diff --git a/docs/endpointpolicymanager/browser-router/_category_.json b/docs/endpointpolicymanager/browser-router/_category_.json new file mode 100644 index 0000000000..5e6f0452ac --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Browser Router", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/manual/_category_.json b/docs/endpointpolicymanager/browser-router/manual/_category_.json new file mode 100644 index 0000000000..3f097c52c3 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Manual", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/48_1_image001.webp b/docs/endpointpolicymanager/browser-router/manual/assets/48_1_image001.webp new file mode 100644 index 0000000000..dcc70973a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/48_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/48_2_image002.webp b/docs/endpointpolicymanager/browser-router/manual/assets/48_2_image002.webp new file mode 100644 index 0000000000..8514481a54 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/48_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/48_3_image003.webp b/docs/endpointpolicymanager/browser-router/manual/assets/48_3_image003.webp new file mode 100644 index 0000000000..33072739c4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/48_3_image003.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/48_4_image004.webp b/docs/endpointpolicymanager/browser-router/manual/assets/48_4_image004.webp new file mode 100644 index 0000000000..399064be54 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/48_4_image004.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/48_5_image005.webp b/docs/endpointpolicymanager/browser-router/manual/assets/48_5_image005.webp new file mode 100644 index 0000000000..a52606c0be Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/48_5_image005.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/507_1_image-20201229224350-1_950x136.webp b/docs/endpointpolicymanager/browser-router/manual/assets/507_1_image-20201229224350-1_950x136.webp new file mode 100644 index 0000000000..34ece00389 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/507_1_image-20201229224350-1_950x136.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/507_2_image-20201229224350-2.webp b/docs/endpointpolicymanager/browser-router/manual/assets/507_2_image-20201229224350-2.webp new file mode 100644 index 0000000000..4583eb758f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/507_2_image-20201229224350-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/507_3_image-20201229224350-3.webp b/docs/endpointpolicymanager/browser-router/manual/assets/507_3_image-20201229224350-3.webp new file mode 100644 index 0000000000..33c82974cb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/507_3_image-20201229224350-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/507_4_image-20201229224350-4.webp b/docs/endpointpolicymanager/browser-router/manual/assets/507_4_image-20201229224350-4.webp new file mode 100644 index 0000000000..925e14bd96 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/507_4_image-20201229224350-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/507_5_image-20201229224350-5_950x366.webp b/docs/endpointpolicymanager/browser-router/manual/assets/507_5_image-20201229224350-5_950x366.webp new file mode 100644 index 0000000000..c9cb934d0c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/507_5_image-20201229224350-5_950x366.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/507_6_image-20201229224350-6.webp b/docs/endpointpolicymanager/browser-router/manual/assets/507_6_image-20201229224350-6.webp new file mode 100644 index 0000000000..113d6a301a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/507_6_image-20201229224350-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_1_hfkb-1127-img-01_950x761.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_1_hfkb-1127-img-01_950x761.webp new file mode 100644 index 0000000000..7e93b8de48 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_1_hfkb-1127-img-01_950x761.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_2_hfkb-1127-img-02.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_2_hfkb-1127-img-02.webp new file mode 100644 index 0000000000..316b225b9a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_2_hfkb-1127-img-02.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_3_hfkb-1127-img-03_950x747.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_3_hfkb-1127-img-03_950x747.webp new file mode 100644 index 0000000000..cb12972cd4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_3_hfkb-1127-img-03_950x747.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_4_hfkb-1127-img-04_950x499.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_4_hfkb-1127-img-04_950x499.webp new file mode 100644 index 0000000000..db61887df3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_4_hfkb-1127-img-04_950x499.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_5_hfkb-1127-img-05_950x643.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_5_hfkb-1127-img-05_950x643.webp new file mode 100644 index 0000000000..7592d2f91b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_5_hfkb-1127-img-05_950x643.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_6_hfkb-1127-img-06_950x684.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_6_hfkb-1127-img-06_950x684.webp new file mode 100644 index 0000000000..338c0a7e1b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_6_hfkb-1127-img-06_950x684.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_7_hfkb-1127-img-07_950x496.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_7_hfkb-1127-img-07_950x496.webp new file mode 100644 index 0000000000..401bbbadeb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_7_hfkb-1127-img-07_950x496.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_8_hfkb-1127-img-08_950x467.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_8_hfkb-1127-img-08_950x467.webp new file mode 100644 index 0000000000..e14bff912b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_8_hfkb-1127-img-08_950x467.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/835_9_hfkb-1127-img-09_950x455.webp b/docs/endpointpolicymanager/browser-router/manual/assets/835_9_hfkb-1127-img-09_950x455.webp new file mode 100644 index 0000000000..13fa915098 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/835_9_hfkb-1127-img-09_950x455.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/907_1_image-20220403003715-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/907_1_image-20220403003715-1.webp new file mode 100644 index 0000000000..a2672d2afa Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/907_1_image-20220403003715-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/907_2_image-20220403003715-2.webp b/docs/endpointpolicymanager/browser-router/manual/assets/907_2_image-20220403003715-2.webp new file mode 100644 index 0000000000..245b558f47 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/907_2_image-20220403003715-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/907_3_image-20220403003715-3.webp b/docs/endpointpolicymanager/browser-router/manual/assets/907_3_image-20220403003715-3.webp new file mode 100644 index 0000000000..5b029ee965 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/907_3_image-20220403003715-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/953_1_thumbnail_image001.webp b/docs/endpointpolicymanager/browser-router/manual/assets/953_1_thumbnail_image001.webp new file mode 100644 index 0000000000..d9943b3999 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/953_1_thumbnail_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/953_2_image002.webp b/docs/endpointpolicymanager/browser-router/manual/assets/953_2_image002.webp new file mode 100644 index 0000000000..23d77ab857 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/953_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router.webp new file mode 100644 index 0000000000..89dd6662fd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_1.webp new file mode 100644 index 0000000000..58752306d4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_10.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_10.webp new file mode 100644 index 0000000000..6a633ea089 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_10.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_14.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_14.webp new file mode 100644 index 0000000000..d25b023116 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_14.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_15.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_15.webp new file mode 100644 index 0000000000..415798000c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_15.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_2.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_2.webp new file mode 100644 index 0000000000..0fce727206 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_21.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_21.webp new file mode 100644 index 0000000000..08b945aedd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_21.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_22.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_22.webp new file mode 100644 index 0000000000..e4e4a545d5 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_22.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_23.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_23.webp new file mode 100644 index 0000000000..906659e63c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_23.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_24.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_24.webp new file mode 100644 index 0000000000..ebf53a5408 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_24.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_3.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_3.webp new file mode 100644 index 0000000000..888d05d1f6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_37.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_37.webp new file mode 100644 index 0000000000..227645cfee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_37.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_38.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_38.webp new file mode 100644 index 0000000000..3169b636ce Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_38.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_39.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_39.webp new file mode 100644 index 0000000000..7abd8480a9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_39.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_4.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_4.webp new file mode 100644 index 0000000000..c5847c07ed Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_40.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_40.webp new file mode 100644 index 0000000000..292faafb67 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_40.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_41.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_41.webp new file mode 100644 index 0000000000..4377dc11a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_41.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_42.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_42.webp new file mode 100644 index 0000000000..4cddc7e920 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_42.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_43.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_43.webp new file mode 100644 index 0000000000..3699a9414d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_43.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_44.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_44.webp new file mode 100644 index 0000000000..3a17669d28 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_44.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_45.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_45.webp new file mode 100644 index 0000000000..a904c94464 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_45.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_46.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_46.webp new file mode 100644 index 0000000000..a9346612eb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_46.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_47.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_47.webp new file mode 100644 index 0000000000..4ed7225872 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_47.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_48.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_48.webp new file mode 100644 index 0000000000..4d45f116e0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_48.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_5.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_5.webp new file mode 100644 index 0000000000..b4bba342c2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_6.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_6.webp new file mode 100644 index 0000000000..e78a68f8d6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_7.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_7.webp new file mode 100644 index 0000000000..4fabd41d7c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_8.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_8.webp new file mode 100644 index 0000000000..08eda0fba6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_9.webp b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_9.webp new file mode 100644 index 0000000000..de60200a00 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/about_endpointpolicymanager_browser_router_9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/browserrouter.webp b/docs/endpointpolicymanager/browser-router/manual/assets/browserrouter.webp new file mode 100644 index 0000000000..788076cae3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/browserrouter.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp new file mode 100644 index 0000000000..9978740d6c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp new file mode 100644 index 0000000000..e19d583566 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp new file mode 100644 index 0000000000..c4034c391b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp new file mode 100644 index 0000000000..324ffec055 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp new file mode 100644 index 0000000000..faa03d7eaf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp new file mode 100644 index 0000000000..f357bbb88e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp new file mode 100644 index 0000000000..c7073b496a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp new file mode 100644 index 0000000000..34c85cd1d0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/170_1_image001.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/170_1_image001.webp new file mode 100644 index 0000000000..54820a032d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/170_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/170_2_image002.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/170_2_image002.webp new file mode 100644 index 0000000000..594e8547ee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/170_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_1_image-20210121211003-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_1_image-20210121211003-1.webp new file mode 100644 index 0000000000..a9d282202b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_1_image-20210121211003-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_2_image-20210121211003-2.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_2_image-20210121211003-2.webp new file mode 100644 index 0000000000..d8fcc4f35d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_2_image-20210121211003-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_3_image-20210121211003-3.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_3_image-20210121211003-3.webp new file mode 100644 index 0000000000..17eeed3cd8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_3_image-20210121211003-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_4_image-20210121211003-4.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_4_image-20210121211003-4.webp new file mode 100644 index 0000000000..ce7ad9e97b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/767_4_image-20210121211003-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/881_1_image-20221228073914-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/881_1_image-20221228073914-1.webp new file mode 100644 index 0000000000..93fbcd7588 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/editpolicytemplate/881_1_image-20221228073914-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_1_image-20190911221425-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_1_image-20190911221425-1.webp new file mode 100644 index 0000000000..2b133aad21 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_1_image-20190911221425-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_2_image-20190911221425-2.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_2_image-20190911221425-2.webp new file mode 100644 index 0000000000..7d15ee0c1b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_2_image-20190911221425-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_3_image-20190911221425-3_950x559.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_3_image-20190911221425-3_950x559.webp new file mode 100644 index 0000000000..cd39fbf10d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_3_image-20190911221425-3_950x559.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_4_image-20190911221425-4_950x354.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_4_image-20190911221425-4_950x354.webp new file mode 100644 index 0000000000..101c0be2f8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_4_image-20190911221425-4_950x354.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_5_image-20190911221425-5_950x150.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_5_image-20190911221425-5_950x150.webp new file mode 100644 index 0000000000..01288fc667 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_5_image-20190911221425-5_950x150.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_6_image-20190911221425-6.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_6_image-20190911221425-6.webp new file mode 100644 index 0000000000..54d38e412e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_6_image-20190911221425-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_7_image-20210105155954-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_7_image-20210105155954-1.webp new file mode 100644 index 0000000000..4e4175e3c2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_7_image-20210105155954-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_8_image-20190911221425-7_950x315.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_8_image-20190911221425-7_950x315.webp new file mode 100644 index 0000000000..ba330fcadf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_8_image-20190911221425-7_950x315.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/483_9_image-20190911221425-8.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_9_image-20190911221425-8.webp new file mode 100644 index 0000000000..130de4454f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/483_9_image-20190911221425-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_11_image-20191222210303-6.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_11_image-20191222210303-6.webp new file mode 100644 index 0000000000..8e853deda2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_11_image-20191222210303-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_13_image-20191222210303-7.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_13_image-20191222210303-7.webp new file mode 100644 index 0000000000..3bde243161 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_13_image-20191222210303-7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_15_image-20191222210303-8.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_15_image-20191222210303-8.webp new file mode 100644 index 0000000000..7e18258447 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_15_image-20191222210303-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_17_image-20191222210303-9.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_17_image-20191222210303-9.webp new file mode 100644 index 0000000000..fcba78a039 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_17_image-20191222210303-9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_1_image-20191222210303-1.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_1_image-20191222210303-1.webp new file mode 100644 index 0000000000..c1e5763e42 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_1_image-20191222210303-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_3_image-20191222210303-2_457x162.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_3_image-20191222210303-2_457x162.webp new file mode 100644 index 0000000000..60f924537d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_3_image-20191222210303-2_457x162.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_5_image-20191222210303-3.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_5_image-20191222210303-3.webp new file mode 100644 index 0000000000..4324923add Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_5_image-20191222210303-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_7_image-20191222210303-4.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_7_image-20191222210303-4.webp new file mode 100644 index 0000000000..f039559009 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_7_image-20191222210303-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/install/535_9_image-20191222210303-5.webp b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_9_image-20191222210303-5.webp new file mode 100644 index 0000000000..304e571036 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/install/535_9_image-20191222210303-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp new file mode 100644 index 0000000000..964bbcf082 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp new file mode 100644 index 0000000000..b52876ad0e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp new file mode 100644 index 0000000000..8734ba4794 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp new file mode 100644 index 0000000000..15fdff9b40 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp new file mode 100644 index 0000000000..f47fa35a98 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp new file mode 100644 index 0000000000..da8b3902f9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp new file mode 100644 index 0000000000..deb3757608 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp new file mode 100644 index 0000000000..7aceb50d08 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp new file mode 100644 index 0000000000..eca7035523 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp new file mode 100644 index 0000000000..8ae1eeeeca Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp new file mode 100644 index 0000000000..55cd988bb8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp new file mode 100644 index 0000000000..390b623613 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_16.webp b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_16.webp new file mode 100644 index 0000000000..b0b9e11323 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_16.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_17.webp b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_17.webp new file mode 100644 index 0000000000..b30c30c9b4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_17.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_18.webp b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_18.webp new file mode 100644 index 0000000000..a5068da83a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_18.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_19.webp b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_19.webp new file mode 100644 index 0000000000..d89b3ee824 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_19.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_20.webp b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_20.webp new file mode 100644 index 0000000000..258718d24f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/manual/assets/policy/about_endpointpolicymanager_browser_router_20.webp differ diff --git a/docs/endpointpolicymanager/browser-router/manual/block.md b/docs/endpointpolicymanager/browser-router/manual/block.md new file mode 100644 index 0000000000..6fae214c4a --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/block.md @@ -0,0 +1,31 @@ +--- +title: "Using Block Policies" +description: "Using Block Policies" +sidebar_position: 40 +--- + +# Using Block Policies + +You can block specific websites by making a rule and selecting the **Block** website type. You can +choose to provide **Block Text**, which will appear in a pop-up for the user, explaining why they +cannot visit the website. + +:::note +For an overview of using Block policies, see the following video: +[Block web sites from opening in all browsers.](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/blockwebsites.md) +::: + + +![about_policypak_browser_router_16](assets/policy/about_endpointpolicymanager_browser_router_16.webp) + +When you include text in the **Block Text** field, the endpoint will react in all browsers with a +pop-up like this one. + +![about_policypak_browser_router_17](assets/policy/about_endpointpolicymanager_browser_router_17.webp) + +:::note +If you leave the **Block Text** field empty, default text is automatically provided. +::: + + +![about_policypak_browser_router_18](assets/policy/about_endpointpolicymanager_browser_router_18.webp) diff --git a/docs/endpointpolicymanager/browser-router/manual/commandlinearguments.md b/docs/endpointpolicymanager/browser-router/manual/commandlinearguments.md new file mode 100644 index 0000000000..741db5fec7 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/commandlinearguments.md @@ -0,0 +1,37 @@ +--- +title: "Using Command Line Arguments" +description: "Using Command Line Arguments" +sidebar_position: 60 +--- + +# Using Command Line Arguments + +This feature enables you to create a route in situations where you start off in the wrong browser +and want to open up the right browser, with specific options such as  `-incognito` for Chrome and +`-private-window` for Firefox, or launch a custom App-V virtualized Internet Explorer plugin like +this one: + +``` +-noframemerging /appwe:76d7f387-c5c4-44a9-8982-cca6124a6aec.  +``` + +Below is an example of launching www.abc.com in Chrome's incognito mode. + +![about_policypak_browser_router_21](assets/about_endpointpolicymanager_browser_router_21.webp) + +Note how you must specifically include **%url%** to specify where the URL will reside on the command +line. Just selecting **incognito** by itself is not enough. The **%url%** will populate the correct +URL, and it is up to you to place it correctly within the command line arguments structure, based on +your needs. + +Another use for the **Custom** policy that utilizes command line arguments might be if you want to +launch a specific non-browser application instead of launching an actual browser. For example, one +use might be to launch a Remote Desktop Protocol (RDP) session that calls a remote program, which +would usually be a browser on the RDP machine. + +To do this, select **Custom** for the browser type. Then set the **Command Line Arguments** field to +**Yes**. Finally, in the **Custom Browser Path** and **Command Line Arguments** field, specify the +application you want to launch (as in, MSTSC) and the command line arguments to pass (as in, +`c:\temp\file1.rdp /v:server1 8080`). + +![about_policypak_browser_router_22](assets/about_endpointpolicymanager_browser_router_22.webp) diff --git a/docs/endpointpolicymanager/browser-router/manual/custom.md b/docs/endpointpolicymanager/browser-router/manual/custom.md new file mode 100644 index 0000000000..91b6c2020b --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/custom.md @@ -0,0 +1,34 @@ +--- +title: "Using Custom Policies" +description: "Using Custom Policies" +sidebar_position: 50 +--- + +# Using Custom Policies + +Custom policies are useful in a variety of situations. The most common situation concerns a user who +wants to route a website to a browser that isn't Internet Explorer, Edge, Chrome, or Firefox. For +instance, Opera and Vivaldi are two browsers you may have installed on endpoints that you want to +route to. + +:::note +For an overview of using custom policies, see the following video: +[Browser Router with Custom Browsers](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/citrixvirtualapps/custombrowsers.md). +::: + + +You might also want to route websites to virtualized browsers. In this example you can see a +virtualized Firefox. To route to virtualized browsers, simply take the icon's launch target and copy +it. + +![about_policypak_browser_router_19](assets/policy/about_endpointpolicymanager_browser_router_19.webp) + +Then, using Endpoint Policy Manager Browser Router, make a custom route and paste the target path +into the **Custom Browser Path** field. + +![about_policypak_browser_router_20](assets/policy/about_endpointpolicymanager_browser_router_20.webp) + +This technique works for most virtualized browsers such as Microsoft App-V, VMware ThinApp, etc. +Note that once a virtualized browser is opened, Endpoint Policy Manager Browser Router cannot route +away from those browsers and then back to real browsers. This is because Endpoint Policy Manager +Browser Router's helper extensions are not installed in the virtualized browser. diff --git a/docs/endpointpolicymanager/browser-router/manual/exportcollections.md b/docs/endpointpolicymanager/browser-router/manual/exportcollections.md new file mode 100644 index 0000000000..b72589eee8 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/exportcollections.md @@ -0,0 +1,31 @@ +--- +title: "Exporting Collections" +description: "Exporting Collections" +sidebar_position: 120 +--- + +# Exporting Collections + +Advanced Concepts explains how to use the Endpoint Policy Manager Exporter to wrap up any Endpoint +Policy Manager directives and deliver them using Microsoft Endpoint Manager (SCCM and Intune), KACE, +your own MDM service, or Endpoint Policy Manager Cloud. + +To export a policy for later use using Endpoint Policy Manager Exporter or Endpoint Policy Manager +Cloud, follow thee steps: + +![about_policypak_browser_router_47](assets/about_endpointpolicymanager_browser_router_47.webp) + +**Step 1 –** Right-click the collection or the policy and select **Export to XML**. This enables you +to save an XML file for later use. + +![about_policypak_browser_router_48](assets/about_endpointpolicymanager_browser_router_48.webp) + +Choose a policy and select Export to XML. + +:::note +Exported collections or policies maintain any Item-Level Targeting that is set. Endpoint +Policy Manager Browser Router policies are always contained within collections, even if you export +one single policy. In other words, a collection is automatically created at the time of export if +you export a single policy. + +::: diff --git a/docs/endpointpolicymanager/browser-router/manual/internetexplorer/_category_.json b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/_category_.json new file mode 100644 index 0000000000..96c4b6b339 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Understanding Browser Router and Internet Explorer", + "position": 80, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/manual/internetexplorer/convertxmls.md b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/convertxmls.md new file mode 100644 index 0000000000..f343722ca1 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/convertxmls.md @@ -0,0 +1,43 @@ +--- +title: "Converting Existing IE Site List XMLs" +description: "Converting Existing IE Site List XMLs" +sidebar_position: 20 +--- + +# Converting Existing IE Site List XMLs + +:::note +To get an overview on how to convert existing IE site lists, please see: +[Internet Explorer to Endpoint Policy Manager Browser Router Site lists](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/iesitelists.md). +::: + + +Now let's see how you can take a Microsoft Enterprise Mode Internet Explorer site list and quickly +convert it to be used in Endpoint Policy Manager Browser Router. This saves you the time and trouble +of converting all of the list information by hand. + +First, you need an Enterprise Mode site list. If you don't have an existing site list already, +Microsoft has a tool you can use to create these lists that you can download at: +[https://www.microsoft.com/en-us/download/details.aspx?id=49974](https://www.microsoft.com/en-us/download/details.aspx?id=49974). +Simply run the tool and add the sites along with their necessary parameters as is shown below. + +![about_policypak_browser_router_31](assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp) + +When this is complete, save the list as an XML file. Once you have a list, create a **From +Enterprise Mode Site List** rule using Endpoint Policy Manager Browser Router. + +![about_policypak_browser_router_32](assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp) + +You will then be prompted to point to the created list. Once selected, a pop-up will confirm the +number of rules being imported. You can choose to import the rules into the existing collection or a +new collection. + +![about_policypak_browser_router_33](assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp) + +The imported rules now appear. + +![about_policypak_browser_router_34](assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp) + +You can review any of the rules to confirm or change their settings. + +![about_policypak_browser_router_35](assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp) diff --git a/docs/endpointpolicymanager/browser-router/manual/internetexplorer/edgemod.md b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/edgemod.md new file mode 100644 index 0000000000..e937c448c5 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/edgemod.md @@ -0,0 +1,107 @@ +--- +title: "Internet Explorer in Edge Mode" +description: "Internet Explorer in Edge Mode" +sidebar_position: 10 +--- + +## Internet Explorer in Edge Mode + +:::note +To get an overview of Endpoint Policy Manager Browser Router and Internet Explorer in Edge +Mode, please see: +[Endpoint Policy Manager Browser Router: Internet Explorer in Edge mode](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/ieedgemode.md). +::: + + +If you want to stay with a Microsoft browser, you want your user to use Edge rather than IE. But +some intranet sites don't support Edge, so you are forced to use IE. However, instead of forcing +users to open a dedicated IE session for these sites, you can use Endpoint Policy Manager Browser +Router to enforce IE in Edge for any site of your choosing. In other words, it tucks IE tabs into +the Edge browser. + +:::warning +Be aware that this is only guaranteed to work in the 2004 version of Windows 10, +however, it might work in versions 1909, 1903, and 1809. +::: + + +Create a rule for +[www.endpointpolicymanager.com](http://www.endpointpolicymanager.com/video/endpointpolicymanager-browser-router-and-ports.html) and +assign it to IE. This time select **Open as IE in Edge tab** . + +![about_policypak_browser_router_29](assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp) + +When the user logs on and tries to access [www.endpointpolicymanager.com](http://www.endpointpolicymanager.com/) they should +see it open as an IE tab in Edge. We say should because the rule will not work right away. There is +a detail called the 65 second rule, which you can read more about here +[https://docs.microsoft.com/en-us/microsoft-edge/deploy/emie-to-improve-compatibility](http://www.endpointpolicymanager.com/video/endpointpolicymanager-troubleshooting-with-admx-files.html). +From the first time a user accesses +[www.endpointpolicymanager.com](http://www.endpointpolicymanager.com/knowledge-base/browser-router-troubleshooting/how-to-quickly-troubleshoot-endpointpolicymanager-browser-router.html), +a period of 65 seconds or so has to transpire until the rule comes fully into effect. Here you can +see that the Endpoint Policy Manager website now appears in IE mode within the Edge browser itself: + +![about_policypak_browser_router_30](assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp) + +### Converting Existing IE Site List XMLs + +:::note +To get an overview on how to convert existing IE site lists, please see +[Internet Explorer to Endpoint Policy Manager Browser Router Site lists](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/iesitelists.md). +::: + + +See how you can take a Microsoft Enterprise Mode Internet Explorer site list and quickly convert it +to be used in Endpoint Policy Manager Browser Router. This saves you the time and trouble of +converting all of the list information by hand. + +First, you need an Enterprise Mode site list. If you don't have an existing site list already, +Microsoft has a tool you can use to create these lists that you can download at +[https://www.microsoft.com/en-us/download/details.aspx?id=49974](https://www.microsoft.com/en-us/download/details.aspx?id=49974). +Simply run the tool and add the sites along with their necessary parameters. + +![about_policypak_browser_router_31](assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp) + +When this is complete, save the list as an XML file. Once you have a list, create a **From +Enterprise Mode Site List** rule using Endpoint Policy Manager Browser Router. + +![about_policypak_browser_router_32](assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp) + +You are then prompted to point to the created list. Once selected, a pop-up confirms the number of +rules being imported. You can choose to import the rules into the existing collection or a new +collection. + +![about_policypak_browser_router_33](assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp) + +The imported rules now appear. + +![about_policypak_browser_router_34](assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp) + +You can review any of the rules to confirm or change their settings. + +![about_policypak_browser_router_35](assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp) + +### Using Special Policy Types for Internet Explorer + +There are two special policies that may be used only once per collection . These policies manage how +the Windows 10 Edge browser functions alongside Internet Explorer 11. + +:::note +To get an overview of Endpoint Policy Manager Browser Router's special policies for +Microsoft Edge, please see +[Endpoint Policy Manager and Edge ‘Special' policies](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/edgespecial.md). +::: + + +The policies are **All intranet to IE** policy and **All Enterprise from Edge to I**E policy. + +![about_policypak_browser_router_36](assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp) + +The **All intranet to IE** policy will take all websites that are already defined in the Intranet +zone and ensure that those sites open in Internet Explorer 11 whenever the user tries to use +Microsoft Edge. In other words, once this policy is applied, if a user opens an Intranet site using +Edge, it is automatically routed to Internet Explorer 11. + +All Enterprise from Edge to IE policy will take all websites that are already defined in the IE +Enterprise site list and route them to Internet Explorer. In other words, once this policy is +applied, if a user opens any website within Edge that you've set to Enterprise Mode, it is +automatically routed to Internet Explorer 11. diff --git a/docs/endpointpolicymanager/browser-router/manual/internetexplorer/overview.md b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/overview.md new file mode 100644 index 0000000000..b553fea298 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/overview.md @@ -0,0 +1,88 @@ +--- +title: "Understanding Browser Router and Internet Explorer" +description: "Understanding Browser Router and Internet Explorer" +sidebar_position: 80 +--- + +# Understanding Browser Router and Internet Explorer + +Endpoint Policy Manager Browser Router has special functions for managing Internet Explorer. First, +you can set Internet Explorer 11's Enterprise Mode and Document Modes for an individual website. +Second, there are also two overriding policies that help route many websites to Internet Explorer, +which is something that IT departments often want to do. + +## Setting Internet Explorer Enterprise Modes and Document Modes + +Internet Explorer 11, when patched to certain levels, will embrace Enterprise Mode (EM) and Document +Modes (DM). Internet Explorer 11 EM and DM enable you to tell Internet Explorer 11 how to render +certain websites for a more compatible view. + +:::note +To get an overview of Endpoint Policy Manager Browser Router and Internet Explorer 11's +Enterprise and Document Modes, please see +[http://www.endpointpolicymanager.com/video/endpointpolicymanager-browser-router-enterprise-and-document-modes.html](http://www.endpointpolicymanager.com/video/endpointpolicymanager-browser-router-block-web-sites-from-opening-in-all-browsers.html). +::: + + +:::note +To learn more about Internet Explorer 11 Enterprise and Document Modes, see the following +Microsoft websites: Enterprise Mode is at: +[Internet Explorer to Endpoint Policy Manager Browser Router Site lists](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/iesitelists.md) +and Document Modes is at: +[https://technet.microsoft.com/en-us/library/dn321432.aspx](http://www.endpointpolicymanager.com/video/endpointpolicymanager-using-pp-browser-router-on-citrix-or-rds-servers-with-published-browser-applications.html). +::: + + +:::warning +This Endpoint Policy Manager Browser Router method is meant to replace the Microsoft +method of creating Enterprise Mode site lists. Do not try to use Microsoft's list (explained in the +Microsoft URL above) along with Endpoint Policy Manager Browser Router's function. Only use Endpoint +Policy Manager Browser Router to perform this function. +::: + + +Using Endpoint Policy Manager Browser Router, you can require particular websites to use a specific +Internet Explorer Enterprise Mode or Document Mode. + +![about_policypak_browser_router_25](assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp) + +Internet Explorer 11's Enterprise Mode has two specifications: v1 and v2. Endpoint Policy Manager +Browser Router automatically detectsthe version of Internet Explorer installed on your endpoint +machines and write the Enterprise site list based on the correct specification. Note that **PORT** +is not supported in the Internet Explorer EM v1 specification, and as such, is ignored when v1 site +lists must be used. + +:::note +Site lists for v2 are automatically created and used when Windows 10 and Internet Explorer +11 (version 11.0.10586.\*) are detected. Site lists for v1 are used in all other circumstances. +::: + + +Note the checkbox labeled **Don't make a route**. If the user is already using Firefox or Chrome and +goes to this website, Internet Explorer will always open when **Don't make a route** is unchecked. +When it is checked, the user is free to use Firefox or Chrome on this website, and they will only +see the Internet Explorer Document Mode set when they specifically select Internet Explorer. This +gives you the ability to use Endpoint Policy Manager Browser Router to manage the Internet Explorer +Enterprise Mode site list without having to force users to specifically use Internet Explorer and +impose a route. + +You can easily see if Endpoint Policy Manager Browser Router and the Internet Explorer 11 Enterprise +Mode are working. There's an Internet Explorer 11 EM icon in the title bar next to the address bar +that demonstrates that EM is active. + +![about_policypak_browser_router_26](assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp) + +If you've chosen to use one of the Internet Explorer Document Modes, you might have a hard time +locating them if they are applying correctly since they are difficult to see. For instance, here +we've set a page to display in IE5 Document Mode using Endpoint Policy Manager Browser Router. + +![about_policypak_browser_router_27](assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp) + +When users visit the website at this point, Endpoint Policy Manager Browser Router correctly sets +the IE Document Mode accordingly. To see the DM, you need to press F12 within Internet Explorer 11 +for **Developer Tools**, and then click the Emulation tab. + +![about_policypak_browser_router_28](assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp) + +In this way, you can easily create routes for all webpages that need special rendering modes using +Endpoint Policy Manager Browser Router. diff --git a/docs/endpointpolicymanager/browser-router/manual/internetexplorer/specialtypes.md b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/specialtypes.md new file mode 100644 index 0000000000..c50a9156c8 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/internetexplorer/specialtypes.md @@ -0,0 +1,32 @@ +--- +title: "Using Special Policy Types for Internet Explorer" +description: "Using Special Policy Types for Internet Explorer" +sidebar_position: 30 +--- + +# Using Special Policy Types for Internet Explorer + +There are two special policies that may be used only once per collection (see Figure 37 for +reference). These policies manage how the Windows 10 Edge browser functions alongside Internet +Explorer 11. + +:::note +To get an overview of Endpoint Policy Manager Browser Router's special policies for +Microsoft Edge, please see +[Endpoint Policy Manager and Edge ‘Special' policies](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/edgespecial.md). +::: + + +The policies are **All intranet to IE** policy and **All Enterprise from Edge to IE** policy. + +![about_policypak_browser_router_36](assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp) + +The **All intranet to IE** policy takes all websites that are already defined in the Intranet zone +and ensure that those sites open in Internet Explorer 11 if the user tries to use Microsoft Edge. In +other words, once this policy is applied, if a user opens an Intranet site using Edge, it will +automatically be routed to Internet Explorer 11. + +**All Enterprise from Edge to IE** policy takes all websites that are already defined in the IE +Enterprise site list and routes those to Internet Explorer. In other words, once this policy is +applied, if a user opens any website within Edge that you've set to Enterprise Mode, it will +automatically be routed to Internet Explorer 11. diff --git a/docs/endpointpolicymanager/browser-router/manual/itemleveltargeting.md b/docs/endpointpolicymanager/browser-router/manual/itemleveltargeting.md new file mode 100644 index 0000000000..4ae7bcaa58 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/itemleveltargeting.md @@ -0,0 +1,70 @@ +--- +title: "Using Item-Level Targeting with Collections and Policies" +description: "Using Item-Level Targeting with Collections and Policies" +sidebar_position: 90 +--- + +# Using Item-Level Targeting with Collections and Policies + +Item-Level Targeting is used in Microsoft Group Policy Preferences and other areas of Endpoint +Policy Manager to target or filter where specific items will apply. With Endpoint Policy Manager +Browser Router, Item-Level Targeting can be used with collections as well as Browser Router policies +within collections. + +To do this, right-click **Collection** and select **Change Item Level Targeting** + +![about_policypak_browser_router_37](assets/about_endpointpolicymanager_browser_router_37.webp) + +Alternatively, within a Browser Router policy, you can dictate when a policy will apply by clicking +**Item Level Targeting**. + +![about_policypak_browser_router_38](assets/about_endpointpolicymanager_browser_router_38.webp) + +The **Edit Item Level Targeting** menu item brings up the **Targeting Editor**. You can select any +combination of characteristics you want to test for. Administrators familiar with Group Policy +Preferences' Item-Level Targeting will be at home in this interface as it is functionally +equivalent. + +You can apply one or more targeting items to a policy, which enables targeting items to be joined +logically. You can also add targeting collections, which group together targeting items in much the +same way parentheses are used in an equation. In this way, you can create a complex determination +about where a policy will be applied. Collections may be set to **And**, **Or**, **Is**, or **Is +Not**. + +![about_policypak_browser_router_39](assets/about_endpointpolicymanager_browser_router_39.webp) + +In this example, the Pak would only apply to Windows 10 machines when the machine is portable and +the user is in the FABRIKAM\Traveling Sales Users group. + +Below are some real-world examples of how you can use Item-Level Targeting. + +- Software prerequisites - If you want to configure an application's settings, first make sure the + application is installed on the user's computer before configuring it. You can use **File Match** + or **Registry Match** targeting items (or both) to verify a specific version of a file or a + registry entry is present. For an example of this, look in the Uninstall registry key. +- Mobile computers - If you want to deploy settings exclusively for users on mobile PCs, filter the + rule to apply only to mobile PCs by using the **Portable Computer** targeting item. +- Operating system version - You can specify different settings for applications based on the + operating system version. To do this, create one rule for each operating system, then filter each + rule using the **Operating System** targeting item. +- Group membership - You can link the **Group Policy Object** (GPO) to the whole domain or + organizational unit (OU), but only members within a specific group will pick up and process the + rule settings. +- IP range - You can specify different settings for various IP ranges, like different settings for + the home office and each field office. + +Close the editor when done. You canl see that the collection's icon has changed to orange, which +shows that it now has Item-Level Targeting on the whole collection. In other words, none of the +items in the collection will apply unless the Item-Level Targeting on the collection evaluates to +**True**. + +![about_policypak_browser_router_40](assets/about_endpointpolicymanager_browser_router_40.webp) + +Within the collection, if you set Item-Level Targeting within any policy, you'll see the icon turn +orange, and the Item-Level Targeting column will indicate if Item-Level Targeting is on **Yes** or +off **No**. + +![about_policypak_browser_router_41](assets/about_endpointpolicymanager_browser_router_41.webp) + +This feature allows you toadd very granular filters. First, filter with Item-Level Targeting in a +collection, and then filter on any specific rule if any Item-Level Targeting is applied there. diff --git a/docs/endpointpolicymanager/browser-router/manual/navigation.md.backup b/docs/endpointpolicymanager/browser-router/manual/navigation.md.backup new file mode 100644 index 0000000000..9cd29fb951 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/navigation.md.backup @@ -0,0 +1,98 @@ +--- +title: "Getting to Know Browser Router" +description: "Getting to Know Browser Router" +sidebar_position: 10 +--- + +# Getting to Know Browser Router + +Endpoint Policy Manager Browser Router editor is located in the Endpoint Policy Manager node. +Endpoint Policy Manager Browser Router enables you to create a new Endpoint Policy Manager Browser +Router policy or collection. + +:::note +The Browser Router node is only visible with the latest Admin Console MSI installed on +your management station. +::: + + +![about_policypak_browser_router](assets/about_endpointpolicymanager_browser_router.webp) + +All Endpoint Policy Manager Browser Router policies must always reside within collections. There are +two steps for this. + +![about_policypak_browser_router_1](assets/about_endpointpolicymanager_browser_router_1.webp) + +**Step 1 –** Create and name a collection. + +**Step 2 –** Put Browser Router policies (or other collections) inside the collection. + +![about_policypak_browser_router_2](assets/about_endpointpolicymanager_browser_router_2.webp) + +You can create collections and policies within collections on either the User or Computer side (or +both). Endpoint Policy Manager Browser Router has a precedence order if you decide to have multiple +policies, collections, or GPOs, or when you choose to use a "on-Group Policy method to deliver +settings. + +For more in formation on this, please see the section on +[Understanding Processing Order and Precedence](processorderprecedence.md). + +To complete the Quickstart examples, we recommend creating a collection on the User side. Next, +create a new Browser Router policy, similar to the one shown below. In this example, we are routing +all requests for www.microsoft.com to Internet Explorer. + +![about_policypak_browser_router_3](assets/about_endpointpolicymanager_browser_router_3.webp) + +Once you click **OK**, you'll get an entry such as the one shown below. + +![about_policypak_browser_router_4](assets/about_endpointpolicymanager_browser_router_4.webp) + +If you'd like to follow along, create two more Browser Router policies in the same collection. In +the next example, we will route www.GPanswers.com to Firefox. + +![about_policypak_browser_router_5](assets/about_endpointpolicymanager_browser_router_5.webp) + +Click OK to save the entry. + +Create another policy to route \*.endpointpolicymanager.com to Edge. + +![about_policypak_browser_router_6](assets/about_endpointpolicymanager_browser_router_6.webp) + +Last, create an entry for **New Default Browser**. + +![about_policypak_browser_router_7](assets/about_endpointpolicymanager_browser_router_7.webp) + +After you do this, a dialog box with limited options appear. You can only choose a default browser, +which will be Chrome. + +![about_policypak_browser_router_8](assets/about_endpointpolicymanager_browser_router_8.webp) + +When you've finished these actions, your entries will resemble these. + +![about_policypak_browser_router_9](assets/about_endpointpolicymanager_browser_router_9.webp) + +Below is an explanation of each column in the editor: + +- Setting - This is the name you gave the policy. The default browser is always named Default + Browser. +- Enabled (True/False) - A policy entry can be enabled, which means it will go to work. If you need + to temporarily stop a policy entry from applying, you can disable it (set it to False). +- Scope - This is either User or Computer, depending on what side of the GPO you are on. +- Item-Level Targeting (No/Yes) - See the section on "Using Item-Level Targeting with Collections + and Policies" for more information on this. +- Browser - This column lists what browser a particular entry will route to. +- Pattern - Explains what type of pattern (rules) we are following. The types are URL, Wildcard, + RegEx, and Internet Security Zone. + +On the endpoint, log on as a user who gets the GPO (or run GPupdate if the user is already logged +on). Make sure that Internet Explorer, Firefox, and Chrome are all installed. You will be ready to +go if you followed along with the Endpoint Policy Manager Browser Router Quickstart, created a new +Wordpad document, and typed in each URL (www.microsoft.com, www.gpanswers.com, +[www.endpointpolicymanager.com](https://technet.microsoft.com/en-us/library/dn321432.aspx)). Next, type in a URL +that is unrelated to anything, such as www.abc.com. Based on the rules, the correct browser is +opened for each URL. + +![about_policypak_browser_router_10](assets/about_endpointpolicymanager_browser_router_10.webp) + +Notice that since there was no rule for www.abc.com, the overriding Default Browser rule took effect +and launched Internet Explorer. diff --git a/docs/endpointpolicymanager/browser-router/manual/osweb.md b/docs/endpointpolicymanager/browser-router/manual/osweb.md new file mode 100644 index 0000000000..fe96eebf09 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/osweb.md @@ -0,0 +1,22 @@ +--- +title: "Using \"OS Web Browser Look & Feel\"" +description: "Using \"OS Web Browser Look & Feel\"" +sidebar_position: 110 +--- + +# Using "OS Web Browser Look & Feel" + +Browser Router has a policy called OS Web Browser Look & Feel. + +The **OS Web Browser Look & Feel** policy post the display used in the Windows settings for Default +Web browser. + +![about_policypak_browser_router_44](assets/about_endpointpolicymanager_browser_router_44.webp) + +There are two options available: + +![about_policypak_browser_router_45](assets/about_endpointpolicymanager_browser_router_45.webp)> + +The end result looks like this. Note that the default browser is also displayed. + +![about_policypak_browser_router_46](assets/about_endpointpolicymanager_browser_router_46.webp) diff --git a/docs/endpointpolicymanager/browser-router/manual/overview.md b/docs/endpointpolicymanager/browser-router/manual/overview.md new file mode 100644 index 0000000000..5cbdcdfeb2 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/overview.md @@ -0,0 +1,111 @@ +--- +title: "Browser Router" +description: "Browser Router" +sidebar_position: 20 +--- + +# Browser Router + +:::note +Before reading this section, please ensure you have read +[Installation Quick Start](/docs/endpointpolicymanager/manuals/introductionandquick/overviewinstall/overviewinstall.md), which explain how to: +::: + + +- Install the Admin MSI on your GPMC machine +- Install the CSE on a test Windows machine +- Set up a computer in Trial mode or Licensed mode +- Set up a common OU structure + +Optionally, if you don't want to use Group Policy, read the sectionon **Advanced Concepts on Group +Policy and non-Group Policy methods** (MEMCM, KACE, and MDM service or Netwrix Endpoint Policy +Manager (formerly PolicyPak) Cloud), located +in[Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md). This information on +how to deploy your directives. + +:::note +Watch this video for an overview of Endpoint Policy Manager Browser Router: +[](http://www.endpointpolicymanager.com/video/endpointpolicymanager-browser-router-ensure-users-utilize-the-right-browser-for-the-right-website.html)[Ensure users utilize the RIGHT browser for the right website !](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/rightbrowser.md). +::: + + +Let's say you wanted to apply the following routing policies: + +- www.microsoft.com is set to Internet Explorer. +- www.gpanswers.com is set to Firefox. +- \*.endpointpolicymanager.com is set to Edge. +- abc.endpointpolicymanager.com is set to Firefox via App-V. +- xyz.endpointpolicymanager.com is set to Chrome via ThinApp. +- All websites with \*xxx\* in the name are blocked; that is, a browser will not launch for them. + +With Endpoint Policy Manager Browser Router, you can apply all of the above policies and more. +Browser Router enables you to perform the following functions: + +- Assemble settings (policies) into collections. +- Set Item-Level Targeting on policies and collections. +- Deliver user-side policies to the Computer side without Group Policy Loopback mode. +- Create exact criteria for when specific websites should open, and in which browser. +- Export policies or collections as XML files (which can be used with Endpoint Policy Manager + Exporter and Endpoint Policy Manager Cloud). See + [Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md) for more details. +- Set custom messages when you have blocked a website. +- Dynamically set Internet Explorer 11 Enterprise Mode (IE 11 EM) and Document Modes site lists. +- Automatically write Internet Explorer 11 EM version 1 or version 2 site lists, based on the + machine type. +- Route all intranet traffic from Microsoft Edge to IE 11. +- Route all sites on Internet Explorer Site List from Edge to IE 11. + +If you would like to perform your own Quickstart with Endpoint Policy Manager Browser Router, it is +recommended that you have one endpoint (Windows 10) set up with the following browsers: + +- Internet Explorer 11 +- Firefox (latest) +- Chrome (latest) + +There are more advanced scenarios, but this will get you going quickly. + +There are a few basic ways to use Endpoint Policy Manager Browser Router. First, you can create one +or multiple Microsoft Group Policy Objects (GPOs) using Endpoint Policy Manager Browser Router. If +you use Group Policy as the delivery mechanism, that directive is deployed to client machines. +Alternatively, you can export the Endpoint Policy Manager Browser Router rules and deliver them via +the following methods: + +Microsoft Endpoint Manager (SCCM and/or Intune) + +- Systems management software +- Endpoint Policy Manager Cloud service + +The client machine with the Endpoint Policy Manager client-side extension (CSE) embraces the +directives and performs the work. + +:::note +If you use the Endpoint Policy Manager Cloud service, you can deliver Group Policy +settings over the Internet, even to non-domain-joined machines. +::: + + +:::note +You can also use Endpoint Policy Manager Browser Router with your Citrix or RDS servers. +See the following video for more information: +[Using PP Browser Router on Citrix or RDS servers with published browser applications](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/citrixvirtualapps/citrix.md). +::: + + +## Endpoint Policy Manager Browser Router Moving Parts + +You will need the following to get started with Endpoint Policy Manager Browser Router: + +- A management station. You must install the Endpoint Policy Manager Admin Console MSI on the + management station where you create GPOs. Once it's installed, you'll see the Endpoint Policy + Manager | Endpoint Policy Manager Browser Router node. +- The Endpoint Policy Manager CSE that runs on the client (target) machine. This is the same CSE for + all Endpoint Policy Manager products; there isn't anything separate to install. The Endpoint + Policy Manager CSE must be present in order to accept Endpoint Policy Manager Security Settings + Manager directives when using Microsoft Endpoint Manager (SCCM and Intune), KACE, similar + utilities, or Endpoint Policy Manager Cloud. +- Endpoints. Endpoints must be licensed for Endpoint Policy Manager Browser Router using one of the + licensing methods. +- Endpoint Policy Manager Exporter (optional). This is a free utility that lets you take exported + Group Policy and Endpoint Policy Manager XML files and wrap them into a "portable" MSI file for + deployment using Microsoft Endpoint Manager (SCCM and Intune) or your own systems management + software. diff --git a/docs/endpointpolicymanager/browser-router/manual/overview_1.md b/docs/endpointpolicymanager/browser-router/manual/overview_1.md new file mode 100644 index 0000000000..019539b254 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/overview_1.md @@ -0,0 +1,41 @@ +--- +title: "Understanding Default Browser Policies" +description: "Understanding Default Browser Policies" +sidebar_position: 20 +--- + +# Understanding Default Browser Policies + +In the previous example, you used the **New Default Browser** policy to set the default browser to +Internet Explorer. In this way, Internet Explorer only would be used when users click on an external +link (e.g., from an email) and there is no other rule routing to a specific browser. Any of the +browsers can be the default, but only one can be chosen as the default. Additionally, there is a +special browser called **User Selectable**. Below you can see how to select the default browser. + +:::note +For an overview of the User Selectable option, see +[Endpoint Policy Manager Browser Router User-Selected Default](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/userselecteddefault.md). +::: + + +![about_policypak_browser_router_11](assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp) + +The **User Selectable** option enables the user to specify their desired default browser as Internet +Explorer, Edge, Chrome, or Firefox. The Endpoint Policy Manager engine "learns" this setting at the +next Group Policy background update (or if GPupdate is manually invoked). This means there could be +a situation where the user changes their default browser, but then logs off before Group Policy +re-applies to capture their desired setting. If this is the case, Endpoint Policy Manager cannot +"learn" the user's desired defaults until the user changes the setting and Group Policy re-applies +it in the background. + +You might also want to specify a default browser one time and then drift. In other words, the user +is assigned a default browser the first time they open a URL but can then change the default browser +to one of their own choosing. In this case, we select the same settings as last time except we +choose to apply the rule only one time, as sown below + +![about_policypak_browser_router_12](assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp) + +Users can then change the default browser to their own liking, even though their settings show that +the web browser is managed by their organization. + +![about_policypak_browser_router_13](assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp) diff --git a/docs/endpointpolicymanager/browser-router/manual/overview_2.md b/docs/endpointpolicymanager/browser-router/manual/overview_2.md new file mode 100644 index 0000000000..ff31074e68 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/overview_2.md @@ -0,0 +1,33 @@ +--- +title: "Troubleshooting" +description: "Troubleshooting" +sidebar_position: 130 +--- + +# Troubleshooting + +We have two guides online to help you troubleshoot Endpoint Policy Manager Browser Router. + +If you're having problems getting Endpoint Policy Manager Browser Router to work, see the following +guide: + +[How to quickly troubleshoot Endpoint Policy Manager Browser Router](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/quick.md). + +If you're having problems getting Endpoint Policy Manager Browser Router to route between browsers +as expected, see the following guide: + +[Troubleshooting routing between browsers.](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/betweenbrowsers.md). + +Additionally, Endpoint Policy Manager Browser Router has extensive logging, which needs to be turned +on. You can do this using the Endpoint Policy Manager Browser Router ADMX templates and turning on +logging. A video of the process can be found here: +[Troubleshooting with ADMX files](/docs/endpointpolicymanager/knowledgebase/gettingstarted/videolearningcenter/troubleshooting/admxfiles.md). + +Log files for Endpoint Policy Manager Browser Router are found in the two following places: + +- `%appdata%\local\PolicyPak\PolicyPak Browser Router` +- `%Programdata%\PolicyPak\PolicyPak Browser Router` + +Logs are automatically wrapped up and can be sent to +[support@endpointpolicymanager.com](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode) +with the PPLOGS.EXE command on any endpoint where the CSE is installed. diff --git a/docs/endpointpolicymanager/browser-router/manual/ports.md b/docs/endpointpolicymanager/browser-router/manual/ports.md new file mode 100644 index 0000000000..ca683dabda --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/ports.md @@ -0,0 +1,33 @@ +--- +title: "Routing Using Ports" +description: "Routing Using Ports" +sidebar_position: 70 +--- + +# Routing Using Ports + +Endpoint Policy Manager Browser Router can open a specific website when a particular website needs a +specific port. In the example below we have `www.portquiz.net:1001` being used for a specific Google +Chrome website. + +![about_policypak_browser_router_23](assets/about_endpointpolicymanager_browser_router_23.webp) + +:::note +For a video on using Endpoint Policy Manager Browser Router and ports, see +[Endpoint Policy Manager Browser Router and Ports](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/ports.md). +::: + + +In this way, you can have granular control over which browser is opened for which website. +Additionally, for Internet Explorer 11, Endpoint Policy Manager Browser Router will automatically +insert the port into Internet Explorer 11 Enterprise Mode v2 site lists. All you need to do is add a +route similar to the one shown below. + +![about_policypak_browser_router_24](assets/about_endpointpolicymanager_browser_router_24.webp) + +:::note +Not every version of Internet Explorer 11 is ready to receive v2 site lists. For a list of +which versions of Internet Explorer 11 use v1 vs v2, see +[When does Endpoint Policy Manager Browser Router write v1 or v2 Enterprise Mode site lists?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/versions.md). + +::: diff --git a/docs/endpointpolicymanager/browser-router/manual/processorderprecedence.md b/docs/endpointpolicymanager/browser-router/manual/processorderprecedence.md new file mode 100644 index 0000000000..111998c71f --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/processorderprecedence.md @@ -0,0 +1,93 @@ +--- +title: "Understanding Processing Order and Precedence" +description: "Understanding Processing Order and Precedence" +sidebar_position: 100 +--- + +# Understanding Processing Order and Precedence + +When you use Endpoint Policy Manager Browser Router you might have multiple policies and/or +conflicting settings. When you do, you need to troubleshoot by understanding the processing order +and precedence order as explained in the following sections. + +## Processing Order + +Within a particular GPO (Computer or User side), the processing order is counted in numerical order. +So, lower-numbered collections attempt to process first, and higher-numbered collections attempt to +process last. + +![about_policypak_browser_router_42](assets/about_endpointpolicymanager_browser_router_42.webp) + +Within any collection, each policy is processed in numerical order from lowest to highest. + +![about_policypak_browser_router_43](assets/about_endpointpolicymanager_browser_router_43.webp) + +## Precedence + +Policies can be delivered by Group Policy and non-Group Policy methods, such as Microsoft Endpoint +Manager (SCCM and Intune) via Endpoint Policy Manager Exporter or Endpoint Policy Manager Cloud. As +such, the Endpoint Policy Manager engine needs to make a final determination whether there is any +overlap of policies. Here is how the precedence works: + +- Policies delivered through Endpoint Policy Manager Cloud have the lowest precedence. +- Policies delivered through Endpoint Policy Manager files have the next highest precedence. +- Policies delivered through Endpoint Policy Manager Group Policy directives have the highest + precedence. + +After that, user-side policy has precedence over computer-side (switched) policy. This is so that +you can specify a baseline setting for various computers and then have particular (overriding) +policies when specific users log on. + +If policies are on the same side, a more-specific URL pattern takes precedence over a less-specific +URL pattern. For example, mail.endpointpolicymanager.com takes precedence over \*.endpointpolicymanager.com. + +If patterns are equally specific, a pattern in a more specific policy always takes precedence over a +pattern in a less-specific policy. For example, a pattern in a GPO linked to an OU wins over a +pattern in a GPO linked to a domain (unless the OU GPO is set to **Enforced**). In other words, +Endpoint Policy Manager Browser Router honors all Group Policy rules and constructs. + +If policies are equally specific, the policy with a higher precedence (which is determined based on +the link order for GPOs and file names for XML Data policies) takes precedence. + +If policies have the same precedence (e.g., we have two patterns in the same GPO), the "last" +pattern takes precedence over previous patterns. For example, patterns in Collection 2 win over +patterns in Collection 1, and any pattern in a collection wins over all previous patterns in the +same collection. + +## Rule Precedence + +Endpoint Policy Manager Browser Router has four rule types. + +![about_policypak_browser_router_14](assets/about_endpointpolicymanager_browser_router_14.webp) + +The following precedence order applies to these rule types. + +| Precedence | Rule | +| ----------- | ------------- | +| Most | URL | +| Second Most | Internet Zone | +| Third Most | Wildcard | +| Last | Regex | + +For instance, if you have a specific URL rule, like google.com gets routed to Firefox, when end +users go directly to google.com, it will open in Firefox. If \*.google.com is routed to Internet +Explorer, then when users go to gmail.google.com, it will open in Internet Explorer. + +Next, we'll look at the precedence of specific rule types of Wildcard and RegEx. + +## Precedence with Wildcards + +Example precedence order with wildcards would be arranged in the following way: + +- google\* +- g\* +- \* + +## Precedence with RegEx + +Items with additional RegEx characters will be considered more specific than those with fewer RegEx +characters. So an example of priority order would be as follows: + +- (x)(.\*)(x)(.\*)(x).com +- (blue)(.\*) +- (.\*) diff --git a/docs/endpointpolicymanager/browser-router/manual/rules.md b/docs/endpointpolicymanager/browser-router/manual/rules.md new file mode 100644 index 0000000000..bb4b2bce67 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/manual/rules.md @@ -0,0 +1,105 @@ +--- +title: "Understanding Browser Router Rules" +description: "Understanding Browser Router Rules" +sidebar_position: 30 +--- + +# Understanding Browser Router Rules + +When you make a new Browser Router policy, you have several ways to make site rules: **URL**, +**Wildcard**, **RegEx**, and **Internet Security Zone**. + +![about_policypak_browser_router_14](assets/about_endpointpolicymanager_browser_router_14.webp) + +## Examples + +The following table shows different types of pattern rules and how they would match. Note that +**Wildcard** can be used to match against Schema, Host, Port, and Path. **RegEx** can only be used +to match against Host. + +| Pattern Rule | Example | Matches | +| -------------------------- | ----------------------------------- | ---------------------------------------------------------------------- | +| Specific URL String | www.endpointpolicymanager.com | [www.endpointpolicymanager.com](http://www.endpointpolicymanager.com/) | +| Wildcard String | www.pol\*.com | endpointpolicymanager.com, politicos.com, pollution.org | +| RegEx (Regular Expression) | (.\*)(pol)(.\*).com | SpolE.com, ESpol24.com, pol.com, etc. | +| Windows IE Zone Pattern | Trusted sites, intranet sites, etc. | All trusted sites, intranet sites, etc. | + +When a pattern matches, it is routed to the correct browser, blocked, or delivered to a custom +browser. + +![about_policypak_browser_router_15](assets/about_endpointpolicymanager_browser_router_15.webp) + +:::note +For specific URL strings, **Apply to child URLs** is set to **yes** by default. This means +that any website that falls underneath that URL will also be affected. +::: + + +You can also select **Block**, which means Endpoint Policy Manager Browser Router won't launch the +URL in any supported browser (Internet Explorer, Firefox, or Chrome), blocking it from launching. +There is also a special type called **Custom**. This can be set to any application that the +administrator wants an end user to open a URL with. One good use for this is that you can specify a +custom entry to open virtualized browsers when using App-V or ThinApp, or route to an alternate +browser such as Opera, Vivaldi, or anything else that can open HTML pages. + +## Wildcard Matching + +While **RegEx** can only be used to match against the host name, Wildcard matching can be utilized +to match against other parts of a site identifier/URL. Patterns are not case-sensitive. A site +identifier consists of the following: + +``` +[Schema://]host[:port][/path] +``` + +where + +- **Schema** must be http, https, \*, or not specified at all. +- **host** is required and must be either a host name, wildcard host name, or \* for any host. +- **port** is optional, and if no port is specified, all ports match. +- **path** is optional, and specified as either a particular path or wildcard path. If a path is not + specified, it matches all paths on host. + +Examples of wildcard matching are shown below. + +Example 1:  Criteria matching only a host name + +Criteria: `*policy*` + +Description: Matches any port and path on a URL with a matching host name that contains the word +"policy" + +Matching examples: + +- http://www.endpointpolicymanager.com +- https://www.endpointpolicymanager.com +- http://www.endpointpolicymanager.com:1234/ +- http://www.endpointpolicymanager.com:5678/any_other_path + +Example 2:  Criteria matching all hosts and a wildcard path + +Criteria: `*/app/*Create*` + +Description: Matches any host and port with a path containing the word "Create" anywhere in the +path. Since host is always mandatory, we MUST specify \* at the beginning for ANY host: + +Matching examples: + +- http://appsvr/app/Create_user.aspx +- https://appsvr/app/Create_item.aspx +- http://appsvr:99/app/Create_prd.aspx +- http://appsvr/app/Create/newrec.aspx + +Example 3: Criteria matching a host, wildcard path, and specific port + +Criteria:`aa.com:8080/*app*/` + +Description:  Matches the aa.com host (www is implied) on port 8080 with the word "app" anywhere in +the path + +Matching examples: + +- http://www.aa.com:8080/app +- https://www.aa.com:8080/res/app/load.aspx +- http://www.aa.com:8080/lib/resapp.aspx +- http://www.aa.com:8080/ffapp/main.aspx diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/_category_.json b/docs/endpointpolicymanager/browser-router/technical-notes/_category_.json new file mode 100644 index 0000000000..fa48a0cf70 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Technical Notes", + "position": 30, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "knowledgebase" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_1_2c5259c2472101dd55c56da8d1dbdb33.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_1_2c5259c2472101dd55c56da8d1dbdb33.webp new file mode 100644 index 0000000000..46fdfb185d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_1_2c5259c2472101dd55c56da8d1dbdb33.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_2_8f4ae9cf7f0bba8ddccb128640467c25.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_2_8f4ae9cf7f0bba8ddccb128640467c25.webp new file mode 100644 index 0000000000..f33ed2d480 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_2_8f4ae9cf7f0bba8ddccb128640467c25.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_3_3e0331eadab3e6c272573b5c3b67e23c.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_3_3e0331eadab3e6c272573b5c3b67e23c.webp new file mode 100644 index 0000000000..13f7bf4cfd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_3_3e0331eadab3e6c272573b5c3b67e23c.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_4_3a4d59894f3cd6623b958202447b1136.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_4_3a4d59894f3cd6623b958202447b1136.webp new file mode 100644 index 0000000000..e55d5e4ccc Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/1326_4_3a4d59894f3cd6623b958202447b1136.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/206_1_image.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/206_1_image.webp new file mode 100644 index 0000000000..8294f763d8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/206_1_image.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_1_img1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_1_img1.webp new file mode 100644 index 0000000000..2d6da0c988 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_1_img1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_2_img2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_2_img2.webp new file mode 100644 index 0000000000..cf5868bbee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_2_img2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_3_img3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_3_img3.webp new file mode 100644 index 0000000000..09a1104c0c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_3_img3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_4_img4-1024x325.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_4_img4-1024x325.webp new file mode 100644 index 0000000000..ff176d02c9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_4_img4-1024x325.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_5_pp-ff-img-01.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_5_pp-ff-img-01.webp new file mode 100644 index 0000000000..68c2bb1986 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_5_pp-ff-img-01.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_6_image_1000x626.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_6_image_1000x626.webp new file mode 100644 index 0000000000..d47e6baf73 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_6_image_1000x626.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_7_img6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_7_img6.webp new file mode 100644 index 0000000000..a6816dcbc9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/267_7_img6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/441_1_image004.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/441_1_image004.webp new file mode 100644 index 0000000000..bdf62b71f4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/441_1_image004.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/441_2_image0012.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/441_2_image0012.webp new file mode 100644 index 0000000000..ff6cec9050 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/441_2_image0012.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_1_image001.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_1_image001.webp new file mode 100644 index 0000000000..dcc70973a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_2_image002.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_2_image002.webp new file mode 100644 index 0000000000..8514481a54 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_3_image003.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_3_image003.webp new file mode 100644 index 0000000000..33072739c4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_3_image003.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_4_image004.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_4_image004.webp new file mode 100644 index 0000000000..399064be54 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_4_image004.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_5_image005.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_5_image005.webp new file mode 100644 index 0000000000..a52606c0be Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/48_5_image005.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_1_image001.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_1_image001.webp new file mode 100644 index 0000000000..b3f456d300 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_2_image002.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_2_image002.webp new file mode 100644 index 0000000000..b9af0961cd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_3_image003.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_3_image003.webp new file mode 100644 index 0000000000..884de6c1cc Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/492_3_image003.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_1_image-20201229224350-1_950x136.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_1_image-20201229224350-1_950x136.webp new file mode 100644 index 0000000000..34ece00389 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_1_image-20201229224350-1_950x136.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_2_image-20201229224350-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_2_image-20201229224350-2.webp new file mode 100644 index 0000000000..4583eb758f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_2_image-20201229224350-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_3_image-20201229224350-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_3_image-20201229224350-3.webp new file mode 100644 index 0000000000..33c82974cb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_3_image-20201229224350-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_4_image-20201229224350-4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_4_image-20201229224350-4.webp new file mode 100644 index 0000000000..925e14bd96 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_4_image-20201229224350-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_5_image-20201229224350-5_950x366.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_5_image-20201229224350-5_950x366.webp new file mode 100644 index 0000000000..c9cb934d0c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_5_image-20201229224350-5_950x366.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_6_image-20201229224350-6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_6_image-20201229224350-6.webp new file mode 100644 index 0000000000..113d6a301a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/507_6_image-20201229224350-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_10_image0012-1024x593.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_10_image0012-1024x593.webp new file mode 100644 index 0000000000..f179750716 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_10_image0012-1024x593.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_1_image007.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_1_image007.webp new file mode 100644 index 0000000000..877400c33e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_1_image007.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_2_image008-1024x395.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_2_image008-1024x395.webp new file mode 100644 index 0000000000..58c3fe17bb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_2_image008-1024x395.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_3_image.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_3_image.webp new file mode 100644 index 0000000000..331d3b6c74 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_3_image.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_4_image013.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_4_image013.webp new file mode 100644 index 0000000000..84955c8aa0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_4_image013.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_5_image014.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_5_image014.webp new file mode 100644 index 0000000000..1960163be9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_5_image014.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_6_image009.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_6_image009.webp new file mode 100644 index 0000000000..9b1aabf1f0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_6_image009.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_7_image010.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_7_image010.webp new file mode 100644 index 0000000000..a0becd0d72 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_7_image010.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_8_image011-1024x487.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_8_image011-1024x487.webp new file mode 100644 index 0000000000..7ad2bea463 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_8_image011-1024x487.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_9_image001-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_9_image001-1.webp new file mode 100644 index 0000000000..fbc14a5b3f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/55_9_image001-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_1_image-20201230005141-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_1_image-20201230005141-1.webp new file mode 100644 index 0000000000..ba59345d1a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_1_image-20201230005141-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_2_image-20201230005141-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_2_image-20201230005141-2.webp new file mode 100644 index 0000000000..d4f37b7252 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_2_image-20201230005141-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_3_image-20201230005141-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_3_image-20201230005141-3.webp new file mode 100644 index 0000000000..43987e888e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/712_3_image-20201230005141-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_1_img-01_950x299.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_1_img-01_950x299.webp new file mode 100644 index 0000000000..d4f008038d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_1_img-01_950x299.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_3_img-02.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_3_img-02.webp new file mode 100644 index 0000000000..5f172c76a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_3_img-02.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_5_img-03.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_5_img-03.webp new file mode 100644 index 0000000000..dd054983de Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_5_img-03.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_7_img-04.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_7_img-04.webp new file mode 100644 index 0000000000..af4e393eb3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_7_img-04.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_9_img-05.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_9_img-05.webp new file mode 100644 index 0000000000..044f675996 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/759_9_img-05.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/764_1_image-20201027210325-1_950x612.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/764_1_image-20201027210325-1_950x612.webp new file mode 100644 index 0000000000..08731ff6ce Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/764_1_image-20201027210325-1_950x612.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/764_3_image-20201027210423-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/764_3_image-20201027210423-2.webp new file mode 100644 index 0000000000..5e8ae961c9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/764_3_image-20201027210423-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/814_1_img-01.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/814_1_img-01.webp new file mode 100644 index 0000000000..4d481ebc67 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/814_1_img-01.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/814_3_img-02.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/814_3_img-02.webp new file mode 100644 index 0000000000..8a793bbebd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/814_3_img-02.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_1_hfkb-1127-img-01_950x761.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_1_hfkb-1127-img-01_950x761.webp new file mode 100644 index 0000000000..7e93b8de48 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_1_hfkb-1127-img-01_950x761.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_2_hfkb-1127-img-02.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_2_hfkb-1127-img-02.webp new file mode 100644 index 0000000000..316b225b9a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_2_hfkb-1127-img-02.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_3_hfkb-1127-img-03_950x747.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_3_hfkb-1127-img-03_950x747.webp new file mode 100644 index 0000000000..cb12972cd4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_3_hfkb-1127-img-03_950x747.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_4_hfkb-1127-img-04_950x499.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_4_hfkb-1127-img-04_950x499.webp new file mode 100644 index 0000000000..db61887df3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_4_hfkb-1127-img-04_950x499.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_5_hfkb-1127-img-05_950x643.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_5_hfkb-1127-img-05_950x643.webp new file mode 100644 index 0000000000..7592d2f91b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_5_hfkb-1127-img-05_950x643.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_6_hfkb-1127-img-06_950x684.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_6_hfkb-1127-img-06_950x684.webp new file mode 100644 index 0000000000..338c0a7e1b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_6_hfkb-1127-img-06_950x684.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_7_hfkb-1127-img-07_950x496.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_7_hfkb-1127-img-07_950x496.webp new file mode 100644 index 0000000000..401bbbadeb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_7_hfkb-1127-img-07_950x496.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_8_hfkb-1127-img-08_950x467.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_8_hfkb-1127-img-08_950x467.webp new file mode 100644 index 0000000000..e14bff912b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_8_hfkb-1127-img-08_950x467.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_9_hfkb-1127-img-09_950x455.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_9_hfkb-1127-img-09_950x455.webp new file mode 100644 index 0000000000..13fa915098 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/835_9_hfkb-1127-img-09_950x455.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/878_1_image-20211223234143-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/878_1_image-20211223234143-1.webp new file mode 100644 index 0000000000..c57ab309c7 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/878_1_image-20211223234143-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/878_2_image-20211223234143-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/878_2_image-20211223234143-2.webp new file mode 100644 index 0000000000..5b157f07a6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/878_2_image-20211223234143-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_1_image-20211223020010-6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_1_image-20211223020010-6.webp new file mode 100644 index 0000000000..498a835b86 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_1_image-20211223020010-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_2_image-20211223020010-7.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_2_image-20211223020010-7.webp new file mode 100644 index 0000000000..d77ea9384b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_2_image-20211223020010-7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_3_image-20211223020010-8.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_3_image-20211223020010-8.webp new file mode 100644 index 0000000000..eaee129af4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_3_image-20211223020010-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_4_image-20211223020010-9.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_4_image-20211223020010-9.webp new file mode 100644 index 0000000000..3bdc5c5e91 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/892_4_image-20211223020010-9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_1_image-20220403003715-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_1_image-20220403003715-1.webp new file mode 100644 index 0000000000..a2672d2afa Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_1_image-20220403003715-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_2_image-20220403003715-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_2_image-20220403003715-2.webp new file mode 100644 index 0000000000..245b558f47 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_2_image-20220403003715-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_3_image-20220403003715-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_3_image-20220403003715-3.webp new file mode 100644 index 0000000000..5b029ee965 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/907_3_image-20220403003715-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/953_1_thumbnail_image001.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/953_1_thumbnail_image001.webp new file mode 100644 index 0000000000..d9943b3999 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/953_1_thumbnail_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/953_2_image002.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/953_2_image002.webp new file mode 100644 index 0000000000..23d77ab857 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/953_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_1_image-20231114102807-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_1_image-20231114102807-2.webp new file mode 100644 index 0000000000..8e42cd9106 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_1_image-20231114102807-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_2_image-20230922212443-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_2_image-20230922212443-1.webp new file mode 100644 index 0000000000..70da869602 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_2_image-20230922212443-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_3_image-20230922212443-2_950x650.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_3_image-20230922212443-2_950x650.webp new file mode 100644 index 0000000000..9399595f2f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_3_image-20230922212443-2_950x650.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_4_image-20230922212443-3_950x397.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_4_image-20230922212443-3_950x397.webp new file mode 100644 index 0000000000..c1dd84dcbf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_4_image-20230922212443-3_950x397.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_5_image-20230922212443-4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_5_image-20230922212443-4.webp new file mode 100644 index 0000000000..a3773dd77e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_5_image-20230922212443-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_6_image-20230922212443-5.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_6_image-20230922212443-5.webp new file mode 100644 index 0000000000..07512655e7 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_6_image-20230922212443-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_7_image-20230922212443-6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_7_image-20230922212443-6.webp new file mode 100644 index 0000000000..2d31a719e4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/966_7_image-20230922212443-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router.webp new file mode 100644 index 0000000000..89dd6662fd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_1.webp new file mode 100644 index 0000000000..58752306d4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_10.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_10.webp new file mode 100644 index 0000000000..6a633ea089 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_10.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_14.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_14.webp new file mode 100644 index 0000000000..d25b023116 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_14.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_15.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_15.webp new file mode 100644 index 0000000000..415798000c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_15.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_2.webp new file mode 100644 index 0000000000..0fce727206 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_21.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_21.webp new file mode 100644 index 0000000000..08b945aedd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_21.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_22.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_22.webp new file mode 100644 index 0000000000..e4e4a545d5 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_22.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_23.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_23.webp new file mode 100644 index 0000000000..906659e63c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_23.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_24.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_24.webp new file mode 100644 index 0000000000..ebf53a5408 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_24.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_3.webp new file mode 100644 index 0000000000..888d05d1f6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_37.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_37.webp new file mode 100644 index 0000000000..227645cfee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_37.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_38.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_38.webp new file mode 100644 index 0000000000..3169b636ce Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_38.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_39.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_39.webp new file mode 100644 index 0000000000..7abd8480a9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_39.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_4.webp new file mode 100644 index 0000000000..c5847c07ed Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_40.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_40.webp new file mode 100644 index 0000000000..292faafb67 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_40.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_41.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_41.webp new file mode 100644 index 0000000000..4377dc11a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_41.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_42.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_42.webp new file mode 100644 index 0000000000..4cddc7e920 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_42.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_43.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_43.webp new file mode 100644 index 0000000000..3699a9414d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_43.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_44.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_44.webp new file mode 100644 index 0000000000..3a17669d28 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_44.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_45.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_45.webp new file mode 100644 index 0000000000..a904c94464 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_45.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_46.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_46.webp new file mode 100644 index 0000000000..a9346612eb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_46.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_47.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_47.webp new file mode 100644 index 0000000000..4ed7225872 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_47.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_48.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_48.webp new file mode 100644 index 0000000000..4d45f116e0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_48.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_5.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_5.webp new file mode 100644 index 0000000000..b4bba342c2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_6.webp new file mode 100644 index 0000000000..e78a68f8d6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_7.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_7.webp new file mode 100644 index 0000000000..4fabd41d7c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_8.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_8.webp new file mode 100644 index 0000000000..08eda0fba6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_9.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_9.webp new file mode 100644 index 0000000000..de60200a00 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/about_endpointpolicymanager_browser_router_9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/browserrouter.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/browserrouter.webp new file mode 100644 index 0000000000..788076cae3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/browserrouter.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_1_image004.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_1_image004.webp new file mode 100644 index 0000000000..8f0987f74e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_1_image004.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_2_image006.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_2_image006.webp new file mode 100644 index 0000000000..addb9d90ed Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_2_image006.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_3_image009.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_3_image009.webp new file mode 100644 index 0000000000..2885357d70 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/171_3_image009.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/253_1_image0015.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/253_1_image0015.webp new file mode 100644 index 0000000000..d4d7888ba8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/253_1_image0015.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/489_1_dfg_950x593.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/489_1_dfg_950x593.webp new file mode 100644 index 0000000000..ee4b248665 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/489_1_dfg_950x593.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_1_image-20220217002324-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_1_image-20220217002324-1.webp new file mode 100644 index 0000000000..eeb0409ffa Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_1_image-20220217002324-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_2_image-20220217002324-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_2_image-20220217002324-2.webp new file mode 100644 index 0000000000..4dec12c4da Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_2_image-20220217002324-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_3_image-20220217002324-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_3_image-20220217002324-3.webp new file mode 100644 index 0000000000..b02c91499d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_3_image-20220217002324-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_4_image-20220217002324-4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_4_image-20220217002324-4.webp new file mode 100644 index 0000000000..fd7a862df5 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_4_image-20220217002324-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_5_image-20220217002324-5.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_5_image-20220217002324-5.webp new file mode 100644 index 0000000000..de6c73a48e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/chrome/870_5_image-20220217002324-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/202_1_image-20220105135628-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/202_1_image-20220105135628-1.webp new file mode 100644 index 0000000000..e5afd7ecd6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/202_1_image-20220105135628-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_1_img-01.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_1_img-01.webp new file mode 100644 index 0000000000..52267d9cc2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_1_img-01.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_3_img-02_950x542.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_3_img-02_950x542.webp new file mode 100644 index 0000000000..17a2f12882 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_3_img-02_950x542.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_5_img-03_950x650.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_5_img-03_950x650.webp new file mode 100644 index 0000000000..a9e69347c1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_5_img-03_950x650.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_7_img-05_950x675.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_7_img-05_950x675.webp new file mode 100644 index 0000000000..55ad5c16bf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/clientsideextension/774_7_img-05_950x675.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp new file mode 100644 index 0000000000..9978740d6c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp new file mode 100644 index 0000000000..e19d583566 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp new file mode 100644 index 0000000000..c4034c391b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp new file mode 100644 index 0000000000..324ffec055 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp new file mode 100644 index 0000000000..faa03d7eaf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp new file mode 100644 index 0000000000..f357bbb88e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp new file mode 100644 index 0000000000..c7073b496a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp new file mode 100644 index 0000000000..34c85cd1d0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/edge/456_1_image001_950x573.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/edge/456_1_image001_950x573.webp new file mode 100644 index 0000000000..7dae4eb1a9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/edge/456_1_image001_950x573.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/170_1_image001.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/170_1_image001.webp new file mode 100644 index 0000000000..54820a032d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/170_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/170_2_image002.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/170_2_image002.webp new file mode 100644 index 0000000000..594e8547ee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/170_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/589_1_img-01_950x137.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/589_1_img-01_950x137.webp new file mode 100644 index 0000000000..88185a0c3d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/589_1_img-01_950x137.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/589_3_img-02_950x665.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/589_3_img-02_950x665.webp new file mode 100644 index 0000000000..102b37c08b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/589_3_img-02_950x665.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_1_image-20210121211003-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_1_image-20210121211003-1.webp new file mode 100644 index 0000000000..a9d282202b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_1_image-20210121211003-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_2_image-20210121211003-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_2_image-20210121211003-2.webp new file mode 100644 index 0000000000..d8fcc4f35d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_2_image-20210121211003-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_3_image-20210121211003-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_3_image-20210121211003-3.webp new file mode 100644 index 0000000000..17eeed3cd8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_3_image-20210121211003-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_4_image-20210121211003-4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_4_image-20210121211003-4.webp new file mode 100644 index 0000000000..ce7ad9e97b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/767_4_image-20210121211003-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/881_1_image-20221228073914-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/881_1_image-20221228073914-1.webp new file mode 100644 index 0000000000..93fbcd7588 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/editpolicytemplate/881_1_image-20221228073914-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_5_img-04.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_5_img-04.webp new file mode 100644 index 0000000000..b0e41ad7a6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_5_img-04.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_6_img-05.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_6_img-05.webp new file mode 100644 index 0000000000..326672dd9b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_6_img-05.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_7_image.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_7_image.webp new file mode 100644 index 0000000000..ea0c411cfb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_7_image.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_8_image.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_8_image.webp new file mode 100644 index 0000000000..febb99c478 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/141_8_image.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_1_image-20190911221425-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_1_image-20190911221425-1.webp new file mode 100644 index 0000000000..2b133aad21 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_1_image-20190911221425-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_2_image-20190911221425-2.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_2_image-20190911221425-2.webp new file mode 100644 index 0000000000..7d15ee0c1b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_2_image-20190911221425-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_3_image-20190911221425-3_950x559.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_3_image-20190911221425-3_950x559.webp new file mode 100644 index 0000000000..cd39fbf10d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_3_image-20190911221425-3_950x559.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_4_image-20190911221425-4_950x354.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_4_image-20190911221425-4_950x354.webp new file mode 100644 index 0000000000..101c0be2f8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_4_image-20190911221425-4_950x354.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_5_image-20190911221425-5_950x150.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_5_image-20190911221425-5_950x150.webp new file mode 100644 index 0000000000..01288fc667 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_5_image-20190911221425-5_950x150.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_6_image-20190911221425-6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_6_image-20190911221425-6.webp new file mode 100644 index 0000000000..54d38e412e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_6_image-20190911221425-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_7_image-20210105155954-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_7_image-20210105155954-1.webp new file mode 100644 index 0000000000..4e4175e3c2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_7_image-20210105155954-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_8_image-20190911221425-7_950x315.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_8_image-20190911221425-7_950x315.webp new file mode 100644 index 0000000000..ba330fcadf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_8_image-20190911221425-7_950x315.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_9_image-20190911221425-8.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_9_image-20190911221425-8.webp new file mode 100644 index 0000000000..130de4454f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/483_9_image-20190911221425-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/524_1_unnamed-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/524_1_unnamed-1.webp new file mode 100644 index 0000000000..9e3b27f92c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/524_1_unnamed-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/531_1_image001.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/531_1_image001.webp new file mode 100644 index 0000000000..5998e3d41b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/531_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_11_image-20191222210303-6.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_11_image-20191222210303-6.webp new file mode 100644 index 0000000000..8e853deda2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_11_image-20191222210303-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_13_image-20191222210303-7.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_13_image-20191222210303-7.webp new file mode 100644 index 0000000000..3bde243161 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_13_image-20191222210303-7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_15_image-20191222210303-8.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_15_image-20191222210303-8.webp new file mode 100644 index 0000000000..7e18258447 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_15_image-20191222210303-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_17_image-20191222210303-9.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_17_image-20191222210303-9.webp new file mode 100644 index 0000000000..fcba78a039 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_17_image-20191222210303-9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_1_image-20191222210303-1.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_1_image-20191222210303-1.webp new file mode 100644 index 0000000000..c1e5763e42 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_1_image-20191222210303-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_3_image-20191222210303-2_457x162.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_3_image-20191222210303-2_457x162.webp new file mode 100644 index 0000000000..60f924537d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_3_image-20191222210303-2_457x162.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_5_image-20191222210303-3.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_5_image-20191222210303-3.webp new file mode 100644 index 0000000000..4324923add Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_5_image-20191222210303-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_7_image-20191222210303-4.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_7_image-20191222210303-4.webp new file mode 100644 index 0000000000..f039559009 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_7_image-20191222210303-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_9_image-20191222210303-5.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_9_image-20191222210303-5.webp new file mode 100644 index 0000000000..304e571036 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/install/535_9_image-20191222210303-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/1323_1_a7ea1a5fea27b5af1303c5cae8c549cd.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/1323_1_a7ea1a5fea27b5af1303c5cae8c549cd.webp new file mode 100644 index 0000000000..a5891c387d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/1323_1_a7ea1a5fea27b5af1303c5cae8c549cd.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/1323_2_faaa54cf16d85c909ec4de3a83505ac9.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/1323_2_faaa54cf16d85c909ec4de3a83505ac9.webp new file mode 100644 index 0000000000..4fab88d141 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/1323_2_faaa54cf16d85c909ec4de3a83505ac9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_1_image0014.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_1_image0014.webp new file mode 100644 index 0000000000..f7dac708c9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_1_image0014.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_2_image003.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_2_image003.webp new file mode 100644 index 0000000000..6e88259074 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_2_image003.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_3_image005.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_3_image005.webp new file mode 100644 index 0000000000..e5cea63c7f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_3_image005.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_4_image0061.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_4_image0061.webp new file mode 100644 index 0000000000..a867fcfe96 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_4_image0061.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_5_faq-asdf-01.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_5_faq-asdf-01.webp new file mode 100644 index 0000000000..f46240da96 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_5_faq-asdf-01.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_6_faq-asdf-02.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_6_faq-asdf-02.webp new file mode 100644 index 0000000000..009329dce6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_6_faq-asdf-02.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_7_faq-asdf-03.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_7_faq-asdf-03.webp new file mode 100644 index 0000000000..77a49e4a78 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/415_7_faq-asdf-03.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp new file mode 100644 index 0000000000..964bbcf082 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp new file mode 100644 index 0000000000..b52876ad0e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp new file mode 100644 index 0000000000..8734ba4794 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp new file mode 100644 index 0000000000..15fdff9b40 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp new file mode 100644 index 0000000000..f47fa35a98 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp new file mode 100644 index 0000000000..da8b3902f9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp new file mode 100644 index 0000000000..deb3757608 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp new file mode 100644 index 0000000000..7aceb50d08 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp new file mode 100644 index 0000000000..eca7035523 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp new file mode 100644 index 0000000000..8ae1eeeeca Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp new file mode 100644 index 0000000000..55cd988bb8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp new file mode 100644 index 0000000000..390b623613 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_16.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_16.webp new file mode 100644 index 0000000000..b0b9e11323 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_16.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_17.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_17.webp new file mode 100644 index 0000000000..b30c30c9b4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_17.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_18.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_18.webp new file mode 100644 index 0000000000..a5068da83a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_18.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_19.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_19.webp new file mode 100644 index 0000000000..d89b3ee824 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_19.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_20.webp b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_20.webp new file mode 100644 index 0000000000..258718d24f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/technical-notes/assets/policy/about_endpointpolicymanager_browser_router_20.webp differ diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/_category_.json b/docs/endpointpolicymanager/browser-router/technical-notes/installation/_category_.json new file mode 100644 index 0000000000..3a0e054a7d --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Installation And Uninstallation", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/chromemanual.md b/docs/endpointpolicymanager/browser-router/technical-notes/installation/chromemanual.md new file mode 100644 index 0000000000..5add7b0a43 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/chromemanual.md @@ -0,0 +1,122 @@ +--- +title: "How-to manually install and enable Endpoint Policy Manager Browser Router (PPBR) extension for Google Chrome?" +description: "How-to manually install and enable Endpoint Policy Manager Browser Router (PPBR) extension for Google Chrome?" +sidebar_position: 60 +--- + +# How-to manually install and enable Endpoint Policy Manager Browser Router (PPBR) extension for Google Chrome? + +If you want to install the Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser extension +for Google chrome manually from a local/network path, follow the below steps. + +**Step 1 –** Download the PPBR Chrome Extension's .CRX file + +**Step 2 –** Copythe PPBR Chrome Extension on Target Computer + +**Step 3 –** Google Chrome Registry Settings for Extensions + +**Step 4 –** (for end users) How-To Enable PPBR Chrome Extension + +## 1. Downloading the PPBR Chrome Extension's .CRX File + +Follow these steps to convert the Chrome Web Store link of any Extension to an `.CRX` File. + +**Step 1 –** Check the information here: +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) +Note down the Extension ID. You'll need this step every time we release updates for Software. + +**Step 2 –** Append the PPBR Chrome Extension ID with the following URL: +[https://chrome.google.com/webstore/detail/policypak-browser-router/[PPBR-Extension-ID](https://chrome.google.com/webstore/detail/endpointpolicymanager-browser-router/[PPBR-Extension-ID)] + +![535_1_image-20191222210303-1](assets/install/535_1_image-20191222210303-1.webp) + +**Step 3 –** ote the PPBR Chrome Extension's Version Number. + +**Step 4 –** Launch this URL, [https://www.crxextractor.com/](https://www.crxextractor.com/) + +**Step 5 –** Insert the updated PPBR Chrome Extension URL that you appended in step 1.2. + +![535_3_image-20191222210303-2_457x162](assets/install/535_3_image-20191222210303-2_457x162.webp) + +**Step 6 –** Click **OK** + +![535_5_image-20191222210303-3](assets/install/535_5_image-20191222210303-3.webp) + +**Step 7 –** Click on Get .CRX + +**Step 8 –** Save the file on network location so end-users can `read/access`. + +## 2. Copy the PPBR Chrome Extension on the Target Computer + +Copy the` .CRX` extension file using Group Policy Preference item. + +**Step 1 –** Go to `Computer Configuration\\Preferences\\Windows Settings\\Files`. + +**Step 2 –** Right-click on the **Files** node and select **New** and then **File**. + +![535_7_image-20191222210303-4](assets/install/535_7_image-20191222210303-4.webp) + +**Step 3 –** Configure this policy as shown below. Change **Source** and **Destination** paths as +needed. + +**Step 4 –** Run `GPUPDATE` on theTarget Computer and verify that the ` .CRX` file is on theexpected +location. + +## 3. Google Chrome Registry Settings for Extensions + +Follow these steps to only install PPBR Chrome Extension. + +**Step 1 –** Launch GPO Item and browse the following location: +`Computer Configuration\\Preferences\\Windows Settings\\Registry` + +**Step 2 –** Right-click on **Registry node**, then click on **New** > **Registry Item** + +![535_9_image-20191222210303-5](assets/install/535_9_image-20191222210303-5.webp) + +**Step 3 –** Configure the setting as shown below. The value's references are under Chrome REG +section. + +Chrome REG: + +Create the registry key: + +``` +32-bit Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\Google\\Chrome\\Extensions\\[id of your extension crx] +64-bit Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\[id of your extension crx] +``` + +Create the following registry key values: + +``` +32-bit Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\Google\\Chrome\\Extensions\\[id of your extension crx]\\path +64-bit Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\[id of your extension crx]\\path +TYPE: REG_SZVALUE: "C:\\path\\to\\your\\extension.crx" +32-bit Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\Google\\Chrome\\Extensions\\[id of your extension crx]\\version +64-bit Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Chrome\\Extensions\\[id of your extension crx]\\version +TYPE: REG_SZ +VALUE: [version of your .crx as specified in the manifest +``` + +**Step 4 –** Run `GPUPDATE `on the target computer and verify the results. + +## 4. (for end users) How-to Enable PPBR Chrome Extension + +This section has to be executed by the end-user. + +![535_11_image-20191222210303-6](assets/install/535_11_image-20191222210303-6.webp) + +**Step 1 –** Relaunch Google Chrome and wait for the notification banner, thenclick the **Enable +extension** button. + +![535_13_image-20191222210303-7](assets/install/535_13_image-20191222210303-7.webp) + +If you aren't prompted forthe **Enable extension** window, look for this icon -in the Chrome Browser +and follow the instructions in the next step to enable it. + +![535_15_image-20191222210303-8](assets/install/535_15_image-20191222210303-8.webp) + +**Step 2 –** Select an option for Endpoint Policy Manager Browser Router Chrome Extension: + +![535_17_image-20191222210303-9](assets/install/535_17_image-20191222210303-9.webp) + +**Step 3 –** Click on **Enable extension** button: diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/defaultbrowser.md b/docs/endpointpolicymanager/browser-router/technical-notes/installation/defaultbrowser.md new file mode 100644 index 0000000000..d62fd5adfd --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/defaultbrowser.md @@ -0,0 +1,113 @@ +--- +title: "When I unlicense or remove Endpoint Policy ManagerBrowser Router from scope,Endpoint Policy Manager Browser Router Agent still shows as OS \"default browser\". Why is that and is there a workaround?" +description: "When I unlicense or remove Endpoint Policy ManagerBrowser Router from scope,Endpoint Policy Manager Browser Router Agent still shows as OS \"default browser\". Why is that and is there a workaround?" +sidebar_position: 40 +--- + +# When I unlicense or remove Endpoint Policy ManagerBrowser Router from scope,Endpoint Policy Manager Browser Router Agent still shows as OS "default browser". Why is that and is there a workaround? + +On Windows 8.1 or later, once Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router is +licensed, it becomes the "default browser" in the operating system, like what is seen here. + +![141_1_img-01](assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp) + +However, if you are using the Legacy Browser Router mode and unlicense Endpoint Policy Manager +Browser Router or remove the computer from the scope of any Endpoint Policy Manager Browser Router +rules, you will find thatEndpoint Policy Manager Browser Router Agent is apparently maintained as +the OS's default browser. + +This is a "Display Only" and "Cosmetic" issue and not reflective upon reality, this is by design. +Usually, IE will now actually be the default browser as far as the user EXPERIENCES it. + +That being said, once you have unlicensedEndpoint Policy Manager Browser Router it is not active any +longer. +Therefore, (when Endpoint Policy Manager Browser Router is not present.) … an end-user could open up +Firefox, Chrome, IE or Edge … like what is seen here… + +![141_2_img-02](assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp) + +And manually set the default browser, or use the operating system itself to specify the desired +default browser .. like what is seen here… + +![141_3_img-03](assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp) + +Afterward, they should see the OS default web browser change accordingly and be maintained correctly +at the next login. + +:::note +When not using Legacy Browser Router mode and you remove the computer from the scope of +any Endpoint Policy Manager Browser Router rules or unlicenseEndpoint Policy Manager Browser Router +after having a Endpoint Policy Manager Browser Router policy in place the default behavior is to +revert the default browser to the value present beforeEndpoint Policy Manager Browser Router was +enabled/licensed. +::: + + +What if: + +- You really, really don't like Endpoint Policy Manager Browser Router displaying as the default + browser, even though the problem is only "cosmetic." +- You want to FORCE SET a default browser and ensure it for the user (but this time, not using + Endpoint Policy Manager Browser Router). +- You want to set a specific browser as the default, THEN let the user change it after you set the + default, say, to IE. + +For either or all of these options… + +**Step 1 –** Step 1. ONLY if using the following PolicyPak Client-Side Extensions ADMX setting set +to Enabled, (aka Legacy Browser Router mode), OR if Client-Side Extensions version 2535 or older was +ever installed on the machine. + +![141_4_image-20210104150503-1](assets/install/483_7_image-20210105155954-1.webp) + +You have to delete this file first…as a one time action using GPPPrefs if + +![141_5_img-04](assets/install/141_5_img-04.webp) + +**Step 2 –** Step 2. Then if you want to FORCE A PARTICULAR BROWSER VIA POLICY … (pick ONE) + +- Use Endpoint Policy Manager File Associations Manager to set HTTP and HTTPS to Internet Explorer. + This is supported as long as you are NOT using Endpoint Policy Manager Browser Router any + longer. [Can I use Endpoint Policy ManagerBrowser Router and/or Endpoint Policy Manager File Associations Manager to set the default browser?](/docs/endpointpolicymanager/knowledgebase/fileassociationsmanager/knowledgebase/troubleshooting/defaultbrowser.md) +- Use the in-box Group Policy method for File / Protocol Associations (not recommended, since you + have Endpoint Policy Manager File Associations Manager, and this method is not dynamic NOR can you + use it ALONGSIDEEndpoint Policy Manager File Associations Manager, so it is NOT + recommended): [https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy) + +:::tip +Remember, The two methods above PERMANENTLY AFFIX it to IE, and don't make it changeable. +(Technically, the user CAN change it, but then it's ‘snapped back' every time the user logs off and +on.) +::: + + +-ANOTHER OPTION- … INSTEAD of forcing a particular browser, you can SET ONE BROWSER as the DEFAULT, +then let the user CHANGE + +"How can I set it to IE, then make it changeable by the end-user?" + +To do this.. we found a utility, which you can likely DEPLOY ONCE via Endpoint Policy Manager +SCRIPTS on the USER side .. (we didn't test that, and only tested it manually on the user side)… + +[http://kolbi.cz/blog/2017/11/10/setdefaultbrowser-set-the-default-browser-per-user-on-windows-10-and-server-2016-build-1607/](http://kolbi.cz/blog/2017/11/10/setdefaultbrowser-set-the-default-browser-per-user-on-windows-10-and-server-2016-build-1607/) + +(Endpoint Policy Manager makes no warranties about this tool.) + +When it runs.. it works instantly.. and sets the default browser. In this example, we set it to IE. + +And then it was later changeable by the user. + +![141_6_img-05](assets/install/141_6_img-05.webp) + +:::note +If you uninstall the Endpoint Policy Manager Client Side Extensions on a machine where +Endpoint Policy Manager Browser Router was set as the default browser then Microsoft Edge will +become the default browser immediately after the Endpoint Policy Manager Client Side Extensions are +uninstalled. You will see the notification below on your screen and if you check the default apps +you will see that Edge has become the default browser. +::: + + +![141_7_image](assets/install/141_7_image.webp) + +![141_8_image](assets/install/141_8_image.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/iepromptdll.md b/docs/endpointpolicymanager/browser-router/technical-notes/installation/iepromptdll.md new file mode 100644 index 0000000000..3aba37faa4 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/iepromptdll.md @@ -0,0 +1,28 @@ +--- +title: "I launched IE and saw \"PPBRAGENTIExIE_01.dll\" or \"PPBRExplorerExtension.dll\" prompted for the user. What should I do?" +description: "I launched IE and saw \"PPBRAGENTIExIE_01.dll\" or \"PPBRExplorerExtension.dll\" prompted for the user. What should I do?" +sidebar_position: 30 +--- + +# I launched IE and saw "PPBRAGENTIExIE_01.dll" or "PPBRExplorerExtension.dll" prompted for the user. What should I do? + +This scenario is common when: + +1. You hand-install the CSE and immediately start to tryNetwrix Endpoint Policy Manager (formerly + PolicyPak) Browser Router or launch your browsers. +2. You deploy the CSE using a software deployment tool and users are currently still logged on to + their machines. + +Endpoint Policy Manager is trying to install a required component into Internet Explorer. + +It is named (old version) `PPBRAGENTIExIE_01.DLL` or `PPBRExplorerExtension.dll` (newer versions.) + +But if Interenet Explorer is running WHILE the installation of theEndpoint Policy Manager CSE +occurs, you might get this message the next time you launch Internet Explorer. + +![524_1_unnamed-1](assets/install/524_1_unnamed-1.webp) + +Even if users select DON'T ENABLE, theEndpoint Policy Manager CSE will fix it at the next login. + +The workaround and recommendation is to install theEndpoint Policy Manager CSE when no users are +logged on at all, and hence, IE wouldn't be open to cause this situation. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/preventiequestions.md b/docs/endpointpolicymanager/browser-router/technical-notes/installation/preventiequestions.md new file mode 100644 index 0000000000..8186dd1bd0 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/preventiequestions.md @@ -0,0 +1,14 @@ +--- +title: "I'm using SCCM to deploy the PP CSE. I want to ensure that Internet Explorer is closed during the installation of PPBR to prevent IE questions of users if they are logged in. What should I do?" +description: "I'm using SCCM to deploy the PP CSE. I want to ensure that Internet Explorer is closed during the installation of PPBR to prevent IE questions of users if they are logged in. What should I do?" +sidebar_position: 20 +--- + +# I'm using SCCM to deploy the PP CSE. I want to ensure that Internet Explorer is closed during the installation of PPBR to prevent IE questions of users if they are logged in. What should I do? + +You can use the snippet of code within SCCM to test to see if IE is closed and then if it is, only +then install the PP CSE. + +``` +Do {$ieCheck = Get-Process iexplore -ErrorAction SilentlyContinueIf ($ieCheck -eq $null) {msiexec /i ‘PolicyPak Client-Side Extension x64.msi' /q#Write-Host ‘Installing'Start-Sleep -s 600Exit}else {#Write-Host ‘IE Open'Start-Sleep -s 600}} while ($ieCheck -ne $null) +``` diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/twologons.md b/docs/endpointpolicymanager/browser-router/technical-notes/installation/twologons.md new file mode 100644 index 0000000000..20f80eee67 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/twologons.md @@ -0,0 +1,20 @@ +--- +title: "Why doesn't Endpoint Policy Manager Browser Router routes take effect the first time I log on to Windows 8.1 or Windows 10?" +description: "Why doesn't Endpoint Policy Manager Browser Router routes take effect the first time I log on to Windows 8.1 or Windows 10?" +sidebar_position: 50 +--- + +# Why doesn't Endpoint Policy Manager Browser Router routes take effect the first time I log on to Windows 8.1 or Windows 10? + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router rules (and Default Browser +specification) might take two logons to take effect and/or one background GPupdate. + +This is by design. + +The first time the user logs on, Endpoint Policy Manager Browser Router needs to get set up and +introduce itself to the OS as the "Default Browser." + +Then on the next Group Policy refresh (second logon or one logon plus a manual or background +GPupdate), Endpoint Policy Manager Browser Router should be "saved" and ready for use. + +All Endpoint Policy Manager Browser Router policies should work at that point. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/installation/windowsopenprompt.md b/docs/endpointpolicymanager/browser-router/technical-notes/installation/windowsopenprompt.md new file mode 100644 index 0000000000..a2e70a8473 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/installation/windowsopenprompt.md @@ -0,0 +1,24 @@ +--- +title: "Why does Windows 8 and 10 ask me \"How do you want to open this?\" and how do I make it go away?" +description: "Why does Windows 8 and 10 ask me \"How do you want to open this?\" and how do I make it go away?" +sidebar_position: 10 +--- + +# Why does Windows 8 and 10 ask me "How do you want to open this?" and how do I make it go away? + +Immediately after installing the Netwrix Endpoint Policy Manager (formerly PolicyPak) CSE on an +endpoint, you might see something like this. + +![531_1_image001](assets/install/531_1_image001.webp) + +This scenario is common when: + +1. You hand-install the CSE and immediately start to try Endpoint Policy Manager Browser Router or + launch your browsers. +2. You deploy the CSE using a software deployment tool and users are currently still logged on to + their machines. + +So, the Endpoint Policy Manager CSE itself doesn't require a reboot to start working. + +However, for Endpoint Policy Manager Browser Router to solidify itself as the default browser (to +then perform the routing) you must logoff and log on to pick up this new setting. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/knowledgebase.md b/docs/endpointpolicymanager/browser-router/technical-notes/knowledgebase.md new file mode 100644 index 0000000000..d729ac3f54 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/knowledgebase.md @@ -0,0 +1,62 @@ +--- +title: "Knowledge Base" +description: "Knowledge Base" +sidebar_position: 10 +--- + +# Knowledge Base + +The following is a list of Knowledge Base articles for Browser Router. + +## Installation and Uninstallation + +- [Why does Windows 8 and 10 ask me "How do you want to open this?" and how do I make it go away?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/installation/windowsopenprompt.md) +- [I'm using SCCM to deploy the PP CSE. I want to ensure that Internet Explorer is closed during the installation of PPBR to prevent IE questions of users if they are logged in. What should I do?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/installation/preventiequestions.md) +- [I launched IE and saw "PPBRAGENTIExIE_01.dll" or "PPBRExplorerExtension.dll" prompted for the user. What should I do?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/installation/iepromptdll.md) +- [When I unlicense or remove Endpoint Policy ManagerBrowser Router from scope,Endpoint Policy Manager Browser Router Agent still shows as OS "default browser". Why is that and is there a workaround?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/installation/defaultbrowser.md) +- [Why doesn't Endpoint Policy Manager Browser Router routes take effect the first time I log on to Windows 8.1 or Windows 10?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/installation/twologons.md) +- [How-to manually install and enable Endpoint Policy Manager Browser Router (PPBR) extension for Google Chrome?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/installation/chromemanual.md) + +## Troubleshooting + +- [Troubleshooting routing between browsers.](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/betweenbrowsers.md) +- [I'm having a "Browser Router Emergency" or some kind of critical website incompatibility. What can I do?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/criticalwebsiteincompatibility.md) +- [When does Endpoint Policy Manager Browser Router write v1 or v2 Enterprise Mode site lists?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/versions.md) +- [PPBRAgentExeIE_01.DLL error message occurs about Internet Explorer enhanced security. What should I do?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/dllcompatible.md) +- [Endpoint Policy Manager Browser Router removes other Chrome ‘force installed' extensions. How can I work around this?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/forceinstall.md) +- [Why don't routes work from Firefox to other browsers (in Firefox 49+) ?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/firefox.md) +- [Why don't routes work from IE to other browsers?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/fromietootherbrowsers.md) +- [Chrome and Citrix problems](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/citrixproblems.md) +- [Why doesn't Edge to Other browser support work as expected?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/fromedgetootherbrowsers.md) +- [Browser router doesn't seem to work when I use a pattern, and the URL has multiple redirects.](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/pattern.md) +- [What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) +- [What does it mean when Endpoint Policy Manager Browser Router gives a pop-up saying to contact support to my end-users?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/contactsupport.md) +- [I see the Endpoint Policy Manager Browser Router Chrome Extension is being installed, but it's not active. What can I do?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/extensioninactive.md) +- [How do I revert to "Legacy Browser Router Method & Features" if directed?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/revertlegacy.md) +- [What is the PPBR "Keep original tab open when routing / Experimental Feature" checkbox, and why must I turn it OFF for ALL routes if I'm having trouble with ONE website?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/keeporiginaltab.md) +- [Why is my Wildcard rule not applying to top level WWW site?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/wildcardrule.md) +- [I'm attempting to use an older CSE but routing from Edge / Chrome to other browsers is not working. Why is this?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/routing.md) +- [How do I fix "">Endpoint Policy Manager Browser Router Chromium Extension" was automatically disabled." message in Chrome or Edge?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/automaticallydisabled.md) +- [An older CSE isn't routing from Chrome or Edge to other browsers, because the older CSE isn't downloading the latest Chrome extension. What can I do?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromerouting.md) +- [How can I use the only remaining Endpoint Policy Manager published Chrome Extension with my older CSE? (CSE 18.7.1779.937 - 19.12.2283.849)](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextension.md) +- [How can I stop websites automatically routing to Edge when I expect them to be shown in IE (and/or I get an endless loop). Why is this?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/stop.md) +- [Hyperlinks in Adobe documents do not work when Browser Router is set as the Default Browser](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/adobelinks.md) +- [Why does Endpoint Policy Manager PPExtensionService.exe make a call out to DNS?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/dnscall.md) +- [How to fix the Chrome / Edge Chromium launch issues?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/launch.md) +- [How does Browser Router function when Internet Explorer is removed from the machine?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/removed.md) +- [How to set "Choose which browser opens web links in Office365" so that Browser Router properly routes web links in Outlook](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/office365.md) +- [How to quickly troubleshoot Endpoint Policy Manager Browser Router](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/quick.md) + +## Tips and Tricks + +- [Which variables can I use in the Browser Router Advanced Blocking Message?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/advancedblockingmessage.md) +- [How can I use Endpoint Policy Manager Browser router to force people to always use the SAME browser?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/forcebrowser.md) +- [Is it possible to prevent all Internet websites, but allow just a few? (Blacklist websites, whitelist some?)](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/securityzone.md) +- [What is meant by "Default Browser" within Endpoint Policy Manager Browser router?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/defined.md) +- [How do I suppress the pop-up of the Browser Router Chrome Extension at First run?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/suppresspopup.md) +- [How to remove the Endpoint Policy Manager Browser Router Agent from the list of available Web Browser handlers under Default Apps in Windows 10](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/removeagent.md) +- [Where does Browser Router store user selected browser (and how can I fake it if I need to) in versions 2536 and later?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/useselectablebrowser.md) +- [How to Configure Browser Router to use IE Document Modes in Edge IE TAB](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/browsermode.md) +- [How do I change the default icon for user-created shortcuts for my default browser?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/shortcuticons.md) +- [Does Endpoint Policy Manager Manage Chrome or Edge "Flags"?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/commandlinearguments.md) +- [What is PPBREdgePackage and When is it used?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/edgelegacybrowser.md) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/_category_.json b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/_category_.json new file mode 100644 index 0000000000..ec873edc2f --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips And Tricks", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/advancedblockingmessage.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/advancedblockingmessage.md new file mode 100644 index 0000000000..e4272fb216 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/advancedblockingmessage.md @@ -0,0 +1,45 @@ +--- +title: "Which variables can I use in the Browser Router Advanced Blocking Message?" +description: "Which variables can I use in the Browser Router Advanced Blocking Message?" +sidebar_position: 10 +--- + +# Which variables can I use in the Browser Router Advanced Blocking Message? + +A customer blocking message is optional. If you don't make any changes, the default looks like this: + +![953_1_thumbnail_image001](assets/953_1_thumbnail_image001.webp) + +However, you can change the default Endpoint Policy Manager Browser Router Block policy and use +variables we provide. + +![953_2_image002](assets/953_2_image002.webp) + +The advanced block message must support both the environment variables for the current user and the +context variables listed below: + +1. `%COLLECTION_ID%` +2. `%COLLECTION_NAME%` +3. `%CSE_VERSION%` +4. `%DATE%` +5. `%DATE_UTC%` +6. `%GPO_ID%` +7. `%GPO_NAME%` +8. `%POLICY_ID%` +9. `%POLICY_NAME%` +10. `%TIME%` +11. `%TIME_UTC%` + +The popup title must be set to **Notification** and the caption text must be set to **The site is +blocked by a corporate policy**. + +The following is a sample of the code used for the default Advanced block message. You may use this +as a template and make your own: + +``` +The website is blocked due to a corporate policy. +Policy: %POLICY_NAME% ({%POLICY_ID%}). +Collection: %COLLECTION_NAME% ({%COLLECTION_ID%}). +GPO: %GPO_NAME% % ({%GPO_ID%}).  +Please contact your administrator to get more information. +``` diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/browsermode.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/browsermode.md new file mode 100644 index 0000000000..e210fecfef --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/browsermode.md @@ -0,0 +1,49 @@ +--- +title: "How to Configure Browser Router to use IE Document Modes in Edge IE TAB" +description: "How to Configure Browser Router to use IE Document Modes in Edge IE TAB" +sidebar_position: 80 +--- + +# How to Configure Browser Router to use IE Document Modes in Edge IE TAB + +:::note +The IE Tab function is only supported in Edge Chromium Edition. You must have Edge +Chromium Edition installed for these rules to function properly. Follow these steps to configure +Browser Router: +::: + + +![767_1_image-20210121211003-1](assets/editpolicytemplate/767_1_image-20210121211003-1.webp) + +**Step 1 –** Create a new Browser Router collection, and add a new policy item to redirect the web +site to IE in whichever mode you wish. + +![767_2_image-20210121211003-2](assets/editpolicytemplate/767_2_image-20210121211003-2.webp) + +**Step 2 –** Run `GPUPDATE` on the target machine to verify that the policy is working. You should +see your site displayed in the required IE Mode. + +:::note +You can press F12 for Developer Tools while in IE, then look under the Emulation tab to +see which mode the page is loaded in. +::: + + +![767_3_image-20210121211003-3](assets/editpolicytemplate/767_3_image-20210121211003-3.webp) + +**Step 3 –** Now that you have confirmed that the site works in the required IE mode, you can enable +the "Open as IE in Edge tab" mode in the BR Policy. + +![767_4_image-20210121211003-4](assets/editpolicytemplate/767_4_image-20210121211003-4.webp) + +**Step 4 –** Run `GPUPDATE` on the target machine, open Internet Explorer, go to the site that +should be redirected to IE in Edge tab mode, then wait 65 seconds or more, refresh page in IE to see +if the policy is working. You should see your site open in a new tab in Edge Chromium and displayed +in the required IE Document Mode. + +:::note +IE Mode in Edge takes 65 seconds to take effect after Internet Explorer is running Please +see this kb article for more +information: [Endpoint Policy Manager Browser Router: Internet Explorer in Edge mode](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/ieedgemode.md) + +::: diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/commandlinearguments.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/commandlinearguments.md new file mode 100644 index 0000000000..6c90a1733d --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/commandlinearguments.md @@ -0,0 +1,44 @@ +--- +title: "Does Endpoint Policy Manager Manage Chrome or Edge \"Flags\"?" +description: "Does Endpoint Policy Manager Manage Chrome or Edge \"Flags\"?" +sidebar_position: 100 +--- + +# Does Endpoint Policy Manager Manage Chrome or Edge "Flags"? + +Chrome supports command-line switches, also called flags. They allow you to run Chrome with special +options that allow you to enable or disable a particular feature by modifying the default +functionality. + +In this topic we show how to use flags or a command-line switch for Google Chrome with Netwrix +Endpoint Policy Manager (formerly PolicyPak) Browser Router. + +For a complete list of Chromium command-line switches, see +[https://peter.sh/experiments/chromium-command-line-switches/](https://peter.sh/experiments/chromium-command-line-switches/). + +## Launching a URL in Incognito mode: + +For example, if you want to launch a specific URL under an incognito mode, you need to configure the +PPBR rule as shown below. + +:::note +Please note that the syntax `%url%` is case sensitive. +::: + + +![881_1_image-20221228073914-1](assets/editpolicytemplate/881_1_image-20221228073914-1.webp) + +:::note +Please note that Chromium often removes a flag's support or replaces it with ADMX +settings. +::: + + +For example, a command-line to disable Google Translate `--disable-translate` is not supported +anymore and it is replaced with +[https://chromeenterprise.google/policies/#TranslateEnabled](https://chromeenterprise.google/policies/#httpschromeenterprisegooglepoliciestranslateenabled). + +:::warning +Command line arguments don't work when the source and target browsers are the same. + +::: diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/defined.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/defined.md new file mode 100644 index 0000000000..a8893ea974 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/defined.md @@ -0,0 +1,62 @@ +--- +title: "What is meant by \"Default Browser\" within Endpoint Policy Manager Browser router?" +description: "What is meant by \"Default Browser\" within Endpoint Policy Manager Browser router?" +sidebar_position: 40 +--- + +# What is meant by "Default Browser" within Endpoint Policy Manager Browser router? + +Pretend for a second you didn't have Netwrix Endpoint Policy Manager (formerly PolicyPak) and +Endpoint Policy Manager Browser Router installed. + +A user on Windows 10 can then set his **Default Browser** from either within a browser, like +Firefox, like this: + +![218_1_ppbr-faq-3-pic-1](assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp) + +Or, they can go directly into Windows **Default apps** and set the Web Browser like this… + +![218_2_ppbr-faq-3-pic-2](assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp) + +But as soon as you have Endpoint Policy Manager Browser Router licensed and with ANY Endpoint Policy +Manager Browser Router rules enabled,you will see Endpoint Policy Manager Browser Router Agent as +the **Web Browser** inside Windows 10. + +![218_3_ppbr-faq-3-pic-3](assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp) + +Then, using Endpoint Policy Manager Browser Router, you can set what the **Default Browser** +policies. Below are two examples on how to do find that. + +![218_4_ppbr-faq-3-pic-4](assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp) + +![218_5_ppbr-faq-3-pic-5](assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp) + +When you set the **Default Browser** using Endpoint Policy Manager to IE, Edge, Chrome, or Firefox, +the operating system will still showEndpoint Policy Manager **Browser Router Agent** as the **Web +Browser**. + +![218_6_ppbr-faq-3-pic-6](assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp) + +But the user's perception of their Default Browser will be what you set here. + +So, when a user clicks on any URL which does not have a route, the default browser, as defined from +Endpoint Policy Manager Browser Router, will open up. + +:::note +there is a special Default Browser option available, called **User Selectable** +[Endpoint Policy Manager Browser Router: Set the Windows 10 Default Browser (once) then drift](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/defaultwindows10.md). +::: + + +You can get more information on theUser Selectable in the Endpoint Policy Manager Browser Router +manual. But in essence the steps are as follows: + +**Step 1 –** After **User Selectable** is set, the user can choose their desired browser, for +example, from within Firefox or via the OS selector. + +**Step 2 –** The new setting is enacted with a GPupdate + +**Step 3 –** Endpoint Policy Manager **Browser Router Agent** is then replaced back in the OS again +as the default. + +**Step 4 –** The user will believe that their default browser is actually what has been set here. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/edgelegacybrowser.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/edgelegacybrowser.md new file mode 100644 index 0000000000..14d1e46b86 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/edgelegacybrowser.md @@ -0,0 +1,28 @@ +--- +title: "What is PPBREdgePackage and When is it used?" +description: "What is PPBREdgePackage and When is it used?" +sidebar_position: 110 +--- + +# What is PPBREdgePackage and When is it used? + +PPBREdgePackage is automatically installed when Edge Legacy is present and a Browser Router policy +is linked to the endpoint. It is designed to enforce Browser Router policies within the Edge Legacy +browser. + +This application can be found listed under Apps & Features + +![907_1_image-20220403003715-1](assets/907_1_image-20220403003715-1.webp) + +PPBREdgePackage is the legacy equivalent of the Netwrix Endpoint Policy Manager (formerly PolicyPak) +Browser Router Chromium Extension and is not needed for Edge Chromium or any other browser. + +To verify Endpoint Policy Manager Browser Router Chromium Extension is installed on Edge Chromium, +look for the Endpoint Policy Manager icon, which can usually be seen in the top-right corner with +the other extensions. + +![907_2_image-20220403003715-2](assets/907_2_image-20220403003715-2.webp) + +It can be managed by clicking on **Extensions** >**…** >, **Manage extension**. + +![907_3_image-20220403003715-3](assets/907_3_image-20220403003715-3.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/forcebrowser.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/forcebrowser.md new file mode 100644 index 0000000000..bff6e27ad5 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/forcebrowser.md @@ -0,0 +1,36 @@ +--- +title: "How can I use Endpoint Policy Manager Browser router to force people to always use the SAME browser?" +description: "How can I use Endpoint Policy Manager Browser router to force people to always use the SAME browser?" +sidebar_position: 20 +--- + +# How can I use Endpoint Policy Manager Browser router to force people to always use the SAME browser? + +First, choose a common page to start each browser on, for example google.com, or a corporate home +page. + +Then configure each browser to open this page every time it is started. You simply use Netwrix +Endpoint Policy Manager (formerly PolicyPak) **Application Settings Manager** (not Endpoint Policy +Manager Browser Router) to set the following values. + +Firefox + +![48_1_image001](assets/48_1_image001.webp) + +Chrome + +![48_2_image002](assets/48_2_image002.webp) + +![48_3_image003](assets/48_3_image003.webp) + +Internet Explorer + +![48_4_image004](assets/48_4_image004.webp) + +Create a Policy that always opens a specific browser when a specific page is requested, for example, +the home page configured above. + +![48_5_image005](assets/48_5_image005.webp) + +In this example,when Firefox or Internet Explorer is started, Browser Router will immediately close +that browser and open Chrome. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/removeagent.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/removeagent.md new file mode 100644 index 0000000000..936be0a51d --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/removeagent.md @@ -0,0 +1,94 @@ +--- +title: "How to remove the Endpoint Policy Manager Browser Router Agent from the list of available Web Browser handlers under Default Apps in Windows 10" +description: "How to remove the Endpoint Policy Manager Browser Router Agent from the list of available Web Browser handlers under Default Apps in Windows 10" +sidebar_position: 60 +--- + +# How to remove the Endpoint Policy Manager Browser Router Agent from the list of available Web Browser handlers under Default Apps in Windows 10 + +If you decide not to use Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router in your +environment and your environment does not have any Endpoint Policy Manager Browser Router (PPBR) +policies enabled, you may still notice that you see the PPBR Agent as an available option under +**Settings** > **Default Apps** > **Web Browser**. + +![483_1_image-20190911221425-1](assets/install/483_1_image-20190911221425-1.webp) + +If you would like to remove the PPBR agent from this list please see the steps under the two +scenarios below, and follow the steps in the scenario relevant to your environment. + +## SCENARIO 1: You have never used Endpoint Policy Manager Browser Router and there are no PPBR policies enabled in your environment: + +You can remove the PPBR Agent from this list by unlicensing the Endpoint Policy Manager Browser +Router component and removing the PPBR Agent entry from the list of default Web Browsers utilizing +the steps below. + +![483_2_image-20190911221425-2](assets/install/483_2_image-20190911221425-2.webp) + +**Step 1 –** Add a new policy under **PolicyPak** > **Administrative Templates Manager**: + +![483_3_image-20190911221425-3_950x559](assets/install/483_3_image-20190911221425-3_950x559.webp) + +**Step 2 –** Under **New Admin Templates Entry** select **Administrative Templates** > **Admin +Templates (ADMX files)** > **PolicyPak** > **Browser Router** > Prevent PPBR component from being +licensed then click **Add** to create the policy. + +![483_4_image-20190911221425-4_950x354](assets/install/483_4_image-20190911221425-4_950x354.webp) + +**Step 3 –** Next set the policy as enabled, and click **OK**. + +![483_5_image-20190911221425-5_950x150](assets/install/483_5_image-20190911221425-5_950x150.webp) + +**Step 4 –** Next, create a new policy item under **Group Policy Preferences** > **Windows +Settings** > **Registry** that will delete the following registry key. + +[```HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\PPBRAgent.exe```] + +:::note +You can add this policy to your existing unlicensed PPBR policy instead of creating a new +policy if so desired. +::: + + +**Step 5 –** Set the GPO (or GPOs) containing these two policy items to apply to the OU or Domain +level as needed (i.e. wherever your affected computers or users happen to live). + +**Step 6 –** Login to one of the computers where the PPBR Agent is still present as a choice under +**Settings** > **Default Apps** > **Default Apps** > **Web Browser**, open CMD, then run GPUPDATE. + +**Step 7 –** Once GPUPDATE is successful, log off of the computer and then log back in. + +![483_6_image-20190911221425-6](assets/install/483_6_image-20190911221425-6.webp) + +**Step 8 –** Now check under **Settings** > **Default Apps** > **Web Browser** and the option to +select the PPBR Agent should no longer be present. + +## SCENARIO 2: You HAVE used Endpoint Policy Manager Browser Router in Legacy Browser Mode (either currently or sometime in the past) but no longer wish to, AND currently have no PPBR policies enabled in your environment: + +![483_7_image-20210105155954-1](assets/install/483_7_image-20210105155954-1.webp) + +**Step 1 –** Follow steps 1-4 above from Scenario 1 then continue with the steps below. + +![483_8_image-20190911221425-7_950x315](assets/install/483_8_image-20190911221425-7_950x315.webp) + +**Step 2 –** Add a new GPPrefs Policy item to one of your existing GPOs above, or create a new GPO +using **Group Policy** > **Policy Preferences** > **Windows Settings** to delete the following file: + +`C:\ProgramData\endpointpolicymanager\Common\ppFileAssociations.xml` + +![483_9_image-20190911221425-8](assets/install/483_9_image-20190911221425-8.webp) + +**Step 3 –** Set the GPO (or GPOs) containing these three policy items to apply to the OU or Domain +level as needed (i.e. wherever your affected computers or users happen to live). + +For Example: + +**Step 4 –** Then login to one of these computers where the PPBR Agent is still present as a choice +under **Settings** > **Default Apps** > **Default Apps** > **Web Browser**, open CMD then run +`GPUPDATE`. + +**Step 5 –** Once `GPUDATE` is successful, log off of the computer and then log back in. + +![483_10_image-20190911221425-9](assets/install/483_6_image-20190911221425-6.webp) + +**Step 6 –** Now check under **Settings** > **Default Apps** > **Web Browser** and the option to +select the PPBR Agent should no longer be present. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/securityzone.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/securityzone.md new file mode 100644 index 0000000000..b71584d169 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/securityzone.md @@ -0,0 +1,19 @@ +--- +title: "Is it possible to prevent all Internet websites, but allow just a few? (Blacklist websites, whitelist some?)" +description: "Is it possible to prevent all Internet websites, but allow just a few? (Blacklist websites, whitelist some?)" +sidebar_position: 30 +--- + +# Is it possible to prevent all Internet websites, but allow just a few? (Blacklist websites, whitelist some?) + +This is possible, using the Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router. + +**Step 1 –** Set up a rule (route as seen in this example. Specify that the Internet Security Zone +is set to BLOCK. + +![170_1_image001](assets/editpolicytemplate/170_1_image001.webp) + +**Step 2 –** Then, make other rules which route to the websites you want. Finally, ensure your +blocking policy is last in the list, so all whitelisted items will process before the blockitem. + +![170_2_image002](assets/editpolicytemplate/170_2_image002.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/shortcuticons.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/shortcuticons.md new file mode 100644 index 0000000000..c82d3d417b --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/shortcuticons.md @@ -0,0 +1,67 @@ +--- +title: "How do I change the default icon for user-created shortcuts for my default browser?" +description: "How do I change the default icon for user-created shortcuts for my default browser?" +sidebar_position: 90 +--- + +# How do I change the default icon for user-created shortcuts for my default browser? + +For a good general overview of the topic, please watch this video: +[Set the links to icons to actually show the default browser.](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/browsericon.md) + +The most common concern is that the FireFox default icon appears like this: + +![835_1_hfkb-1127-img-01_950x761](assets/835_1_hfkb-1127-img-01_950x761.webp) + +When you typically want user shortcuts to look like this: + +![835_2_hfkb-1127-img-02](assets/835_2_hfkb-1127-img-02.webp) + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router's DEFAULT BROWSER function uses +the registered icon for the default browser as the icon. + +![835_3_hfkb-1127-img-03_950x747](assets/835_3_hfkb-1127-img-03_950x747.webp) + +This might be required, either per user or per machine, depending on which browsers you actually +have installed on the machine and how they were installed. + +The REGISTRY values for the browsers are: + +`Computer\HKEY_CLASSES_ROOT\MSEdgeHTM\DefaultIcon` + +`Computer\HKEY_CLASSES_ROOT\MSEdgeBHTML\DefaultIcon` + +`Computer\HKEY_CLASSES_ROOT\FirefoxURL-***\DefaultIcon` ← Note that each user could have a UNIQUE +one, making changing this much harder en-mass. + +`Computer\HKEY_CLASSES_ROOT\ChromeHTML\DefaultIcon` + +`Computer\HKEY_CLASSES_ROOT\IE.HTTP\DefaultIcon` + +`Computer\HKEY_CLASSES_ROOT\IE.HTTPS\DefaultIcon` + +So if you wanted to change Firefox's default icon you could change it from this… + +![835_4_hfkb-1127-img-04_950x499](assets/835_4_hfkb-1127-img-04_950x499.webp) + +To this… + +![835_5_hfkb-1127-img-05_950x643](assets/835_5_hfkb-1127-img-05_950x643.webp) + +A second example could be with Google Chrome and setting it as the Default Browser. + +![835_6_hfkb-1127-img-06_950x684](assets/835_6_hfkb-1127-img-06_950x684.webp) + +The default icons will be from ChromeHTML Index 0. + +![835_7_hfkb-1127-img-07_950x496](assets/835_7_hfkb-1127-img-07_950x496.webp) + +But if you change it to 4 and run GPupdate, you will see updated icons. + +![835_8_hfkb-1127-img-08_950x467](assets/835_8_hfkb-1127-img-08_950x467.webp) + +The quickest way to mass update this would be a Group Policy Preferences Registry item. An example +can be seen here. You want to do this on the computer side, which will change the value for both +user and computer browsers. + +![835_9_hfkb-1127-img-09_950x455](assets/835_9_hfkb-1127-img-09_950x455.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/suppresspopup.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/suppresspopup.md new file mode 100644 index 0000000000..dd075e3be4 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/suppresspopup.md @@ -0,0 +1,13 @@ +--- +title: "How do I suppress the pop-up of the Browser Router Chrome Extension at First run?" +description: "How do I suppress the pop-up of the Browser Router Chrome Extension at First run?" +sidebar_position: 50 +--- + +# How do I suppress the pop-up of the Browser Router Chrome Extension at First run? + +When you use the Chrome Pak or Chrome ADMX settings you can use this setting. + +- Navigate to Policy Path: Computer `Configuration\Administrative Templates\Google\Google Chrome\` +- Policy Name: Continue running background apps when Google Chrome is closed +- Policy State: Disabled diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/useselectablebrowser.md b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/useselectablebrowser.md new file mode 100644 index 0000000000..36a7feb439 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/tipsandtricks/useselectablebrowser.md @@ -0,0 +1,135 @@ +--- +title: "Where does Browser Router store user selected browser (and how can I fake it if I need to) in versions 2536 and later?" +description: "Where does Browser Router store user selected browser (and how can I fake it if I need to) in versions 2536 and later?" +sidebar_position: 70 +--- + +# Where does Browser Router store user selected browser (and how can I fake it if I need to) in versions 2536 and later? + +:::warning +This article pertains to build 2536 and later. For earlier builds, the instructions are +different, and technically, not supported. If using a CSE version older than 2536, please upgrade to +the latest Netwrix Endpoint Policy Manager (formerly PolicyPak) version before using the steps in +this KB. +::: + + +Endpoint Policy Manager Browser Router has a function called **User Selectable browser**. Learn more +about this feature first here: + +[Endpoint Policy Manager Browser Router User-Selected Default](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/userselecteddefault.md) + +[What is meant by "Default Browser" within Endpoint Policy Manager Browser router?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/defined.md) + +You might need to have Endpoint Policy Manager Browser Router indicate that a user specifically +chose a particular browser, even if they did not. + +The values a particular user chose are stored for both HTTP and HTTPS. They are stored per user in +the following location in the registry: + +`"HKEY_CURRENT_USER\SOFTWARE\PolicyPak\Client-Side Extensions\{1659C456-08FC-4359-B125-BB70EE34DD55}\PPBRAgent\SavedOldValues"`Then +within SavedOldValues there are two keys, one for HTTP and one for HTTPs. + +`/Software/Microsoft/Windows/Shell/Associations/UrlAssociations/http/UserChoice` + +`/Software/Microsoft/Windows/Shell/Associations/UrlAssociations/https/UserChoice` + +The first path is default browser for HTTP schema and the second one is HTTPS. + +Those two keys hold a REG_SZ called ProgID which specifies the user's chosen (or perceived) default +browser. + +For instance, in this example, after the Admin has chosen User Selectable, the User chooses Edge +(UWP version), with the following results: + +![507_1_image-20201229224350-1_950x136](assets/507_1_image-20201229224350-1_950x136.webp) + +Supported values in ProgID are: + +- Edge (With Chromium): + - MSEdgeHTM +- Edge (UWP version): + - AppXq0fevzme2pys62n3e0fbqa7peapykr8v for HTTP + - AppX90nv6nhay5n6a98fnetv7tpk64pp35es for HTTPS +- Internet Explorer + - IE.HTTP + - IE.HTTPS +- Chrome: + - ChromeHTML + +:::note +Firefox uses a customized value for ProgId dependent on the version of Firefox installed. +You can set the default browser to Firefox and then look under the following key to find the correct +custom ProgId value: +::: + + +`HKCU\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\ProgId` + +For Example: +![507_2_image-20201229224350-2](assets/507_2_image-20201229224350-2.webp) + +Example: If a user has not yet selected a Browser, or if MS Edge Chromium is the perceived browser, +then specify the default as Chrome (one time) and allow the user to select a different browser if +desired going forward. + +Prerequisites: + +- A PPBR User Selectable policy applied on the User Side +- Browser you wish to use as the default must be installed +- The PPBR policy should be applied AFTER the GP Preferences policy. + +To do this you'll use a Group Policy Preferences Registry Item to SET the value Only do this iff +Item Level Targeting proves the value is ABSENT OR if the value is set to MSEdgeHTM (Edge Chromium). + +:::note +The GPO must be linked to where USERS are, not COMPUTERS, because the logged-in user SID +is used during this operation. +::: + + +**Step 1 –** Set the value: + +- Hive: HKEY_CURRENT_USER +- `Key Path: SOFTWARE\PolicyPak\Client-Side Extensions\{1659C456-08FC-4359-B125-BB70EE34DD55}\PPBRAgent\SavedOldValues\Software/Microsoft/Windows/Shell/Associations/UrlAssociations/http/UserChoice` +- Value Name: ProgID +- Value Type: REG_SZ + ![507_3_image-20201229224350-3](assets/507_3_image-20201229224350-3.webp)- + ValueData: ChromeHTML + +**Step 2 –** (But only if the value below is absent...: + +`HKCU\ Software\PolicyPak\Client-Side Extensions\{1659C456-08FC-4359-B125-BB70EE34DD55}\PPBRAgent\SavedOldValues\Software/Microsoft/Windows/Shell/Associations/UrlAssociations/http/UserChoice\` + +... or if ProgId at the location below is set to MSEdgeHTM (as verified by ILT): + +`HKCU\ Software\PolicyPak\Client-Side Extensions\{1659C456-08FC-4359-B125-BB70EE34DD55}\PPBRAgent\SavedOldValues\Software/Microsoft/Windows/Shell/Associations/UrlAssociations/http/UserChoice\ProgId\` + +![507_4_image-20201229224350-4](assets/507_4_image-20201229224350-4.webp) + +![507_5_image-20201229224350-5_950x366](assets/507_5_image-20201229224350-5_950x366.webp) + +Be sure to have entries which set HTTP and HTTPS like these two values here (i.e., Repeat Steps 1 & +2 above for HTTPS value) + +![507_6_image-20201229224350-6](assets/507_6_image-20201229224350-6.webp) + +:::tip +Remember, You need two entries. One for HTTP and one for HTTPS. +::: + + +:::note +If Chrome is not installed, PPBR will fail back to Internet Explorer. Also, for first time +logins, Chrome will not become the default browser until the 2nd processing of gpupdate.For +convenience the required User side Group Policy Preference XMLS are attached below: +::: + + +HTTP: [https://www.endpointpolicymanager.com/pp-files/2020-12-29_no-default-or-default-edge- +then-set-to-chrome-http.xml](https://www.endpointpolicymanager.com/pp-files/2020-12-29_no-default-or-default-edge- +then-set-to-chrome-http.xml) + +HTTPS: [https://www.endpointpolicymanager.com/pp-files/2020-12-29_no-default-or-default-edge- +then-set-to-chrome-https.xml](https://www.endpointpolicymanager.com/pp-files/2020-12-29_no-default-or-default-edge- +then-set-to-chrome-https.xml) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/_category_.json b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/_category_.json new file mode 100644 index 0000000000..d0c808bf1b --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Troubleshooting", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/adobelinks.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/adobelinks.md new file mode 100644 index 0000000000..3e40f4cd93 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/adobelinks.md @@ -0,0 +1,45 @@ +--- +title: "Hyperlinks in Adobe documents do not work when Browser Router is set as the Default Browser" +description: "Hyperlinks in Adobe documents do not work when Browser Router is set as the Default Browser" +sidebar_position: 230 +--- + +# Hyperlinks in Adobe documents do not work when Browser Router is set as the Default Browser + +## PROBLEM: + +When using Adobe, URLs in PDF documents do not open in a web browser whenNetwrix Endpoint Policy +Manager (formerly PolicyPak) Browser Router (PPBR) is set as the default browser. + +## CAUSE: + +There is a Windows Defender Attack Surface Reduction Rule in place for Adobe: + +![892_1_image-20211223020010-6](assets/892_1_image-20211223020010-6.webp) + +![892_2_image-20211223020010-7](assets/892_2_image-20211223020010-7.webp) + +## RESOLUTION: + +### Option 1: Remove the Attack Surface Reduction Rule for Adobe by deleting the rule highlighted below. + +![892_3_image-20211223020010-8](assets/892_3_image-20211223020010-8.webp) + +### Option 2: (Recommended) Add exclusions for Endpoint Policy Manager under "Exclude files and paths from Attack Surface Reduction Rules" policy. + +:::note +If you prefer you can block only the PPBR Agent executable instead of the entire Endpoint +Policy Manager folder:` "C:\Program Files\PolicyPak\Browser Router\Client\PPBRAgent.exe"` +::: + + +Excluding the "`C:\Program Files\PolicyPak"` folder, (or if you prefer just +`"C:\Program Files\PolicyPak\Browser Router\Client\PPBRAgent.exe") `should be enough to resolve the +issue with Adobe and Browser Router. + +![892_4_image-20211223020010-9](assets/892_4_image-20211223020010-9.webp) + +For a list of additional Endpoint Policy Manager items that may need to be excluded please see the +KB below: + +[How must I configure my Anti-virus or system-level software to work with Endpoint Policy Manager CSE?](/docs/endpointpolicymanager/knowledgebase/installation/knowledgebase/antivirussystemsoftware/antivirus.md) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/automaticallydisabled.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/automaticallydisabled.md new file mode 100644 index 0000000000..2356f68e44 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/automaticallydisabled.md @@ -0,0 +1,40 @@ +--- +title: "How do I fix \"\">Endpoint Policy Manager Browser Router Chromium Extension\" was automatically disabled.\" message in Chrome or Edge?" +description: "How do I fix \"\">Endpoint Policy Manager Browser Router Chromium Extension\" was automatically disabled.\" message in Chrome or Edge?" +sidebar_position: 180 +--- + +# How do I fix "">Endpoint Policy Manager Browser Router Chromium Extension" was automatically disabled." message in Chrome or Edge? + +If you get the message ""Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router +Chromium Extension" was automatically disabled" like this… This article will show you the +workaround. + +![759_1_img-01_950x299](assets/759_1_img-01_950x299.webp) + +To adjust for this, make sure that the Endpoint Policy Manager Browser Router extension(s) you use +are explicitly added to the policy named "Allow specific extensions to be installed". + +You can use this chart to see the Endpoint Policy Manager Browser Router Extension you should allow +to install: +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) + +In this screenshot, the Endpoint Policy Manager Extension is the third one listed. + +Note in this screenshot this is being done on the USER side for EDGE: + +![759_3_img-02](assets/759_3_img-02.webp) + +But you may also perform the operation per computer on the COMPUTER side (For EDGE) as follows. + +![759_5_img-03](assets/759_5_img-03.webp) + +Additionally, this same problem can occur in Chrome and hence, you would use the same value, but +using the Chrome ADMX setting. Here is the setting "Configure extension installation allow list" on +the Computer side. + +![759_7_img-04](assets/759_7_img-04.webp) + +And here is "Configure extension installation allow list" on the User side. + +![759_9_img-05](assets/759_9_img-05.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/betweenbrowsers.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/betweenbrowsers.md new file mode 100644 index 0000000000..bdb5b77948 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/betweenbrowsers.md @@ -0,0 +1,119 @@ +--- +title: "Troubleshooting routing between browsers." +description: "Troubleshooting routing between browsers." +sidebar_position: 10 +--- + +# Troubleshooting routing between browsers. + +This guide will help you troubleshoot problems routing from browser to browser. For instance, if you +are inside Internet Explorer and expect Firefox or Chrome to automatically be opened, but it +doesn't, then this is the guide for you. + +:::note +Firefox version must be Firefox ESR and not Firefox RR (rapid release). For more details, +[https://www.endpointpolicymanager.com/pp-blog/policypak-will-soon-only-support-firefox-esr](https://www.endpointpolicymanager.com/pp-blog/endpointpolicymanager-will-soon-only-support-firefox-esr). +::: + + +**Step 1 –** This troubleshooting guide assumes you have already performed the steps in this initial +troubleshooting guide: Browser Router > +[Knowledge Base](/docs/endpointpolicymanager/knowledgebase/knowledgebase.md). This will demonstrate that you are: + +- Getting the GPOs involved in Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router + and +- Licensing is working for Endpoint Policy Manager Browser Router +- Endpoint Policy Manager Browser Router is set as the OS Default Browser for HTTP and HTTPS +- Routes are being created in `ppBRResults.xml` file in the user's AppData. + +If you haven't pre-confirmed ALL of these aforementioned steps, then STOP. + +ONLY continue if you see `ppBRResults.xml` and are sure Endpoint Policy Manager Browser Router is +correctly licensed. + +**Step 2 –** First, test the Endpoint Policy Manager Browser Router is routing "natural" links. Use +WORDPAD (not notepad!) to create a simple document which will open up the browser based upon your +rules (routes.) + +![267_1_img1](assets/267_1_img1.webp) + +Does clicking on each link open the correct expected browser? + +YES: Continue onward. + +No: Stop, and update your GPO / routes / rules until you get the expected result. + +**Step 3 –** Browser Router installs extensions inside of: + +- Internet Explorer +- Firefox +- Chrome +- Edge + +Those helper applications will only install when: + +- The browser has already been opened before (this creates a profile for the browser inside the + user's profile) +- The user has logged in after this or `GPupdate` has run + +Therefore, if you have a brand new user profile, and FF, IE and Chrome have never ever been launched +before, then Endpoint Policy Manager Browser Router will not work immediately. + +Again, the browser needs to be: + +- Launched and its first-time wizard complete +- Closed +- THEN running` GPupdate` (or logoff and back on) + +…will install the Endpoint Policy Manager Browser Router helper applications inside each browser on +the endpoint. + +So, some examples where Endpoint Policy Manager Browser Router will not work instantly: + +![267_2_img2](assets/267_2_img2.webp) + +![267_3_img3](assets/267_3_img3.webp) + +To ensure each browser is ready to route BETWEEN BROWSERS, you are looking for the following. + +Inside IE: (Gear | Manage Add-ons) + +![267_4_img4-1024x325](assets/267_4_img4-1024x325.webp) + +FF: The Firefox plugin for Endpoint Policy Manager Browser Router will ONLY install into Firefox +ESR. When using Firefox ESR, you can then see this after you launch Firefox ESR and then press +Ctrl+Shift+J . Then look for the text the following entry: + +![267_5_pp-ff-img-01](assets/267_5_pp-ff-img-01.webp) + +If you are ATTEMPTING to use Firefox RR, then it will not work and you will get the following +(expected) error. + +![267_6_image_1000x626](assets/267_6_image_1000x626.webp) + +Chrome: (Gear | Extensions) + +Chrome's helper app is automatically installed over the Internet. So if routing from Chrome TO +Another Browser is not functioning, you need to ensure you have Internet connectivity (at least one +time) to get the Endpoint Policy Manager Browser Router Chrome Extension automatically downloaded +and installed on your machine. + +![267_7_img6](assets/267_7_img6.webp) + +If you don't see the Extension listed, try: + +**Step 1 –** Closing Chrome. + +**Step 2 –** Verifying Internet connectivity. + +**Step 3 –** Try installing any Chrome extension manually (not ours, just one .. any one .. thru the +webstore): [https://chrome.google.com/webstore/category/extensions?hl=en-US](https://chrome.google.com/webstore/category/extensions?hl=en-US) + +**Step 4 –** Again; make sure you have SOME Endpoint Policy Manager Browser Router policies. + +**Step 5 –** Run GPupdate /force + +**Step 6 –** Did our Chrome extension appear? + +**Step 7 –** Related.. If you see ONLY Chrome, and not any FORCED extensions, +[Endpoint Policy Manager Browser Router removes other Chrome ‘force installed' extensions. How can I work around this?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/forceinstall.md) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromeextension.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromeextension.md new file mode 100644 index 0000000000..f968e1114a --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromeextension.md @@ -0,0 +1,72 @@ +--- +title: "How can I use the only remaining Endpoint Policy Manager published Chrome Extension with my older CSE? (CSE 18.7.1779.937 - 19.12.2283.849)" +description: "How can I use the only remaining Endpoint Policy Manager published Chrome Extension with my older CSE? (CSE 18.7.1779.937 - 19.12.2283.849)" +sidebar_position: 210 +--- + +# How can I use the only remaining Endpoint Policy Manager published Chrome Extension with my older CSE? (CSE 18.7.1779.937 - 19.12.2283.849) + +**Step 1 –** Copy the contents below. + +``` +{    "name": "com.endpointpolicymanager.ppbragent",    "description": "Chrome Native Messaging implementation",    "path": "PPBRAgent.exe",    "type": "stdio",     +"allowed_origins": [        "chrome-extension://kndjicdjdanehpnonfmdekhinhdcdnbo/",        "chrome-extension://mdmkjmbojjnnhlohmjhaapalpbbhkdcg/",         +"chrome-extension://fmbfiodledfjldlhiemaadmgppoeklbn/"    ]} +``` + +**Step 2 –** Save in a file named + +`com.endpointpolicymanager.chromehost.json` + +**Step 3 –** The goal is to copy that file to + +``` +C:\Program Files\PolicyPak\Browser Router\Client +``` + +On machines with the CSE (CSE 18.7.1779.937 - 19.12.2283.849)That you CANNOT upgrade to latest CSE +for now. + +![774_1_img-01](assets/clientsideextension/774_1_img-01.webp) + +You can use a variety of methods to get the file copied. Options include: + +- Group Policy Preferences Files +- Endpoint Policy Manager Remote Work Delivery Manager +- Endpoint Policy Manager Scripts +- SCCM +- Any other way you want to copy a file down to the machine + +To show one example, using Group Policy Preferences Files… + +Here's the `Com.endpointpolicymanager.chromehost.json` file stored in the file in the share called +`\\dc2016\share` + +![774_3_img-02_950x542](assets/clientsideextension/774_3_img-02_950x542.webp) + +Using Group Policy Preferences Files, on the Computer side… + +![774_5_img-03_950x650](assets/clientsideextension/774_5_img-03_950x650.webp) + +#### Specify: + +Source: + +``` +\\dc2016\SHARE\com.endpointpolicymanager.chromehost.json +``` + +Destination (must include the path and file name): + +``` +C:\Program Files\PolicyPak\Browser Router\Client\com.endpointpolicymanager.chromehost.json +``` + +Run `GPupdate `on the client, and here's the result. + +Note that upgrading to modern CSE versions will have a SIMIILARLY named file in this folder. + +These two files can sit side by side without issue if you need to use an OLDER CSE for now, then +UPGRADE to latest CSE later. + +![774_7_img-05_950x675](assets/clientsideextension/774_7_img-05_950x675.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromeextensionid.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromeextensionid.md new file mode 100644 index 0000000000..6ba5a34d5c --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromeextensionid.md @@ -0,0 +1,55 @@ +--- +title: "What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?" +description: "What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?" +sidebar_position: 110 +--- + +# What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension? + +Below is the ID list from Chrome. If you need to, you can force-install an Extension ID via ADMX or +Netwrix Endpoint Policy Manager (formerly PolicyPak) Application Manager Pak using this article: + +[Endpoint Policy Manager Browser Router removes other Chrome ‘force installed' extensions. How can I work around this?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/forceinstall.md) + +Note that Endpoint Policy Manager does not guarantee that the version you are using is definitely in +the chrome store. We are only allowed to publish 20 items, as such, the oldest items will be removed +when the newest items are published. + +This means you might need to upgrade to the latest CSE which will then attempt to download and +acquire the latest extension version. + +If you want to test if a particular version is still published, you can use a URL like: + +[https://chrome.google.com/webstore/detail/policypak-browser-router/kndjicdjdanehpnonfmdekhinhdcdnbo](https://chrome.google.com/webstore/detail/endpointpolicymanager-browser-router/kndjicdjdanehpnonfmdekhinhdcdnbo) + +This will indicate to you if the extension is still published or not. + +:::note +Edge Chromium uses the same PPBR Chrome Extension.You can see the extension ID in Edge +Chromium by visiting edge://extensions from within Edge Chromium. +::: + + +![202_1_image-20220105135628-1](assets/clientsideextension/202_1_image-20220105135628-1.webp) + +| DATE | CSE VERSION | VERSION OF EXTENSION | EXTENSION ID | Still available in Chrome Store? | +| ---------- | ---------------- | -------------------- | -------------------------------- | -------------------------------- | +| 1-10-2020 | 2310 (20.1.2310) | 19.12.0.0 | fmbfiodledfjldlhiemaadmgppoeklbn | Yes | +| 5-13-2019 | 2067 | 18.5.0.1 | mdmkjmbojjnnhlohmjhaapalpbbhkdcg | No | +| 3-14-2019 | 2010 | 18.5.0.1 | mdmkjmbojjnnhlohmjhaapalpbbhkdcg | No | +| 3-12-2019 | 2007 | 18.5.0.1 | mdmkjmbojjnnhlohmjhaapalpbbhkdcg | No | +| 2-20-2019 | 1988 | 18.5.0.1 | mdmkjmbojjnnhlohmjhaapalpbbhkdcg | No | +| 10.11.2018 | 18.10.1856.842 | 18.5.0.1 | kndjicdjdanehpnonfmdekhinhdcdnbo | No | +| 9.3.2018 | 18.8.1808.948 | 18.5.0.1 | kndjicdjdanehpnonfmdekhinhdcdnbo | No | +| 7.27.2018 | 18.7.1779.937 | 18.5.0.1 | kndjicdjdanehpnonfmdekhinhdcdnbo | No | +| 3.28.2018 | 18.3.1659.1008 | 1.7.0.1 | jdhmijaiabbgphiblbckmccdckhodbak | No | +| 3.20.2018 | 18.3.1649.976 | 1.7.0.1 | jdhmijaiabbgphiblbckmccdckhodbak | No | +| 3.2.2018 | 18.3.1638.1067 | 1.7.0.1 | jdhmijaiabbgphiblbckmccdckhodbak | No | +| 12.19.2017 | 17.12.1560.1262 | 1.4.0.0 | mfeebkookdmejnaljhahgjojlcahjoni | No | +| 11.14.2017 | 17.11.1524.1428 | 1.4.0.0 | mfeebkookdmejnaljhahgjojlcahjoni | No | +| 8.17.2018 | 17.8.1434.1421 | 1.4.0.0 | mfeebkookdmejnaljhahgjojlcahjoni | No | +| 7.20.2017 | 17.7.1407.1201 | 0.0.3.8 | jdadlnndcplobhfcdfcfobnecakhmkhd | No | +| 6.21.2017 | 17.6.1379.695 | 0.0.3.8 | jdadlnndcplobhfcdfcfobnecakhmkhd | No | +| 6.14.2017 | 17.6.1371.1049 | 0.0.3.8 | jdadlnndcplobhfcdfcfobnecakhmkhd | No | +| 4.27.2017 | 17.3.1281.984 | 0.0.3.8 | jdadlnndcplobhfcdfcfobnecakhmkhd | No | +| 2.22.2017 | 17.2.1260.930 | 0.0.3.8 | jdadlnndcplobhfcdfcfobnecakhmkhd | No | diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromerouting.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromerouting.md new file mode 100644 index 0000000000..97ca9cae7c --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/chromerouting.md @@ -0,0 +1,86 @@ +--- +title: "An older CSE isn't routing from Chrome or Edge to other browsers, because the older CSE isn't downloading the latest Chrome extension. What can I do?" +description: "An older CSE isn't routing from Chrome or Edge to other browsers, because the older CSE isn't downloading the latest Chrome extension. What can I do?" +sidebar_position: 190 +--- + +# An older CSE isn't routing from Chrome or Edge to other browsers, because the older CSE isn't downloading the latest Chrome extension. What can I do? + +This is a quick Q & A about this concern. + +Q: What's the (business) problem exactly ? + +A:Netwrix Endpoint Policy Manager (formerly PolicyPak) was contacted by Google about theEndpoint +Policy Manager Browser Router Chrome Extension. + +:::note +This is NOT a security concern. They have a policy which basically says … that we're not +allowed to have more than one extension which does (essentially) the same thing. +::: + + +Q: So what's the (technical) problem exactly ? + +A: When you install theEndpoint Policy Manager CSE and use theEndpoint Policy Manager Browser Router +Chrome Extension, we tie a specific CSE version to download a specific Chrome Extension browser. For +YEARS it's been OK to just keep publishing NEW versions of the Chrome Extension, when we had MAJOR +updates to the CSE. One Major Update = One Chrome Extension. Chrome is changing the rules and +saying, basically, we cannot do that since the Extension ostensibly does the same thing. Our +position is that we are only doing this because we technically have to. But, Google being Google, +rules are rules. + +Q: What does this mean for me? + +A: In the short term, nothing.Endpoint Policy Manager Browser Router will continue to operate within +user profiles where Chrome or Edge has ALREADY DOWNLOADED the OLDER version of the Chrome Extension. +Again: because the older extension is ALREADY DOWNLOADED, those users are unaffected. + +Q: When would I notice a problem and have unhappy users? + +A: There are a few scenarios where you could notice that routing from Chrome or Edge to other +browsers is not working any longer. The typical ways you could encounter this are: + +- If you manually delete the older Chrome extension, then the olderEndpoint Policy Manager Browser + Router CSE will not be able to re-download the old Chrome Extension. +- If you delete a user's profile and then re-log on, then the olderEndpoint Policy Manager Browser + Router CSE will not be able to re-download the old Chrome Extension. +- If you bring up a brand new machine and then users log on, then the olderEndpoint Policy Manager + Browser Router CSE will not be able to re-download the old Chrome Extension. + +Q: How would I know if I'm affected byEndpoint Policy Manager being forced to take down some +olderEndpoint Policy Manager Browser Router Chrome Extensions? + +A: We have the list of extensions which ARE VALID (now, it is exactly ONE extension) and which WERE +valid (100% of the older ones are now turned off) which are on this list + +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) + +Q: What should I now? + +A: You have two choices: Upgrade to the latest CSE (recommended) or perform the "workaround" which +enables OLDER CSEs to keep using the NEW (only published) extension. + +Q: How should I update to the latest extension? + +A: Our general guidance is, and has always been… please try to stick closely to us in our release +schedule as possible. We know this is not always possible, but have generalized guidance here of how +you should update the CSE and exactly what "supported" means. +[https://www.endpointpolicymanager.com/resources/pp-blog/using-rings-to-test-and-update-the-policypak-client-side-extension-and-how-to-stay-supported/](https://www.endpointpolicymanager.com/resources/pp-blog/using-rings-to-test-and-update-the-policypak-client-side-extension-and-how-to-stay-supported/) + +Q: I cannot update to the latest extension, but I am using builds CSE 18.7.1779.937 - +19.12.2283.849. What is this workaround of which you speak? + +A: We have a KB article about it here: "How can I use the onlyEndpoint Policy Manager published +Chrome Extension with my older CSE? (CSE 18.7.1779.937 - 19.12.2283.849)" +[How can I use the only remaining Endpoint Policy Manager published Chrome Extension with my older CSE? (CSE 18.7.1779.937 - 19.12.2283.849)](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextension.md) + +Q: I'm using a CSE before 18.7.1779.937. What is the workaround? + +A: You must upgrade affected machines to the latest CSE to fix this problem. + +Q: Will we have this problem in the future? + +A: We have figured out how to have ONE Chrome Extension for all versions going forward. The latest +Chrome Extension … with the easy to remember name "fmbfiodledfjldlhiemaadmgppoeklbn" … is going to +be the "going forward one" that we can just always use. If you upgrade to the latest CSE then stick +reasonably close to our release schedule and guidance we think you won't likely have a problem. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/citrixproblems.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/citrixproblems.md new file mode 100644 index 0000000000..f532748e29 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/citrixproblems.md @@ -0,0 +1,26 @@ +--- +title: "Chrome and Citrix problems" +description: "Chrome and Citrix problems" +sidebar_position: 80 +--- + +# Chrome and Citrix problems + +## Symptom: + +A user logs into their Citrix desktop and attempts to launch Google chrome but nothing happens. + +## Solutions: + +A temporary workaround is to manually kill any `Chrome.exe` processes being run by that user before +chrome will launch properly. + +The permanent workaround would be to use theNetwrix Endpoint Policy Manager (formerly PolicyPak) +Application Settings Manager Chrome Pak, and on the COMPUTER side, to deliver + +UN-check to "Continue running background apps when Google Chrome is Closed) as seen in the +screenshot. + +Chrome is keeping itself alive, even though it should not. This will fix the problem. + +![253_1_image0015](assets/chrome/253_1_image0015.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/contactsupport.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/contactsupport.md new file mode 100644 index 0000000000..1d9aaf75b0 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/contactsupport.md @@ -0,0 +1,49 @@ +--- +title: "What does it mean when Endpoint Policy Manager Browser Router gives a pop-up saying to contact support to my end-users?" +description: "What does it mean when Endpoint Policy Manager Browser Router gives a pop-up saying to contact support to my end-users?" +sidebar_position: 120 +--- + +# What does it mean when Endpoint Policy Manager Browser Router gives a pop-up saying to contact support to my end-users? + +If you see a message like what's seen below… + +"Please contact your support personnel who can gather logs and work with Netwrix Endpoint Policy +Manager (formerly PolicyPak) support." + +![206_1_image](assets/206_1_image.webp) + +This could happen for a variety of reasons. + +**Step 1 –** Please make sure you are using the ABSOLUTE latest Endpoint Policy Manager Client Side +Extension and then attempt to reproduce. Even if Endpoint Policy Manager Browser Router has had no +changes in a previous build, it's possible that another part of Endpoint Policy Manager has caused +the issue, we know about it, and have possibly fixed it in the latest Client Side Extension. + +After that.. there are the following likely causes of problems: + +**Step 2 –** Some other security software like: McAfee, Carbon Black, Ivanti LES (HEAT), etc. +Sometimes an upgrade in THESE kinds of software will break and "beat up" on Endpoint Policy Manager. +So everything was working yesterday, but then stopped working AFTER you made an upgrade to one of +these pieces of software. A good test would be to remove or roll it backward or exclude Endpoint +Policy Manager from these specific pieces of software. + +Tips: + +- Ivanti LES (HEAT) workarounds: + [https://community.ivanti.com/docs/DOC-59389](https://community.ivanti.com/docs/DOC-59389) +- For your AV / other software, see your own vendor's exclusions. +- Endpoint Policy Manager AV Exclusions: + [How must I configure my Anti-virus or system-level software to work with Endpoint Policy Manager CSE?](/docs/endpointpolicymanager/knowledgebase/installation/knowledgebase/antivirussystemsoftware/antivirus.md) +- If you have a FEW or ONE machine showing the issue: FAQ. + +**Step 3 –** After that, it could still be a bug. But it would typically appear on MANY machines and +not just a SINGLE or a FEW machines. That being said, if you would like for us to check out your +logs, in these cases, we need AT LEAST TWO machines to see a PATTERN in the logs. So be prepared to +get logs from multiple machines showing the issue so we can do some deeper investigation. + +[What must I send to Endpoint Policy Manager support in order to get the FASTEST support?](/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/troubleshooting/fastsupport.md) + +:::tip +Remember, We need AT LEAST two machines of logs to check in this case. +::: diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/criticalwebsiteincompatibility.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/criticalwebsiteincompatibility.md new file mode 100644 index 0000000000..fd43218e70 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/criticalwebsiteincompatibility.md @@ -0,0 +1,46 @@ +--- +title: "I'm having a \"Browser Router Emergency\" or some kind of critical website incompatibility. What can I do?" +description: "I'm having a \"Browser Router Emergency\" or some kind of critical website incompatibility. What can I do?" +sidebar_position: 20 +--- + +# I'm having a "Browser Router Emergency" or some kind of critical website incompatibility. What can I do? + +There are a few things you can do if you need to keep Netwrix Endpoint Policy Manager (formerly +PolicyPak) running on the machine (in general) but disable Browser Router's interaction with the +machine. +That being said, here's the order we recommend in getting to the bottom of the issue. + +**Step 1 –** What happens if you 100% uninstall the Endpoint Policy Manager CSE…. Does the problem +go away? If NO, then this is unlikely to be a Endpoint Policy Manager problem. + +**Step 2 –** Can you reproduce using the LATEST CSE available in the Portal. Does the problem go +away? + +**Step 3 –** Check to see if this flag is set in ANY routes. A check here could "bleed" from one +route into another website. This setting is not supported, and as such you might have to remove it +from all routes. + +![814_1_img-01](assets/814_1_img-01.webp) + +**Step 4 –** After steps 1, 2 and 3… if you can REPRODUCE using latest CSE... then and only then.. +send us log files (user and computer) via Sharefile (do not attach.) + +[What must I send to Endpoint Policy Manager support in order to get the FASTEST support?](/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/troubleshooting/fastsupport.md) + +**Step 5 –** AFTER you install the latest CSE, you might want to attempt to disable the in-Browser +Extensions for the affected browser, but keep Browser Router operating. Here's how to do that (see +screenshot below.) + +![814_3_img-02](assets/814_3_img-02.webp) + +**Step 6 –** AFTER you install the latest CSE and the in-browser Extension, and are STILL able to +reproduce the issue, you could kill JUST the affected component like Browser Router. Use these +instructions: + +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) +(KB shows killing PPPreferences, but in this case you would kill Endpoint Policy Manager Browser +Router.) + +**Step 7 –** Is the web app something we could have access to, and reproduce the experience on our +end? If yes, that would get you a test / repro / fix about 100x faster. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/default.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/default.md new file mode 100644 index 0000000000..40976312e1 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/default.md @@ -0,0 +1,142 @@ +--- +title: "Why is Browser Router not showing up as the OS Default Browser since Feb24/March24 Monthly windows patches KB5035845?" +description: "Why is Browser Router not showing up as the OS Default Browser since Feb24/March24 Monthly windows patches KB5035845?" +sidebar_position: 300 +--- + +# Why is Browser Router not showing up as the OS Default Browser since Feb24/March24 Monthly windows patches KB5035845? + +**Updated 9/12/2024**: Starting from CSE version 24.9 and later this problem has been overcome. If +you're using CSE version 24.9 and later, there is no need to follow these steps. Only use these +steps if you're using a CSE before version 24.9. + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router and Endpoint Policy Manager File +Associations Manager will generally still work as expected. However, since the Feb24/March24 Monthly +windows patches KB5035845, Edge appears to “take over and won’t let go” of: + +- File Association PDF +- Protocol: HTTP +- Protocol: HTTPS + +What will work: + +- Browser to Browser Routing +- File Associations for everything except PDF + +What won’t work: + +- Browser Router won’t be registered as “Endpoint Policy Manager Browser Router Agent” within the + OS. You’ll see Edge. +- Browser Router “Default Policy” type is not honored as expected and anything set to “Default + Browser” will be passed onward to Edge (instead of what you might have set it to, say, Firefox, + Chrome, etc). Use this article to understand “Endpoint Policy Manager Browser Router Default + Policy” type + [What is meant by "Default Browser" within Endpoint Policy Manager Browser router?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/tipsandtricks/defined.md) +- Delivering File Associations specifically for PDF for Endpoint Policy Manager File Associations + Manager + +You will also get the same experience if you attempt to use PolicyPak File Associations Manager to +change HTTP or HTTPS, even if you’re not using PolicyPak Browser Router. See the +[Can I use Endpoint Policy ManagerBrowser Router and/or Endpoint Policy Manager File Associations Manager to set the default browser?](/docs/endpointpolicymanager/knowledgebase/fileassociationsmanager/knowledgebase/troubleshooting/defaultbrowser.md) +topic for additional information. + +Troubleshooting: + +Here’s an example log output: + +The `ppSwitched_onLogon` log file shows “Default Browser: MicrosoftEdge.EXE + +Agent Display Name: 'Managed by your organization (Browser Name) + +Use actual default browser icon: true + +Later in that file it shows an error: + +Updating system settings and registry entries + +``` +{ +    Loaded browser router policies state for user 'sxr'. Active: true +    Loaded browser router policies state for any user. Active: true +    Updating 'Browser Router' browser settings +    { +      Going to apply user side settings. +      Going to save default browser selected by user. +      Default browser selected by user: 'MSEdgeHTM' +      Default browser selected by user: 'MSEdgeHTM' +      Changing program associations +      { +        Error: Couldn't write association for 'http'. ProgId: 'PPBRNURL', Error code: 5 +        Error: Couldn't write association for 'https'. ProgId: 'PPBRNURL', Error code: 5 +      } // End of Changing program associations, elapsed time: 00:00:00.078  + +``` + +However, there is a workaround for both scenarios if your computers are DOMAIN JOINED. + +You can Revert to Legacy methods which have some detractors. Read the Explain/Help text for each of +these two policy settings to decide if you want to revert back one or both products to Legacy +method. + +:::warning +The Legacy methods will not work if your endpoints are only using PolicyPak Cloud or +only using an MDM service like Intune. Legacy mode only works when the machine is domain joined. +::: + + +:::note +After setting these settings and the policy refresh occurs to get these policies, +endpoints may still need two logoffs and/or reboots for this to kick in. +::: + + +![1326_1_2c5259c2472101dd55c56da8d1dbdb33](assets/1326_1_2c5259c2472101dd55c56da8d1dbdb33.webp) + +![1326_2_8f4ae9cf7f0bba8ddccb128640467c25](assets/1326_2_8f4ae9cf7f0bba8ddccb128640467c25.webp) + +Update 4/8/2024: + +It was identified that UCPD.sys driver is causing the issue with default file association for .PDF +and protocol association for HTTP/HTTPS. + +UCPD.sys affects the following registry paths responsible for the associations to file extensions +and protocols: + +Workaround 1 using Endpoint Policy Manager Scripts & Triggers + +To fix the issue, you need to perform two steps: + +**Step 1 –** Create a Powershell script which will disable the UCPD.sys driver via registry. + +- `New-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\UCPD” -Name “Start” -Value 4 -PropertyType DWORD -Force` + + - This script is setting value 4 to UCPD service to be disabled + +- `Unregister-ScheduledTask -TaskName "UCPD velocity"` + + - This part will unregister the scheduled task to check and re-deploy UCPD service at startup + +- Disable UCPD.sys driver + + ``` + New-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\UCPD” -Name “Start” -Value 4 -PropertyType DWORD -Force + Unregister-ScheduledTask -TaskName "UCPD velocity" + Unregister-ScheduledTask -TaskName "Pre-staged app cleanup" + ``` + +**Step 2 –** Deploy the script via Endpoint Policy Manager Scripts Manager using the hints from the +screen shot below. + +![1326_3_3e0331eadab3e6c272573b5c3b67e23c](assets/1326_3_3e0331eadab3e6c272573b5c3b67e23c.webp) + +Workaround 2 using fsLogix (Microsoft Tools) + +You may also use Microsoft fsLogix if already installed on servers or workstations. You may use the +following redirect rules which should overcome the concern. + +:::note +Do not use both Workaround 1 and 2 at the same time. +::: + + +![1326_4_3a4d59894f3cd6623b958202447b1136](assets/1326_4_3a4d59894f3cd6623b958202447b1136.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/dllcompatible.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/dllcompatible.md new file mode 100644 index 0000000000..bd2297b076 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/dllcompatible.md @@ -0,0 +1,23 @@ +--- +title: "PPBRAgentExeIE_01.DLL error message occurs about Internet Explorer enhanced security. What should I do?" +description: "PPBRAgentExeIE_01.DLL error message occurs about Internet Explorer enhanced security. What should I do?" +sidebar_position: 40 +--- + +# PPBRAgentExeIE_01.DLL error message occurs about Internet Explorer enhanced security. What should I do? + +When running IE and Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router, the +following error could occur: + +![441_1_image004](assets/441_1_image004.webp) + +This message is caused by IE Enhanced Security mode. To get Endpoint Policy Manager Browser Router +to work properly, set IE specifically to have these two checkboxes unchecked. + +![441_2_image0012](assets/441_2_image0012.webp) + +Then, restart IE (a reboot is not required). + +Note also that if the top checkbox is checked, the error does not occur, but Endpoint Policy Manager + +Browser Router still will not run. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/dnscall.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/dnscall.md new file mode 100644 index 0000000000..4f2f80138b --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/dnscall.md @@ -0,0 +1,30 @@ +--- +title: "Why does Endpoint Policy Manager PPExtensionService.exe make a call out to DNS?" +description: "Why does Endpoint Policy Manager PPExtensionService.exe make a call out to DNS?" +sidebar_position: 240 +--- + +# Why does Endpoint Policy Manager PPExtensionService.exe make a call out to DNS? + +## Problem: + +Your production system or network monitoring tools are logging a lot of DNS queries for a +decommissioned host. + +In System Monitor (Sysmon) logs there are frequent Event Log entries of `PPExtensionService.EXE` +that is querying that dead host computer' FQDN. + +Like in an example screenshot below. + +![878_1_image-20211223234143-1](assets/878_1_image-20211223234143-1.webp) + +## Cause: + +The cause of the problem is a Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router +(PPBR) rule that has an Item-level Targeting (ILT) filter of the decommissioned host computer. + +![878_2_image-20211223234143-2](assets/878_2_image-20211223234143-2.webp) + +## Resolution: + +Correct the ILT condition or remove the filter that is in place for that computer. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/extensioninactive.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/extensioninactive.md new file mode 100644 index 0000000000..2fe1bb8800 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/extensioninactive.md @@ -0,0 +1,32 @@ +--- +title: "I see the Endpoint Policy Manager Browser Router Chrome Extension is being installed, but it's not active. What can I do?" +description: "I see the Endpoint Policy Manager Browser Router Chrome Extension is being installed, but it's not active. What can I do?" +sidebar_position: 130 +--- + +# I see the Endpoint Policy Manager Browser Router Chrome Extension is being installed, but it's not active. What can I do? + +From time to time it's possible that the Netwrix Endpoint Policy Manager (formerly PolicyPak) +Browser Router extension for Chrome will be installed, but not active, like in this example. + +![489_1_dfg_950x593](assets/chrome/489_1_dfg_950x593.webp) + +This can occur if you are attempting to force deploy the extension via Group Policy or Endpoint +Policy Manager Application Manager or if there is some kind of error. + +The first workaround to try is to rename the problematic extension folder: + +i.e. `%LocalAppData%\Google\Chrome\User Data\Default\Extensions\fmbfiodledfjldlhiemaadmgppoeklbn` + +Then close and relaunch Chrome, also check the Systray to ensure Chrome is not running in the +background, if it is then disable that option. + +If that does not work then rename +the `%LocalAppData%\Google\Chrome\User Data\Default\Extensions `folder to reset the Chrome +extensions. + +This should snap it back in place the next time Chrome re-launches. + +As a last resort, if the above does not work you can rename the +`%LocalAppData%\Google\Chrome\User Data\Default `folder to reset Chrome and then close and relaunch +Chrome. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/firefox.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/firefox.md new file mode 100644 index 0000000000..24a52b9cdf --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/firefox.md @@ -0,0 +1,31 @@ +--- +title: "Why don't routes work from Firefox to other browsers (in Firefox 49+) ?" +description: "Why don't routes work from Firefox to other browsers (in Firefox 49+) ?" +sidebar_position: 60 +--- + +# Why don't routes work from Firefox to other browsers (in Firefox 49+) ? + +If you run into issues when Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router is +configured to route site from Firefox to some other browser but its not routing at all. We've fixed +this problem with the latest CSE, but if you're using an OLDER CSE, then you could need to modify +Firefox to compensate. + +New releases of Firefox comes with the setting where we can enable multi-process windows for the +browsers. See the following screenshot: + +![492_1_image001](assets/492_1_image001.webp) + +The above screenshot means that its enabled and you should expect the Endpoint Policy Manager +Browser Router will have problem in routing. To make it working please disable the setting using +Endpoint Policy Manager's pre-configured Pak for Firefox about:config as illustrated in the +screenshot: + +![492_2_image002](assets/492_2_image002.webp) + +So once you check and uncheck the above option it will set the value as false like shown in below +screenshot: + +![492_3_image003](assets/492_3_image003.webp) + +You should be all set for now with Endpoint Policy Manager Browser Router. Let us know if otherwise. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/forceinstall.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/forceinstall.md new file mode 100644 index 0000000000..9e12c83d3a --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/forceinstall.md @@ -0,0 +1,71 @@ +--- +title: "Endpoint Policy Manager Browser Router removes other Chrome ‘force installed' extensions. How can I work around this?" +description: "Endpoint Policy Manager Browser Router removes other Chrome ‘force installed' extensions. How can I work around this?" +sidebar_position: 50 +--- + +# Endpoint Policy Manager Browser Router removes other Chrome ‘force installed' extensions. How can I work around this? + +Here's what's happening: + +- Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router installs the PPBR forced + extension plug in on the COMPUTER side at installation time. +- When you use Endpoint Policy Manager Application Settings Manager or Chrome's ADMX to specifically + dictate plugins PER-USER... +- There's a conflict, and Google doesn't MERGE, it just uses COMPUTER. + +RESULT: You only see Endpoint Policy Manager Browser Router's extension and NOT your desired +user-side extensions for Chrome.. Workaround: Endpoint Policy Manager Provides ADMX settings to work +around various items in Endpoint Policy Manager On-Prem. See this video to implement the ADMX: + +[Troubleshooting with ADMX files](/docs/endpointpolicymanager/knowledgebase/gettingstarted/videolearningcenter/troubleshooting/admxfiles.md) + +:::note +You shouldn't need to perform these steps (any of them) if you want to dictate Chrome +"forced installed" extensions on the COMPUTER side. On the COMPUTER side... when you force install +extensions, Endpoint Policy Manager Browser knows what to do and just adds in the correct Chrome +Extension. This KB is only required if you are opting to dictate Chrome "forced installed" +extensions on the USER side. +::: + + +Then, the policy setting which must be applied to the computer side which is called PREVENT COMPUTER +SIDED INSTALLATION OF CHROME EXTENSION + +![171_1_image004](assets/chrome/171_1_image004.webp) + +Then… Using Chrome's own ADMX setting named "Configure the list of force-installed apps and +extensions" (seen below) to manually add the Endpoint Policy Manager Browser Router using Chrome's +ADMX setting on USER or COMPUTER side. + +![171_2_image006](assets/chrome/171_2_image006.webp) + +Use this string found in this article: + +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) + +For instance, an example string might look like … + +``` +fmbfiodledfjldlhiemaadmgppoeklbn;https://clients2.google.com/service/update2/crx +``` + +Which will manually install the Endpoint Policy Manager Browser Router Chrome Extension. Or using +Endpoint Policy Manager Application Settings Manager and our Chrome Pak, you can use this field +(user or computer side.) + +![171_3_image009](assets/chrome/171_3_image009.webp) + +Use the same string: + +``` +fmbfiodledfjldlhiemaadmgppoeklbn;https://clients2.google.com/service/update2/crx. +``` + +Which will manually install the Endpoint Policy Manager Browser Router Chrome Extension alongside +the optional extensions you wish for Chrome. + +Again, the example extension ID above is just an example. Please use the correct one based upon your +CSE. + +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/fromedgetootherbrowsers.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/fromedgetootherbrowsers.md new file mode 100644 index 0000000000..10dca17d92 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/fromedgetootherbrowsers.md @@ -0,0 +1,15 @@ +--- +title: "Why doesn't Edge to Other browser support work as expected?" +description: "Why doesn't Edge to Other browser support work as expected?" +sidebar_position: 90 +--- + +# Why doesn't Edge to Other browser support work as expected? + +1. Edge –> OTHER browser support is only valid for Windows 10 1703 and later. +2. In 1607 and earlier, the plug in will load, but may not work or at least have to manually enabled + it to function. +3. In 1703 and later.. the user might have to OPEN, CLOSE and RE-open Edge twice or three times + before it kicks in. +4. Regardless .. Netwrix Endpoint Policy Manager (formerly PolicyPak) Edge to Other browser support + is only expected to work / fully supported on Windows 10 1703 and later. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/fromietootherbrowsers.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/fromietootherbrowsers.md new file mode 100644 index 0000000000..e2294d3aec --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/fromietootherbrowsers.md @@ -0,0 +1,89 @@ +--- +title: "Why don't routes work from IE to other browsers?" +description: "Why don't routes work from IE to other browsers?" +sidebar_position: 70 +--- + +# Why don't routes work from IE to other browsers? + +For some customers, some Internet Explorer settings set or un-set are interfering with Netwrix +Endpoint Policy Manager (formerly PolicyPak) Browser Router's IE plug in. + +Before setting the setting in Group Policy, we suggest you test one or two machines; and there are +two settings you need to test. + +Said another way, ONE, TWO or THREE values may need to be tested to encompass a complete solution. + +## Value #1: Enable third-party browser extensions + +**Step 1 –** Test on one or two machines and ensure this is ON as seen here. + +**Step 2 –** Reboot the machine and see if Endpoint Policy Manager Browser Router will route from IE +to other browsers + +![415_1_image0014](assets/internetexplorer/415_1_image0014.webp) + +(Old: Not needed anymore; here for archival purposes… + +## Value #2: Enhanced Protection Mode. + +**Step 1 –** Test on one or two machines with this OFF as seen here. + +**Step 2 –** Reboot the machine and see if Endpoint Policy Manager Browser Router will route from IE +to other browsers. + +![415_2_image003](assets/internetexplorer/415_2_image003.webp) + +(Old: Not needed anymore; here for archival purposes…) . + +## Value #3: + +**Step 1 –** Set the "Enable 64-bit processes for Enhanced Protection mode" CHECKED as seen here. + +**Step 2 –** Reboot the machine and see if Endpoint Policy Manager Browser Router will route from IE +to other browsers. + +![415_3_image005](assets/internetexplorer/415_3_image005.webp) + +Once you learn what combination works, then set these settings in Group Policy . You can do this on +USER or COMPUTER side. We recommend COMPUTER. + +Windows ComponentsInternet ExplorerInternet Control PanelAdvanced Page + +Then select the: + +Turn on Enhanced Protection Mode :: Set to Disabled + +And/or + +Turn on 64-bit tab processes when running in Enhanced Protection Mode :: Set to Enabled + +:::tip +Remember, Remember that each machine needs to be rebooted after it receives these directives; just +like you did in your manual tests. +::: + + +![415_4_image0061](assets/internetexplorer/415_4_image0061.webp) + +Note also that the settings can be hiding in one ore more GPOs, so use GPresult to look for those +values. + +Additionally, these same values can be found in Group Policy Preferences Internet Explorer 10 +settings (which affects 10 and 11). + +An example GPresult /h report will show a Group Policy Preferences setting demonstrating the +required "Enable third-party browser extensions (requires restart)" as DISABLING the ability to use +third-party extensions. + +![415_5_faq-asdf-01](assets/internetexplorer/415_5_faq-asdf-01.webp) + +In these cases, you need to find the Group Policy Preferences item within the GPO and set the value +to GREEN and CHECK which will "Enable third-party browser extensions". + +![415_6_faq-asdf-02](assets/internetexplorer/415_6_faq-asdf-02.webp) + +Only then will the GPO's GPresult report demonstrate that the required item is Enabled like what's +seen here. + +![415_7_faq-asdf-03](assets/internetexplorer/415_7_faq-asdf-03.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/keeporiginaltab.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/keeporiginaltab.md new file mode 100644 index 0000000000..3234a8bdd9 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/keeporiginaltab.md @@ -0,0 +1,34 @@ +--- +title: "What is the PPBR \"Keep original tab open when routing / Experimental Feature\" checkbox, and why must I turn it OFF for ALL routes if I'm having trouble with ONE website?" +description: "What is the PPBR \"Keep original tab open when routing / Experimental Feature\" checkbox, and why must I turn it OFF for ALL routes if I'm having trouble with ONE website?" +sidebar_position: 150 +--- + +# What is the PPBR "Keep original tab open when routing / Experimental Feature" checkbox, and why must I turn it OFF for ALL routes if I'm having trouble with ONE website? + +The "Keep original tab open when routing / Experimental" flag is for a specific use case and is +generally not recommended. + +The feature is there to keep an ORIGINAL tab open AND also start a new website on a new tab (instead +of closing the original tab.) + +That being said, when you use this feature, every website is touched even if the website is not +involved in a route. + +Every website has the HTML re-written to attempt to work for this feature… even if the website is +not related at all to this route. + +Therefore, we generally do NOT recommend you use this feature, and you might be asked by support to +turn it off in ALL ROUTES if you're having ANYNetwrix Endpoint Policy Manager (formerly PolicyPak) +Browser Router problems. + +Problems which might arise are typically websites with "multiple tabs" like this: + +![589_1_img-01_950x137](assets/editpolicytemplate/589_1_img-01_950x137.webp) + +In these cases, you would need to go through EACHEndpoint Policy Manager Browser Router entry and +UN-check the Experimental flag checkbox. + +Then you issues should be resolved. + +![589_3_img-02_950x665](assets/editpolicytemplate/589_3_img-02_950x665.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/launch.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/launch.md new file mode 100644 index 0000000000..073a17ab6d --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/launch.md @@ -0,0 +1,102 @@ +--- +title: "How to fix the Chrome / Edge Chromium launch issues?" +description: "How to fix the Chrome / Edge Chromium launch issues?" +sidebar_position: 250 +--- + +# How to fix the Chrome / Edge Chromium launch issues? + +You might discover one or more computers will not correctly launch Chrome or Edge. + +Netwrix Endpoint Policy Manager (formerly PolicyPak) was required to update the Endpoint Policy +Manager Browser Router extension in the Google Chrome store from V2 to V2 Manifests.  MV2 support +timeline is ending on June 2022. This document has more +information: [https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/](https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/). + +After we updated and republished the PPBR chromium extension with V3 manifests, some customers +reported that Endpoint Policy Manager Browser Router would stop routing after Chrome or Edge was +opened (and left opened) for 5 – 10 minutes. The reason for this error is a known Chromium API bug +reproducible for MV3 extensions. Check the following discussion: +[https://bugs.chromium.org/p/chromium/issues/detail?id=1189678](https://bugs.chromium.org/p/chromium/issues/detail?id=1189678). The +MV3 support for the Browser Router extension will be rescheduled as soon as the Chromium bug is +fixed. + +Therefore, due to the Chromium timeout bug with v3 manifests, we rolled back to the V2 manifest +version. + +In doing so, a Chrome / Edge bug itself may not be able to compensate for the switch back to V2 +manifests from the V3 manifests already in the Chrome / Edge profiles. Sometimes, the V3 extension +is not removed correctly and you'll see both V2 and V3 manifests at the same time; causing Chrome / +Edge crash during startup. + +Resolution is reasonably straightforward: Chrome and Edge shouldn't have both manifests at the same +time. For now, affected machines need removal of the MV3 extension.  + A quick fix for the Chrome/Edge launch issue is reinstalling the Endpoint Policy Manager Cloud +Client and /or CSE. However, following workaround should work as well. + +**Step 1 –** Remove the +directory` fmbfiodledfjldlhiemaadmgppoeklbn from %LocalAppData%\Google\Chrome\User Data\Default\Extensions\` + +**Step 2 –** Remove the +directory` fmbfiodledfjldlhiemaadmgppoeklbn from %LocalAppData%\Microsoft\Edge\User Data\Default\Extensions\` + +**Step 3 –** Logoff and Re-logon to the client machine. (A true logoff and log on is required.) + +Here is a PowerShell script that can be used with Endpoint Policy Manager Scripts Manager which goes +into the Chrome or Edge folder and deletes all the details for the extension. + +PowerShell Scripts for Google Chrome and Microsoft Edge Chromium: + +Google Chrome: + +``` +$users = Get-ChildItem C:\Users +foreach ($user in $users){$folder = "$($user.fullname)\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmbfiodledfjldlhiemaadmgppoeklbn" +If (Test-Path $folder) {Remove-Item $folder -Recurse -Force -ErrorAction silentlycontinue } } +``` + +Microsoft Edge: + +``` +$users = Get-ChildItem C:\Users +foreach ($user in $users){$folder = "$($user.fullname)\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\fmbfiodledfjldlhiemaadmgppoeklbn" +If (Test-Path $folder) {Remove-Item $folder -Recurse -Force -ErrorAction silentlycontinue } } +``` + +## Deploy these PowerShell scripts using Endpoint Policy Scripts Manager: + +These are the locations and directories of the Endpoint Policy Manager Browser Router Extension that +will be removed when PS script is deployed with PP Scripts Manager. + +**Step 1 –** BR Extension folder location. + +![870_1_image-20220217002324-1](assets/chrome/870_1_image-20220217002324-1.webp) + +**Step 2 –** Create a User-side PP Scripts Manager policy. Use the Google Chrome PS script from PS +Scripts section. + +![870_2_image-20220217002324-2](assets/chrome/870_2_image-20220217002324-2.webp) + +**Step 3 –** Create a User-side PP Scripts Manager policy. Use the Microsoft Edge PS script from PS +Scripts section. + +![870_3_image-20220217002324-3](assets/chrome/870_3_image-20220217002324-3.webp) + +**Step 4 –** At next `GPUPDATE `or when`/FORCE`switch is used the respective folders for the +extension will be removed. + +**Step 5 –** At next logon and Chrome or Edge restart, the Endpoint Policy Manager Browser Router +extension with the single (correct) manifest will return. + +**Step 6 –** Verify the Endpoint Policy Manager Browser Router extension of each Browser as shown +below. + +Microsoft Edge: + +![870_4_image-20220217002324-4](assets/chrome/870_4_image-20220217002324-4.webp) + +Google Chrome: + +![870_5_image-20220217002324-5](assets/chrome/870_5_image-20220217002324-5.webp) + +Use this Endpoint Policy Manager Scripts Manager policy to mass deploy for any future issues. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/office365.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/office365.md new file mode 100644 index 0000000000..8388fcc71c --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/office365.md @@ -0,0 +1,60 @@ +--- +title: "How to set \"Choose which browser opens web links in Office365\" so that Browser Router properly routes web links in Outlook" +description: "How to set \"Choose which browser opens web links in Office365\" so that Browser Router properly routes web links in Outlook" +sidebar_position: 270 +--- + +# How to set "Choose which browser opens web links in Office365" so that Browser Router properly routes web links in Outlook + +:::note +Netwrix Endpoint Policy Manager (formerly PolicyPak) Cloud already has the +Office2016/Office365 ADMX settings available in the Cloud and they can be accessed via the Endpoint +Policy Manager Admin Templates Manager built-in cloud editor.‌ +::: + + +For the Endpoint Policy Manager OnPrem version, you can download the Office 365 ADMX files from +here - +[https://www.microsoft.com/en-US/download/details.aspx?id=49030](https://www.microsoft.com/en-US/download/details.aspx?id=49030) +for use in your On-Prem environment. + +Also, this policy will not work for Microsoft 365 Apps for Business, See Group Policy Support +section in the table at the link below: + +[https://learn.microsoft.com/en-us/office365/servicedescriptions/office-applications-service-description/office-applications-service-description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-applications-service-description/office-applications-service-description) + +![966_1_image-20231114102807-2](assets/966_1_image-20231114102807-2.webp) + +11 Limited to policies for web apps and privacy policies for client apps. + +## SCENARIO 1: Using Endpoint Policy Manager Cloud + +Create a new Admin Template policy with the appropriate setting from the ADMX template (use Keyword +section to search): + +![966_2_image-20230922212443-1](assets/966_2_image-20230922212443-1.webp) + +Now set the value to "System default browser" instead of "Microsoft Edge" in the policy: + +![966_3_image-20230922212443-2_950x650](assets/966_3_image-20230922212443-2_950x650.webp) + +## SCENARIO 2: Using Endpoint Policy Manager On-Prem + +Once Office ADMX is deployed, create a new Admin Template policy with the appropriate setting from +the ADMX template (use Keyword section to search): + +![966_4_image-20230922212443-3_950x397](assets/966_4_image-20230922212443-3_950x397.webp) + +Now set the value to "System default browser" instead of "Microsoft Edge" in the policy: + +![966_5_image-20230922212443-4](assets/966_5_image-20230922212443-4.webp) + +## Verification: + +### BEFORE: + +![966_6_image-20230922212443-5](assets/966_6_image-20230922212443-5.webp) + +### AFTER: + +![966_7_image-20230922212443-6](assets/966_7_image-20230922212443-6.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/pattern.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/pattern.md new file mode 100644 index 0000000000..7843e19ec0 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/pattern.md @@ -0,0 +1,23 @@ +--- +title: "Browser router doesn't seem to work when I use a pattern, and the URL has multiple redirects." +description: "Browser router doesn't seem to work when I use a pattern, and the URL has multiple redirects." +sidebar_position: 100 +--- + +# Browser router doesn't seem to work when I use a pattern, and the URL has multiple redirects. + +Our suggestion would be NOT to make Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser +Router patterns for URLs which go "in the middle of being redirected". + +We cannot support these URLs in some browsers (e.g. in IE) and it cannot be fixed. + +Our suggestion is to add PPBR pattern for a FIRST URL expected in redirects chain, or to the LAST +URL. + +For example: if user navigates `www.abc.com` in IE, and he is redirected to `www.def.com` and then +to `www.ghi.com` .. this MIGHT work in SOME browsers, but not others. + +We suggest you pick EITHER `"*abc* -> Chrome"` (example) or `"*ghi* -> Chrome"` (example). + +But AVOID following pattern: `"*def* -> Chrome" `which is in the MIDDLE of the redirect and not +expected to work. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/quick.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/quick.md new file mode 100644 index 0000000000..abb4ba2c95 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/quick.md @@ -0,0 +1,128 @@ +--- +title: "How to quickly troubleshoot Endpoint Policy Manager Browser Router" +description: "How to quickly troubleshoot Endpoint Policy Manager Browser Router" +sidebar_position: 280 +--- + +# How to quickly troubleshoot Endpoint Policy Manager Browser Router + +**Step 1 –** Are you licensed? And did you reboot the endpoint? + +Each component of Netwrix Endpoint Policy Manager (formerly PolicyPak) On-Prem is licensed +separately. + +Endpoint Policy Manager Browser Router is licensed with a license key, and that license key is +typically inside a GPO. + +To understand how / where your license keys might live, please check this video: + +[https://kb.endpointpolicymanager.com/kb/article/458-policypak-licensing-onpremise-licensing-methods-compared](https://kb.endpointpolicymanager.com/kb/article/458-policypak-licensing-onpremise-licensing-methods-compared) + +Also, before continuing, reboot the endpoint with the Endpoint Policy Manager CSE / Endpoint Policy +Manager Browser Router installed upon it. + +Endpoint Policy Manager Browser Router may need a reboot the first time for all features. + +**Step 2 –** Are you getting the GPO? + +You need a GPO to make the routes. Make sure the following is true: + +- You have a GPO. +- GPO is linked to either USER or COMPUTER OU. +- The GPO has data / routes in it for the correct side. + +In this example, the GPO has data / routes on the user side and is correctly linked to where users +reside (West Sales Users.) + +![55_1_image007](assets/55_1_image007.webp) + +**Step 3 –** Verifying you GOT the GPOs… one for licensing and one for the routes. + +Run `GPresult /R `two times: + +- AS an ADMIN and verify that you got the LICENSING GPO. +- As the USER and verify you got the GPO with the Endpoint Policy Manager Browser Router data. + +![55_2_image008-1024x395](assets/55_2_image008-1024x395.webp) + +**Step 4 –** Is Endpoint Policy Manager Browser Router the "default browser" ? + +In DEFAULT PROGRAMS, verify that PPBRAgent is the Default Browser for HTTP and HTTPs. + +(Will be PPBRAgent32 on 32-bit and PPBRAgent64 on 64-bit). + +:::warning +For Non-Domain Joined machines, we (PolicyPak) cannot set this automatically. For more +information on this +problem, [Which Endpoint Policy Manager items will not work when the computer is non-domain joined (or the computer is NEVER connected to the Internet)?](/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/nondomainjoined/limitations.md) +::: + + +For Domain joined Windows 10, Look at Default Programs here, + +![55_3_image](assets/55_3_image.webp) + +For Domain Joined Windows 7, check Default Programs as seen here, + +![55_4_image013](assets/55_4_image013.webp) + +![55_5_image014](assets/55_5_image014.webp) + +CHECKPOINT: If PPBRAGENT is not the default for HTTP and HTTPS then, run `GPupdate /force` then +REBOOT the computer. + +Then verify that it took. If it didn't, stop here and figure out why. + +Common reasons: + +- Computer doesn't have Endpoint Policy Manager CSE installed. +- Computer isn't licensed. +- User/ Computer didn't get the GPO. +- No Endpoint Policy Manager Browser Router routes at all. +- Again: For NON-Domain Joined machines, you must set Endpoint Policy Manager as the default browser + MANUALLY. There is no workaround. + +**Step 5 –** Check Endpoint Policy Manager Browser Router logs + +As the USER, go to `Appdata\Local\PolicyPak\PolicyPak Browser Router` and verify that ANY logs exist +as seen here. + +![55_6_image009](assets/55_6_image009.webp) + +Open the LATEST-created file (by date) for inspection. + +![55_7_image010](assets/55_7_image010.webp) + +**Step 6 –** Checking what Endpoint Policy Manager Browser Router thinks are your routes. Endpoint +Policy Manager Browser Router can take routes from various sources and multiple GPOs and/or files +and/or Endpoint Policy Manager Cloud. + +Ultimately those rules are boiled down to one file: `ppBRresults.xml.` + +You should manually inspect this to verify that routes are generated as expected. + +![55_8_image011-1024x487](assets/55_8_image011-1024x487.webp) + +**Step 7 –** Getting more help (exactly what to do and attach THREE THINGS). + +- To get MORE help with Endpoint Policy Manager Browser Router, first export your Endpoint Policy + Manager Browser Router collection as seen here. +- It’s good to take a screen shot too, so we can see what you’re trying to; computer or user side. +- Attach / send both your SCREEN SHOT and your XML EXPORT file to your support case. + +![55_9_image001-1](assets/55_9_image001-1.webp) + +Then, run `PPLOGS` twice: + +- Use an ADMIN command prompt and run `PPLOGS`. Rename to `ppLogs-as-Admin.zip`. Attach to your + support case. +- Use a NORMAL command prompt and run `PPLOGS`. Rename to` ppLogs-as-USER.zip`. Attach to your + support case. + +![55_10_image0012-1024x593](assets/55_10_image0012-1024x593.webp) + +:::note +If your email system strips ZIP files, rename it to `.ZIPP` or `.TXT` or whatever you +want. + +::: diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/removed.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/removed.md new file mode 100644 index 0000000000..b762d75e4e --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/removed.md @@ -0,0 +1,30 @@ +--- +title: "How does Browser Router function when Internet Explorer is removed from the machine?" +description: "How does Browser Router function when Internet Explorer is removed from the machine?" +sidebar_position: 260 +--- + +# How does Browser Router function when Internet Explorer is removed from the machine? + +First, if you still have IE in your environment, a good read would be this blog +entry: [https://techcommunity.microsoft.com/t5/windows-it-pro-blog/don-t-wait-for-june-15th-set-your-own-ie-retirement-date/ba-p/3298143](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/don-t-wait-for-june-15th-set-your-own-ie-retirement-date/ba-p/3298143)  +The goal is to simulate your own "IE Death date" internally and do some small scale testing before +IE actually goes away. + +From a Netwrix Endpoint Policy Manager (formerly PolicyPak) perspective, and specifically Endpoint +Policy Manager browser router, with IE going away/ gone, we have made some code changes to +compensate for it. + +Once IE is removed (for real, or using the simulation in policy from the Microsoft article above...) +the follow behavior is now expected with latest CSE and Endpoint Policy Manager Browser Router: + +1. WILDCARD route to IE, it will open in EDGE. (not IE in Edge) +2. URL route to IE, it will open in EDGE (not IE in Edge.) +3. URL + Browser mode route (WITH "Open in Standalone IE" or "Open as IE in edge tab" .. it will + open in EDGE IN IE MODE.) + +So if you are using Browser Router, we strongly recommend upgrading your CSEs to the latest version. + +But if you cannot / don't want to, know that you will get unexpected routing behavior. If you're +using something BEFORE that, we cannot guarantee success when IE is finally removed on April 15, +2022 diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/revertlegacy.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/revertlegacy.md new file mode 100644 index 0000000000..a7df40af7e --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/revertlegacy.md @@ -0,0 +1,48 @@ +--- +title: "How do I revert to \"Legacy Browser Router Method & Features\" if directed?" +description: "How do I revert to \"Legacy Browser Router Method & Features\" if directed?" +sidebar_position: 140 +--- + +# How do I revert to "Legacy Browser Router Method & Features" if directed? + +If you are having a problem with Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router +(PPBR) not working as expected, you may be asked by tech support to "Revert to Legacy Browser Router +Method & Features". + +First, be sure you are eligible to use this function by copying the latest Endpoint Policy Manager +`ADMX` files to your Central Store or using Endpoint Policy Manager Cloud. + +Directions for Central Store: +[Troubleshooting with ADMX files](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/admxfiles.md) + +Directions for Endpoint Policy Manager Cloud (if they are not already pre-placed +there):[Endpoint Policy ManagerCloud: Upload and use your own ADMX files to Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/admxfiles.md) + +Then, the setting you should use if directed by support is entitled: + +Computer Configuration | Policies | Admin Templates | Endpoint Policy Manager ADMX Settings | +Client-side Extensions | Browser Router | Revert to Legacy Browser Router Method & Features and set +to enabled to return back to the legacy behavior. + +![764_1_image-20201027210325-1_950x612](assets/764_1_image-20201027210325-1_950x612.webp) + +## What does "Revert to Legacy Browser Router Method & Features" mean? + +As the product evolved, Browser Router changed what it did to make it better, faster. When +interacting with some third-party software, Browser Router is prevented from performing some of its +tasks that relied on the new method. + +By establishing to use Legacy Browser Router Method & Features, Browser Router is returned to its +original methods. What this essentially means is: + +- Instead of immediate application of Browser Router settings, a re-login will be required. +- Browser Router will not route from external third-party applications (Skype, Slack, etc.) on + non-domain joined devices without interaction. In Legacy mode, the user must set the Endpoint + Policy Manager Browser Router agent as the default browser manually – e.g. If a browser such as + Chrome and Firefox are set as default, the default cannot be updated VIA policy) + +An example of the user required to manually specify Endpoint Policy Manager Browser Router can be +seen here. + +![764_3_image-20201027210423-2](assets/764_3_image-20201027210423-2.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/routing.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/routing.md new file mode 100644 index 0000000000..60af6a3d5c --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/routing.md @@ -0,0 +1,64 @@ +--- +title: "I'm attempting to use an older CSE but routing from Edge / Chrome to other browsers is not working. Why is this?" +description: "I'm attempting to use an older CSE but routing from Edge / Chrome to other browsers is not working. Why is this?" +sidebar_position: 200 +--- + +# I'm attempting to use an older CSE but routing from Edge / Chrome to other browsers is not working. Why is this? + +Netwrix Endpoint Policy Manager (formerly PolicyPak) was contacted by Google about the Endpoint +Policy Manager Browser Router Chrome Extension. This is NOT a security concern. They have a policy +which basically says … that we're not allowed to have more than one extension which does +(essentially) the same thing. + +We were able to perform some negotiations with them to KEEP some, but we were REQUIRED to delete / +take down others. + +So what's the problem exactly?: When you install the Endpoint Policy Manager CSE and use the +Endpoint Policy Manager Browser Router Chrome + +Extension, we tie a specific CSE version to download a specific Chrome Extension browser. For YEARS +it's been OK to just keep publishing NEW versions of the Chrome Extension, when we had MAJOR updates +to the CSE. One Major Update = One Chrome Extension. Chrome is changing the rules and saying, +basically, we cannot do that since the Extension ostensibly does the same thing. Our position is +that we are only doing this because we technically have to. But, Google being Google, rules are +rules. + +In the short term, nothing. Endpoint Policy Manager Browser Router will continue to operate on the +machines where the OLDER CSE is also downloading an OLDER version of the Chrome Extension. This is +because the older extension is ALREADY DOWNLOADED, so those users are unaffected. + +When would you notice a problem? + +There are a few scenarios where you could notice that routing from Chrome or Edge to other browsers +is not working any longer. The typical ways you could encounter this are: + +1. If you manually delete the older Chrome extension, then the older Endpoint Policy Manager Browser + Router CSE will not be able to re-download the old Chrome Extension. +2. If you delete a user's profile and then re-log on, then the older Endpoint Policy Manager Browser + Router CSE will not be able to re-download the old Chrome Extension. +3. If you bring up a brand new machine and then users log on, then the older Endpoint Policy Manager + Browser Router CSE will not be able to re-download the old Chrome Extension. + +How would I know if I'm affected by Endpoint Policy Manager being forced to take down some older +Endpoint Policy Manager Browser Router Chrome Extensions? We have the list of extensions which ARE +and WERE valid on this list +[What is the Chrome Extension ID for all the published versions of Endpoint Policy Manager Browser Router Client Side Extension?](/docs/endpointpolicymanager/knowledgebase/browserrouter/knowledgebase/troubleshooting/chromeextensionid.md) + +What should you do now? + +Our general guidance is, and has always been… please try to stick closely to us in our release +schedule as possible. We know this is not always possible, but have generalized guidance here of how +you should update the CSE and exactly what "supported" means. +[https://www.endpointpolicymanager.com/resources/pp-blog/using-rings-to-test-and-update-the-policypak-client-side-extension-and-how-to-stay-supported/](https://www.endpointpolicymanager.com/resources/pp-blog/using-rings-to-test-and-update-the-policypak-client-side-extension-and-how-to-stay-supported/) + +Will we have this problem in the future? + +We do have one problem to solve. Since we now are under specific pressure to attempt to have ONE +Chrome Extension for all versions, that's going to take some work. We are investigating how to take +the latest Chrome Extension … with the easy to remember name "fmbfiodledfjldlhiemaadmgppoeklbn" … to +be the "going forward one" that we can just always use. We're not 100% sure we can do that, but +we're going to try. If you stick closely to our release schedule and guidance we think you won't +likely have a problem. + +If you still have questions about this concern email support. diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/stop.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/stop.md new file mode 100644 index 0000000000..8ce559dea8 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/stop.md @@ -0,0 +1,39 @@ +--- +title: "How can I stop websites automatically routing to Edge when I expect them to be shown in IE (and/or I get an endless loop). Why is this?" +description: "How can I stop websites automatically routing to Edge when I expect them to be shown in IE (and/or I get an endless loop). Why is this?" +sidebar_position: 220 +--- + +# How can I stop websites automatically routing to Edge when I expect them to be shown in IE (and/or I get an endless loop). Why is this? + +This is happening because of Microsoft's own Internet Explorer to Microsoft Edge redirection for +compatibility websites. + +Currently, some sites are considered incompatible and automatically redirected from IE to +Edge.  Redirection is the default behavior on Windows 10 (21H1, 20H2) with the latest updates +installed. + +For example, if you +open [https://facebook.com/](https://facebook.com/) or [https://cnn.com/](https://cnn.com/) in IE +(no PPBR involved) it will be opened in Edge. + +You can read more about this here. + +[https://docs.microsoft.com/en-us/deployedge/edge-learnmore-neededge](https://docs.microsoft.com/en-us/deployedge/edge-learnmore-neededge) + +When you use Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router, chances are you +want fine grained control instead of some websites (none of which you control) redirecting to Edge. + +As such, to turn off Microsoft's own automatic redirection behavior you need to locate the + +Computer | Admin Templates | Microsoft Edge  | Redirect incompatible sites from Internet Explorer to +Microsoft Edge. + +Then ENABLE the policy and set the options within the pulldown to Disable as seen in the screenshot. + +You can also use Intune / other MDM as explained in the URL above to stop this behavior. + +Then, Endpoint Policy Manager Browser Router will be 100% in charge of your URLs and the routing / +redirection. + +![456_1_image001_950x573](assets/edge/456_1_image001_950x573.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/tabissue.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/tabissue.md new file mode 100644 index 0000000000..b896d0a6f7 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/tabissue.md @@ -0,0 +1,42 @@ +--- +title: "How-to resolve the IE-Tab Issues in Edge for Endpoint Policy Manager Browser Router managed URLs" +description: "How-to resolve the IE-Tab Issues in Edge for Endpoint Policy Manager Browser Router managed URLs" +sidebar_position: 290 +--- + +# How-to resolve the IE-Tab Issues in Edge for Endpoint Policy Manager Browser Router managed URLs + +Problem: + +Endpoint Policy Manager Browser Router fails to redirect URLs to Edge in IE-Tab mode despite being +redirected to Microsoft Edge browser. + +Other Symptoms: + +Visiting Edge:compat in Edge from an affected system may show a screen similar to below. + +![1323_1_a7ea1a5fea27b5af1303c5cae8c549cd](assets/internetexplorer/1323_1_a7ea1a5fea27b5af1303c5cae8c549cd.webp) + +Possible Causes: + +There was previous GPO configuration where the IE Site List and the Enterprise Mode Site list were +managed via Group Policy ADMX settings. Note: Even after disabling the IE site list and the +Enterprise Mode Site list in the previous GPO configuration on Computer and/or User side this issue +could persist. + +This issue can also occur if the following registry location is edited manually. +`HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` + +Resolution: + +To resolve the issue regardless of either cause above, delete the ppBRsitelist_v2.xml file located +in the User's Local app data directory +`%LocalAppData%\PolicyPak\PolicyPak Browser Router\ppBRsitelist_v2.xml`. + +Then run `GPUPDATE` or `GPUPDATE /FORCE` to restore PPBR functionality and ensure proper redirection +of websites to Edge in IE-tab mode. + +Or visit Edge:compat in Edge and click the Force update button, the screen should now look similar +to below. + +![1323_2_faaa54cf16d85c909ec4de3a83505ac9](assets/internetexplorer/1323_2_faaa54cf16d85c909ec4de3a83505ac9.webp) diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/versions.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/versions.md new file mode 100644 index 0000000000..7a36054c41 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/versions.md @@ -0,0 +1,29 @@ +--- +title: "When does Endpoint Policy Manager Browser Router write v1 or v2 Enterprise Mode site lists?" +description: "When does Endpoint Policy Manager Browser Router write v1 or v2 Enterprise Mode site lists?" +sidebar_position: 30 +--- + +# When does Endpoint Policy Manager Browser Router write v1 or v2 Enterprise Mode site lists? + +Versions less than the following will not accept any EMIE lists, and Endpoint Policy Manager Browser +Router will not try to write EMIE lists: + +IE10: 10.\* +IE11 + Win7: 11.0.9600.17041 +IE11 + Win8.1: 11.0.9600.17031 + +Versions greater than or equal to the following accept EMIE v1, and Endpoint Policy Manager Browser +Router will write v1 site lists: + +IE11 + Win7: 11.0.9600.17041 +IE11 + Win8.1: 11.0.9600.17031 +IE11 + Win10 RTM: 11.0.10240.\* +IE11 + Win10 Version 1511: 11.0.10586.\* + +Versions greater than or equal to the following accept both EMIE v1 and v2, but Endpoint Policy +Manager Browser Router will write v2 site lists: + +- IE11 + Win10 Version 1511: 11.0.10586.\* +- IE 11 + Win 7: Version 11.0.9600.18347 or later +- IE + Win 8.1: Version 11.0.9600.18123 or later diff --git a/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/wildcardrule.md b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/wildcardrule.md new file mode 100644 index 0000000000..f54f56c3c1 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/technical-notes/troubleshooting/wildcardrule.md @@ -0,0 +1,49 @@ +--- +title: "Why is my Wildcard rule not applying to top level WWW site?" +description: "Why is my Wildcard rule not applying to top level WWW site?" +sidebar_position: 160 +--- + +# Why is my Wildcard rule not applying to top level WWW site? + +The reason this happens is that "WWW" is specific, and since browsers in some cases strip, or +mishandle "WWW" we treat http://www.site.com the same way as http://site.com to avoid any issues. + +More Info: + +Let's say your goal is to have everyone use Internet Explorer as their default browser unless they +are visiting Microsoft websites, and for Microsoft websites you want everyone to use Edge instead of +IE. + +To try to accomplish this you have created a Default Browser policy set to Internet Explorer, and a +wildcard policy to redirect \*.microsoft.com to Edge, however, users report that they when they try +to visit + +http://www.microsoft.com that the site still opens in Internet Explorer instead of Edge. The website +http://docs.microsoft.com however, opens correctly in Edge. + +![712_1_image-20201230005141-1](assets/712_1_image-20201230005141-1.webp) + +Assuming that the Browser Router Policy and prerequisites are all configured correctly, (i.e., the +Default Browser policy, and/or other BR policies are working as expected) the reason this is +happening is because wildcard rules like \*.site.com ignore "www" and only apply to subdomains of +the URL specified in the wildcard policy. The URL http://www.microsoft.com will be treated like +http://microsoft.com and be opened in the default browser, Internet Explorer in this case, whereas +subdomains like http://docs.microsoft.com will be redirected to Edge as they match the wildcard +policy. + +Said another way, wildcard rules like \*.site.com apply to all subdomains of .site.com, EXCEPT www. + +To workaround this issue you can either create a URL policy for http://microsoft.com or a wildcard +policy for \*Microsoft\*. Either of the policies below will resolve this issue. + +:::note +There is no "www" in the URL rule below. +::: + + +![712_2_image-20201230005141-2](assets/712_2_image-20201230005141-2.webp) + +OR + +![712_3_image-20201230005141-3](assets/712_3_image-20201230005141-3.webp) diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/_category_.json b/docs/endpointpolicymanager/browser-router/video-learning-center/_category_.json new file mode 100644 index 0000000000..5e102a37bc --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Video Learning Center", + "position": 20, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "videolearningcenter" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_1_image001.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_1_image001.webp new file mode 100644 index 0000000000..dcc70973a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_2_image002.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_2_image002.webp new file mode 100644 index 0000000000..8514481a54 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_3_image003.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_3_image003.webp new file mode 100644 index 0000000000..33072739c4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_3_image003.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_4_image004.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_4_image004.webp new file mode 100644 index 0000000000..399064be54 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_4_image004.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_5_image005.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_5_image005.webp new file mode 100644 index 0000000000..a52606c0be Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/48_5_image005.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_1_image-20201229224350-1_950x136.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_1_image-20201229224350-1_950x136.webp new file mode 100644 index 0000000000..34ece00389 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_1_image-20201229224350-1_950x136.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_2_image-20201229224350-2.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_2_image-20201229224350-2.webp new file mode 100644 index 0000000000..4583eb758f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_2_image-20201229224350-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_3_image-20201229224350-3.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_3_image-20201229224350-3.webp new file mode 100644 index 0000000000..33c82974cb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_3_image-20201229224350-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_4_image-20201229224350-4.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_4_image-20201229224350-4.webp new file mode 100644 index 0000000000..925e14bd96 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_4_image-20201229224350-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_5_image-20201229224350-5_950x366.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_5_image-20201229224350-5_950x366.webp new file mode 100644 index 0000000000..c9cb934d0c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_5_image-20201229224350-5_950x366.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_6_image-20201229224350-6.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_6_image-20201229224350-6.webp new file mode 100644 index 0000000000..113d6a301a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/507_6_image-20201229224350-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_1_hfkb-1127-img-01_950x761.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_1_hfkb-1127-img-01_950x761.webp new file mode 100644 index 0000000000..7e93b8de48 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_1_hfkb-1127-img-01_950x761.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_2_hfkb-1127-img-02.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_2_hfkb-1127-img-02.webp new file mode 100644 index 0000000000..316b225b9a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_2_hfkb-1127-img-02.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_3_hfkb-1127-img-03_950x747.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_3_hfkb-1127-img-03_950x747.webp new file mode 100644 index 0000000000..cb12972cd4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_3_hfkb-1127-img-03_950x747.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_4_hfkb-1127-img-04_950x499.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_4_hfkb-1127-img-04_950x499.webp new file mode 100644 index 0000000000..db61887df3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_4_hfkb-1127-img-04_950x499.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_5_hfkb-1127-img-05_950x643.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_5_hfkb-1127-img-05_950x643.webp new file mode 100644 index 0000000000..7592d2f91b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_5_hfkb-1127-img-05_950x643.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_6_hfkb-1127-img-06_950x684.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_6_hfkb-1127-img-06_950x684.webp new file mode 100644 index 0000000000..338c0a7e1b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_6_hfkb-1127-img-06_950x684.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_7_hfkb-1127-img-07_950x496.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_7_hfkb-1127-img-07_950x496.webp new file mode 100644 index 0000000000..401bbbadeb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_7_hfkb-1127-img-07_950x496.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_8_hfkb-1127-img-08_950x467.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_8_hfkb-1127-img-08_950x467.webp new file mode 100644 index 0000000000..e14bff912b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_8_hfkb-1127-img-08_950x467.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_9_hfkb-1127-img-09_950x455.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_9_hfkb-1127-img-09_950x455.webp new file mode 100644 index 0000000000..13fa915098 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/835_9_hfkb-1127-img-09_950x455.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_1_image-20220403003715-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_1_image-20220403003715-1.webp new file mode 100644 index 0000000000..a2672d2afa Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_1_image-20220403003715-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_2_image-20220403003715-2.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_2_image-20220403003715-2.webp new file mode 100644 index 0000000000..245b558f47 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_2_image-20220403003715-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_3_image-20220403003715-3.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_3_image-20220403003715-3.webp new file mode 100644 index 0000000000..5b029ee965 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/907_3_image-20220403003715-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/953_1_thumbnail_image001.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/953_1_thumbnail_image001.webp new file mode 100644 index 0000000000..d9943b3999 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/953_1_thumbnail_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/953_2_image002.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/953_2_image002.webp new file mode 100644 index 0000000000..23d77ab857 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/953_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router.webp new file mode 100644 index 0000000000..89dd6662fd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_1.webp new file mode 100644 index 0000000000..58752306d4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_10.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_10.webp new file mode 100644 index 0000000000..6a633ea089 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_10.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_14.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_14.webp new file mode 100644 index 0000000000..d25b023116 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_14.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_15.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_15.webp new file mode 100644 index 0000000000..415798000c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_15.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_2.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_2.webp new file mode 100644 index 0000000000..0fce727206 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_21.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_21.webp new file mode 100644 index 0000000000..08b945aedd Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_21.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_22.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_22.webp new file mode 100644 index 0000000000..e4e4a545d5 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_22.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_23.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_23.webp new file mode 100644 index 0000000000..906659e63c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_23.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_24.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_24.webp new file mode 100644 index 0000000000..ebf53a5408 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_24.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_3.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_3.webp new file mode 100644 index 0000000000..888d05d1f6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_37.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_37.webp new file mode 100644 index 0000000000..227645cfee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_37.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_38.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_38.webp new file mode 100644 index 0000000000..3169b636ce Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_38.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_39.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_39.webp new file mode 100644 index 0000000000..7abd8480a9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_39.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_4.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_4.webp new file mode 100644 index 0000000000..c5847c07ed Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_40.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_40.webp new file mode 100644 index 0000000000..292faafb67 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_40.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_41.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_41.webp new file mode 100644 index 0000000000..4377dc11a1 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_41.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_42.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_42.webp new file mode 100644 index 0000000000..4cddc7e920 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_42.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_43.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_43.webp new file mode 100644 index 0000000000..3699a9414d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_43.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_44.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_44.webp new file mode 100644 index 0000000000..3a17669d28 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_44.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_45.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_45.webp new file mode 100644 index 0000000000..a904c94464 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_45.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_46.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_46.webp new file mode 100644 index 0000000000..a9346612eb Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_46.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_47.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_47.webp new file mode 100644 index 0000000000..4ed7225872 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_47.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_48.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_48.webp new file mode 100644 index 0000000000..4d45f116e0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_48.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_5.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_5.webp new file mode 100644 index 0000000000..b4bba342c2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_6.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_6.webp new file mode 100644 index 0000000000..e78a68f8d6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_7.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_7.webp new file mode 100644 index 0000000000..4fabd41d7c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_8.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_8.webp new file mode 100644 index 0000000000..08eda0fba6 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_9.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_9.webp new file mode 100644 index 0000000000..de60200a00 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/about_endpointpolicymanager_browser_router_9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/browserrouter.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/browserrouter.webp new file mode 100644 index 0000000000..788076cae3 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/browserrouter.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp new file mode 100644 index 0000000000..9978740d6c Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_1_ppbr-faq-3-pic-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp new file mode 100644 index 0000000000..e19d583566 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_2_ppbr-faq-3-pic-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp new file mode 100644 index 0000000000..c4034c391b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_3_ppbr-faq-3-pic-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp new file mode 100644 index 0000000000..324ffec055 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_4_ppbr-faq-3-pic-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp new file mode 100644 index 0000000000..faa03d7eaf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/218_5_ppbr-faq-3-pic-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp new file mode 100644 index 0000000000..f357bbb88e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_11.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp new file mode 100644 index 0000000000..c7073b496a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_12.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp new file mode 100644 index 0000000000..34c85cd1d0 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/defaultbrowser/about_endpointpolicymanager_browser_router_13.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/170_1_image001.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/170_1_image001.webp new file mode 100644 index 0000000000..54820a032d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/170_1_image001.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/170_2_image002.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/170_2_image002.webp new file mode 100644 index 0000000000..594e8547ee Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/170_2_image002.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_1_image-20210121211003-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_1_image-20210121211003-1.webp new file mode 100644 index 0000000000..a9d282202b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_1_image-20210121211003-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_2_image-20210121211003-2.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_2_image-20210121211003-2.webp new file mode 100644 index 0000000000..d8fcc4f35d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_2_image-20210121211003-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_3_image-20210121211003-3.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_3_image-20210121211003-3.webp new file mode 100644 index 0000000000..17eeed3cd8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_3_image-20210121211003-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_4_image-20210121211003-4.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_4_image-20210121211003-4.webp new file mode 100644 index 0000000000..ce7ad9e97b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/767_4_image-20210121211003-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/881_1_image-20221228073914-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/881_1_image-20221228073914-1.webp new file mode 100644 index 0000000000..93fbcd7588 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/editpolicytemplate/881_1_image-20221228073914-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_1_image-20190911221425-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_1_image-20190911221425-1.webp new file mode 100644 index 0000000000..2b133aad21 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_1_image-20190911221425-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_2_image-20190911221425-2.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_2_image-20190911221425-2.webp new file mode 100644 index 0000000000..7d15ee0c1b Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_2_image-20190911221425-2.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_3_image-20190911221425-3_950x559.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_3_image-20190911221425-3_950x559.webp new file mode 100644 index 0000000000..cd39fbf10d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_3_image-20190911221425-3_950x559.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_4_image-20190911221425-4_950x354.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_4_image-20190911221425-4_950x354.webp new file mode 100644 index 0000000000..101c0be2f8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_4_image-20190911221425-4_950x354.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_5_image-20190911221425-5_950x150.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_5_image-20190911221425-5_950x150.webp new file mode 100644 index 0000000000..01288fc667 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_5_image-20190911221425-5_950x150.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_6_image-20190911221425-6.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_6_image-20190911221425-6.webp new file mode 100644 index 0000000000..54d38e412e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_6_image-20190911221425-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_7_image-20210105155954-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_7_image-20210105155954-1.webp new file mode 100644 index 0000000000..4e4175e3c2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_7_image-20210105155954-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_8_image-20190911221425-7_950x315.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_8_image-20190911221425-7_950x315.webp new file mode 100644 index 0000000000..ba330fcadf Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_8_image-20190911221425-7_950x315.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_9_image-20190911221425-8.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_9_image-20190911221425-8.webp new file mode 100644 index 0000000000..130de4454f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/483_9_image-20190911221425-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_11_image-20191222210303-6.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_11_image-20191222210303-6.webp new file mode 100644 index 0000000000..8e853deda2 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_11_image-20191222210303-6.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_13_image-20191222210303-7.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_13_image-20191222210303-7.webp new file mode 100644 index 0000000000..3bde243161 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_13_image-20191222210303-7.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_15_image-20191222210303-8.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_15_image-20191222210303-8.webp new file mode 100644 index 0000000000..7e18258447 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_15_image-20191222210303-8.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_17_image-20191222210303-9.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_17_image-20191222210303-9.webp new file mode 100644 index 0000000000..fcba78a039 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_17_image-20191222210303-9.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_1_image-20191222210303-1.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_1_image-20191222210303-1.webp new file mode 100644 index 0000000000..c1e5763e42 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_1_image-20191222210303-1.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_3_image-20191222210303-2_457x162.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_3_image-20191222210303-2_457x162.webp new file mode 100644 index 0000000000..60f924537d Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_3_image-20191222210303-2_457x162.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_5_image-20191222210303-3.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_5_image-20191222210303-3.webp new file mode 100644 index 0000000000..4324923add Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_5_image-20191222210303-3.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_7_image-20191222210303-4.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_7_image-20191222210303-4.webp new file mode 100644 index 0000000000..f039559009 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_7_image-20191222210303-4.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_9_image-20191222210303-5.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_9_image-20191222210303-5.webp new file mode 100644 index 0000000000..304e571036 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/install/535_9_image-20191222210303-5.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp new file mode 100644 index 0000000000..964bbcf082 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_25.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp new file mode 100644 index 0000000000..b52876ad0e Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_26.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp new file mode 100644 index 0000000000..8734ba4794 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_27.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp new file mode 100644 index 0000000000..15fdff9b40 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_28.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp new file mode 100644 index 0000000000..f47fa35a98 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_29.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp new file mode 100644 index 0000000000..da8b3902f9 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_30.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp new file mode 100644 index 0000000000..deb3757608 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_31.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp new file mode 100644 index 0000000000..7aceb50d08 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_32.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp new file mode 100644 index 0000000000..eca7035523 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_33.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp new file mode 100644 index 0000000000..8ae1eeeeca Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_34.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp new file mode 100644 index 0000000000..55cd988bb8 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_35.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp new file mode 100644 index 0000000000..390b623613 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/internetexplorer/about_endpointpolicymanager_browser_router_36.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_16.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_16.webp new file mode 100644 index 0000000000..b0b9e11323 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_16.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_17.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_17.webp new file mode 100644 index 0000000000..b30c30c9b4 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_17.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_18.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_18.webp new file mode 100644 index 0000000000..a5068da83a Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_18.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_19.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_19.webp new file mode 100644 index 0000000000..d89b3ee824 Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_19.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_20.webp b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_20.webp new file mode 100644 index 0000000000..258718d24f Binary files /dev/null and b/docs/endpointpolicymanager/browser-router/video-learning-center/assets/policy/about_endpointpolicymanager_browser_router_20.webp differ diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/_category_.json b/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/_category_.json new file mode 100644 index 0000000000..f0194879d1 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Citrix And Virtual Applications", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/citrix.md b/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/citrix.md new file mode 100644 index 0000000000..e97bfb70bf --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/citrix.md @@ -0,0 +1,80 @@ +--- +title: "Using PP Browser Router on Citrix or RDS servers with published browser applications" +description: "Using PP Browser Router on Citrix or RDS servers with published browser applications" +sidebar_position: 10 +--- +# Using PP Browser Router on Citrix or RDS servers with published browser applications + +In this video, learn the best practice for using PPBR and Citrix / RDS servers. Route from browser +to browser very quickly using this technique. + + + +### PolicyPak: Using PP Browser Router on Citrix or RDS servers with published browser applications + +In this demonstration, I'm going to show you how you can use Netwrix Endpoint Policy Manager +(formerly PolicyPak) Browser Router to define routes for your customers that are using Citrix +servers. + +First things first is that you do need to license and install the "Endpoint Policy Manager +Client-Side Extension" on your Citrix server or your RDP server. It takes about a minute. I've +already done that, and it's ready to go. Just showing you that it's here already installed. + +The second thing you would do is actually where your Citrix server lives – I happen to have it in a +OU called "CITRIX" here – what I want to show you is that you would create a new route. We might +call this "Custom Routes for All Users on Citrix." + +What you're going to do is define your routes on the computer side. Instead of defining it per user, +you're defining it per computer against the Citrix server. That means you're going to go to computer +side, "Endpoint Policy Manager," click on "Browser Router," and here's where you get to define your +routes. + +First of all, they all need to be in a "Collection." You could even ensure that this collection only +fires off if you wanted to by using "Collection Level Targeting" and saying that this collection +will only fire off when it's in a "Terminal Session." That is an extra level if you want to. It's +not necessary in this case because I am defining this policy against the Citrix server's OU +directly, but it's an option if you wanted to. + +I'm going to create a "New Policy" here for Browser Router. I'll do "AAA," and I'll say the +"Wildcard" is "\*aaa\*." Whenever I go to a website with AAA, I'm going to always use "Internet +Explorer." I'll create another one for "BBB," and I'll create a "Wildcard" called "\*bbb\*" and I'll +always go to "Firefox." And I'll create a "New Policy" for "CCC" and a "Wildcard" "\*ccc\*" and that +will always go to "Google Chrome." + +As an added bonus, you can create a "New Default Browser" and guarantee that when your customers are +using the Citrix server, the three different browsers you might have on it are not fighting for +superiority. You simply define what your default browser is and that's it. + +Go over to your Citrix and you could either wait 90 minutes or so until Group Policy takes effect, +or you could go to your Citrix server like I'm doing here and run GP Update. You're going to want to +do a quick preflight test on your Citrix server just to make sure that it all works right. + +If you're on the Citrix server and you run "Internet Explorer" here, we said if you go to +"www.bbb.com," you want to launch Firefox. Well, here we go. In fact, we launch Firefox. If you're +in Firefox and you go to "www.ccc.com," you're going to launch Chrome. If you're in Chrome and you +go back to "www.bbb.com," that's going to go back to Firefox. And if you're in Firefox and you go +back to "www.aaa.com," that's going to launch Internet Explorer. + +Once you've tested it on your server as if it were just a regular computer endpoint, now you're +ready to go back to your machine that has the Citrix Receiver on it. You could either use it this +way where your programs are hanging out in a folder or if you want to use the Web interface or if +you want to use the "Citrix Receiver" app, any of these work exactly the same way. + +For instance, you're in Internet Explorer here. It doesn't matter who you're logged on now to that +server because all users on that server are going to get it. So we'll go ahead and launch Internet +Explorer here. You'll see that it's coming from the Citrix server. Once it launches, we're going to +see if it's routing between everything. If you just keep your eyes open here, we'll go ahead and +close out all these windows to keep it simple here. + +Then we'll try to go to "www.bbb.com." What should happen? Well, that should close, and the Firefox +that's on the Citrix server has now launched. If we were to go to "www.ccc.com," it will launch the +Chrome that's on the Citrix server as well. Then going from Chrome, you can go back to Firefox and +finally back to Internet Explorer. So we will route properly even on a Citrix machine on a Citrix +server. + +Again, my suggestion is that you do this on the computer side, affect your Citrix machines directly +with those policies. Don't forget to use that "Default browser" as an extra added bonus. Notice how +we never got prompted not once about who should be the default browser when using the browsers on a +Citrix sever. + +I hope this video helps you out and you're ready to get started with Browser Router. Thanks. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/custombrowsers.md b/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/custombrowsers.md new file mode 100644 index 0000000000..c40b919c64 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/citrixvirtualapps/custombrowsers.md @@ -0,0 +1,75 @@ +--- +title: "Browser Router with Custom Browsers" +description: "Browser Router with Custom Browsers" +sidebar_position: 20 +--- +# Browser Router with Custom Browsers + +If you have App-V, ThinApp, or Citrix or RDS published applications, use this trick to route from a +real built-in browser to your virtual / published browser. + + + +### Endpoint Policy Manager \_ Browser Router with Custom Browsers + +Hi. In this video I'm going to show you how you can use custom browser router routes to ensure that +the right browser opens for the right time. So, the scenario might be a user might be using the +built-in version of; say; Internet Explorer and they go to a website like endpointpolicymanager.com. You always +want this to fire off, not here in the built-in browser but either in an Appv4 or 5 browsers or a +thin app browser or a Citrix browser. For instance, this browser is hanging out over there on the +Citrix server, so it's connecting to my Citrix server over here. It's real easy to do this. We'll +just create a custom route. There's really only one thing you need to know, which is how to launch +from the command line and once you know that you can create a custom browser router route so I'll +just wait for this to finish here. + +So, by way of example, let's say I just right-click over to Mozilla Firefox and go to Properties, +okay. What I'll do is I will take the target here, okay, you can see it launches the Citrix ICA +Client against all this stuff. Just copy that for now. You'll come back to that in a second and +let's go ahead and create a route. So, you can say, you know, custom browser route. All right, we'll +go ahead and click edit here. You can do what I'm about to show you in either the user or computer +side. That's totally fine. I just happened to do this – I'm just going to do this demo on the user +side first. So, you go to user side, Policy Pak, and we'll go to Browser Router here. We have to +create a new collection. You can put item level targeting in here. You can say, for instance, only +do these things WHEN the person is on a machine that matches a computer name or is in a particular +security group or the operating system is whatever. + +So, we're not going to do that here but you can get very fine-grained and say this custom route set +will only take effect WHEN those conditions are true. So, now what I'll do is I'll create a new +custom route policy and I'll call this \*Pak\* and I'll say this is a wildcard \*Pak\* and I want to +go to my custom browser. I'm just going to paste it in. Remember, I copied it before. This is the +Citrix ICA launcher for Firefox. Anytime I hit Netwrix Endpoint Policy Manager (formerly PolicyPak) +it will go over there and it says you better make sure that this exists on a local client or else if +it doesn't we're going to fall back and go to Internet Explorer if we don't see it. So, that's the +first thing. Let me go back to that machine also and let's use Appv5 and we'll create a custom route +Appv5, so we'll go ahead and take this version of Firefox here. Okay, this is Appv5 and let's create +one called New Policy. We'll do this \*gpa\* for gp answers so we'll go to \*gpa\* and this will go +to gp answers. + +This will go to the Appv5 version of Firefox here, okay. Go ahead and run that and then the last +thing we'll do on this machine is maybe for ThinApp what we'll do is we'll launch the ThinApp +Firefox27 when we go to, say, VMware. So, what we need to do is we need to get it exactly right. +This part is a little trickier because you might want to copy it this way, so now that you've got +the command line exactly right here you can then go back to your GPO, create a new policy, and call +this \*vmware\* and we'll go back to \*vmware\* and we'll make a custom route to the thin app +version of Firefox. Okay? So, there we go. So, now we've got our custom routes. We'll go back to our +endpoint machine. We'll run gpupdate and we'll wait for this to finish. Okay, now that that's done, +let's go over to our built-in browser and we'll go to Endpoint Policy Manager first and we'll see +what happens here. Now that, that is done, let's go ahead and relaunch Internet Explorer and we'll +go over to Endpoint Policy Manager.com and _boom_! What it's doing is it's rerouting. You can see it +rerouted to the – no, that wasn't – there you go. I want to make sure you can see that. So, it's now +launching the ICA Citrix version of Firefox over the network. Okay, so that worked out pretty well. +Now, let's go ahead and back in the browser that's actually ON the machine here, we'll go to +gpanswers.com and this time it's going to route to the Appv5 version of Firefox and I know that this +is the right version actually because even though there's nothing that's presented to the user, the +About… this is Version 27. Okay? + +That's correct and if I go to vmware, that's going to launch, _boom_, the thin app version of +Firefox right there. So, if you've got Appv4, Appv5, Thin App or Citrix, using browser router you +can specifically say that when they go to the website using the built-in browsers on their machine, +you will automatically launch the custom browser. Okay? That being said, we do know that if you were +in the custom browser right here and you try to go back to, for instance, endpointpolicymanager.com, this is +where the routes end. We do not route from the custom browsers like thin app or Appv back outward to +your original browser. So, for custom browsers like this, it is a one-way street. For custom routes +for browsers that are actually installed on the machine, it will route between browsers just fine as +you have seen in the previous videos. If you have any questions, we are here for you and we hope you +get started with it soon. Thanks so much. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/_category_.json b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/_category_.json new file mode 100644 index 0000000000..ee7419d8c4 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Getting Started", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/blockwebsites.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/blockwebsites.md new file mode 100644 index 0000000000..1928829098 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/blockwebsites.md @@ -0,0 +1,10 @@ +--- +title: "Block web sites from opening in all browsers." +description: "Block web sites from opening in all browsers." +sidebar_position: 30 +--- +# Block web sites from opening in all browsers. + +Users being naughty? Use PP Browser Router to stop that nonsense. + + diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/edgespecial.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/edgespecial.md new file mode 100644 index 0000000000..d35cc94191 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/edgespecial.md @@ -0,0 +1,64 @@ +--- +title: "Endpoint Policy Manager and Edge ‘Special' policies" +description: "Endpoint Policy Manager and Edge ‘Special' policies" +sidebar_position: 40 +--- +# Endpoint Policy Manager and Edge ‘Special' policies + +After you create your Enterprise Mode site lists, you can decide how to handle Edge browser. Do you +want websites to render in Edge or IE? This video shows you how to adjust for your conditions. + + + +### Endpoint Policy Manager and Edge ‘Special' policies + +Hi. This is Jeremy Moskowitz, Group Policy MVP and Founder of Netwrix Endpoint Policy Manager +(formerly PolicyPak) Software. In this video, I'm going to demonstrate two special policies that we +have for Browser Router. One is called "All Intranet to IE policy" and the other one is called "All +Enterprise from Edge to IE policy." + +These are both actually regarding Edge. These items are available as regular garden-variety Group +Policy settings, but we've also got them in Browser Router. Let me demonstrate what they're meant +for and how you would use them. + +For instance, because Edge only works Windows 10, that's only going to come into play right here. +Let's say you are in Edge and you decide to go to a site that's on your Enterprise site list. For +instance, in a previous video, I made an Enterprise site list for "www.microsoft.com." You can see +that it's still hanging out in Edge. That's not really what I want. + +What I really want is I want all things that are on the Enterprise site list to go from Edge to +Internet Explorer ("All Enterprise from Edge to IE"). When I click "Enabled" here, we're saying that +if we've got any items like this one that's in the Enterprise Mode site list – so I'm making +"www.microsoft.com" force into the "IE8 Enterprise Mode" – when I've done that, at that point now if +I'm in Edge, Edge should force open Internet Explorer. + +Let's go ahead and see if that happens. I'll go ahead and run GP Update here. I'll go ahead and +close that out. Let's go back to Edge here, and we'll go to "www.microsoft.com." Edge automatically +force opens up Internet Explorer, and we put it in the site list dynamically. This gives you an +ability from Edge to force open Internet Explorer because it's in the site list. + +Now here's another one. Let's say here's the other policy. If we go to "www.msn.com" as an example +here. This isn't on a site list or anything. Let's force it for now for the purposes of this +demonstration here, let me go ahead and force it into "Local intranet." If I click on "Sites" here +and I click "Advanced," I'm going to "Add" in "www.msn.com" into "Local intranet." + +Now that I've done that here and, in Edge, if I go to "www.msn.com," right now you can see that it +renders in Edge, which maybe isn't what we want. If we want to instead, we can right click, "Add" a +new special policy that says "All Intranet to IE policy." What this is going to do is, for Edge +only, we're going to open up any item that's currently in the intranet zone and force open Internet +Explorer. + +We'll go ahead and run GP Update and see what happens. We'll go ahead and close this out. Now ten +seconds ago, when I went to MSN.com, where did it go? It stayed in Edge. Now, if I go to +"www.msn.com," because we've specified that this is an intranet site, it will force open in Internet +Explorer. So we're force routing the items from Edge directly to Internet Explorer because we're +saying do that for the items that are in intranet zone. + +We're taking advantage of something that already exists inside of Group Policy and Microsoft Edge, +but we're putting it in a nice one-stop-shop place for you. This gives you the advantage to create +your dynamic Enterprise Mode site lists using Endpoint Policy Manager Browser Router and also set +the policies you need to do what you need to, to force Edge to open up Internet Explorer under those +conditions. + +If you have any questions, we're here for you. I hope you can take advantage of this right away. +Thanks. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/edgesupport.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/edgesupport.md new file mode 100644 index 0000000000..638ca2e823 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/edgesupport.md @@ -0,0 +1,91 @@ +--- +title: "Browser Router now with support for MS Edge" +description: "Browser Router now with support for MS Edge" +sidebar_position: 20 +--- +# Browser Router now with support for MS Edge + +Netwrix Endpoint Policy Manager (formerly PolicyPak) now supports routing FROM EDGE to other +browsers (Firefox, IE, and Chrome.) Its easy, and here's the only small thing you need to know to +make it work perfectly ! + + + +### PolicyPak: Browser Router now with support for MS Edge + +Hi. This is Jeremy Moskowitz. This video is an update to Endpoint Policy Manager Browser Router +where we now introduce full support for Microsoft Edge with regards to Browser Router. So you may +need to already know what Browser Router does. If you don't, you can watch those videos but I'm +going to set the stage here. + +I'm going to create a couple of routes, and then I'll show you how Edge support works inside +Endpoint Policy Manager Browser Router. I'm going to create my first "New Policy" here. I'm going to +give it the "Policy Name" "All things Googly to chrome." I'll go to "Wildcard" "\*google\*" and go +to "Google Chrome." + +I'm then going to create a "New Policy" that says "FF to FF," "Wildcard" "\*mozilla\*" and we'll go +to "Firefox" here. If I were to go "Add" a "New Policy" that says "GPanswers.com to EDGE," we can +then go to "Url" "GPanswers.com" and go to "Edge." Then if I wanted to create one for Endpoint +Policy Manager to Internet Explorer, "New Policy," "PP to IE" and go to "endpointpolicymanager.com" and go to +"Internet Explorer." + +Okay, great, so now we've set that all up just the way we want, and now we're ready to test it out. +I'm going to log on as a user who has never logged on before ("Other user"): "eastsalesuser6." This +person has never logged on before. I'll pause the video be logging on for the very first time for +any user takes a couple seconds. This is just creating a profile, so I'll hold on for ten seconds +here. + +Okay, now we're all logged on. Remember, nothing has been run before. "Firefox" has never run. +"Google Chrome" has never been run. Edge has never been run and Internet Explorer. Nothing has ever +been run. Actually, one of the things that can happen which is sort of a pain in the neck is that +different browsers will ask to be the default, so expect that here in this example. + +If you want to make that go away in real life, you can simply make a new policy that sets "New +Default Browser" so they never ask. I don't have that set in this video, so you may see that when we +start running some things. + +Let me start off with "Internet Explorer" here. We're going to go around the circle here. I'm +starting off life in Internet Explorer here. I don't care about any of this stuff. By the way, all +of these messages can be sent to the bottom of the ocean using Endpoint Policy Manager Application +Manager, but I'm not going to worry about that this minute. + +Let's go ahead and get started here. I'm in Internet Explorer. If I were to go to "www.mozilla.org," +what we're going to see that happens is we're going to close that tab and open up Firefox for the +first time. We'll go ahead and let Firefox do its first-time run thing. That's cool, so now we have +that. + +Now if we're in this browser and we say to go to "www.google.com," it's going to go to the Chrome +browser. Then we said if we're in Chrome and we go to "www.gpanswers.com," we want to open up in +Edge. So here comes Edge, and now we're in Edge. + +Now here's where finally the new support comes in. If you're in Edge, up until recently there was no +way to go from Edge to another browser. If you wanted to go back to "www.endpointpolicymanager.com," which we +said open up only in Internet Explorer, or www.mozilla.org open up in Firefox, when you click on +Edge the very first time you run Edge it will not actually do what you ask it to do. + +Actually, here's that default thing I told you about, which is fine. We can make that go away but +not for the purposes of this video. So if you make a route that would be outside of Edge, Edge +doesn't know how to do that yet. It just goes right to the website and opens it up. For instance, if +I were to go to another route like "www.mozilla.org" or something like that, what you want to see is +it go from Edge to open up Firefox. + +Now, here's the support. All you need to do is close Edge and open it up, and the second time is the +charm. That's it. That's all you need to do. So let's do it all again because now I've opened Edge, +closed Edge, and now this user is locked and loaded and we support it. + +Let's start again. We'll go from "Google Chrome" to Edge. So we'll go from Chrome and we'll say +"www.gpanswers.com." Here we are in Edge now. We can go to "www.endpointpolicymanager.com." Watch Edge. We will +close Edge and open up Internet Explorer. + +If we're in Edge and we want to do some great stuff in Edge here which is fine and have this tab and +then go to "www.mozilla.org," what happens? We close the tab and then we correctly open up Firefox +just like that. + +Let's do another one. If we're in a tab in Edge and we want to go to "www.google.com," watch what +happens. We close the tab and open up the right browser just like that. + +So that's it. We now fully support Edge as a routable browser in and a routable browser out. Nothing +you need to do in your routes. It's just as simple as that. We've got you covered. + +I hope this helps you out. Looking forward to getting you started real soon with Endpoint Policy +Manager Browser Router. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/ie.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/ie.md new file mode 100644 index 0000000000..314d931c17 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/ie.md @@ -0,0 +1,62 @@ +--- +title: "Manage Internet Explorer 11 and Edge Compatibility, Enterprise Modes and IE-in-Edge Mode" +description: "Manage Internet Explorer 11 and Edge Compatibility, Enterprise Modes and IE-in-Edge Mode" +sidebar_position: 70 +--- +# Manage Internet Explorer 11 and Edge Compatibility, Enterprise Modes and IE-in-Edge Mode + +Use Netwrix Endpoint Policy Manager (formerly PolicyPak) to dynamically set Enterprise and Document +modes, as well as force an Internet Explorer tab to open--inside Edge! + + + +Hi, this is Whitney with Endpoint Policy Manager Software. In other videos, we talked about setting +default browsers, routing the right website to the right browser, and making sure that the naughty +websites are blocked. In this video, we're going to talk about another feature of Browser Router, +the ability to dynamically set Internet Explorer Enterprise, and document modes. We're also going to +look at the idea of being able to open an Internet Explorer tab inside of Edge, but we'll get to +that in a minute. + +For this demo, I already have a GPO in place that's dictating that my default browser is Chrome. +Just to show that it's working, let's click on microsoft.com here and see it opening in Chrome, just +as expected. Now, let's go over to my management station, and we're going to create a new policy +here. I'm just going to call it Microsoft to IE, and I'm going to come down here and specify +www.microsoft.com. Now the radio button for Internet Explorer is already selected, but what I really +want to focus on is the Browser Mode drop down here. While, obviously, Microsoft.com doesn't need to +be rendered in one of these document modes, a website you're using might need to be rendered in say +IE 7 Document Mode. + +Now that we've selected IE7 Document Mode, I want to mention this idea here of "Don't make a route." +If we check this box, that means that if your user is already in Internet Explorer and goes to +microsoft.com, then render in IE7 Document Mode, but if your user is in any browser, don't make a +route, just open microsoft.com in whatever browser they're already in. If I'm already in IE and I go +to microsoft.com, it would render me in IE7 Document Mode, but if I was in Firefox and went to +microsoft.com, it would just leave me in Firefox. That said, in this case, I do want to make a +route, so I'm going to leave this box unchecked. I'm going to select OK and head back over to the +endpoint. I'll just run a quick gpupdate, and when it's done, we'll see that we've both made a route +ensuring that microsoft.com will open up in Internet Explorer and that it's rendering in the +document mode we specified. + +Okay, let's click on that microsoft.com link again. Remember, last time we did this it opened up in +our default browser, which is Chrome. This time, though, it's opening in Internet Explorer, and +notice that it's rendering really, really poorly right now. That's because we currently have it in a +document mode that it's not designed for. However, it is a good visual to see that we did in fact +achieve a different rendering mode. To be more specific, though, if you hit F12, you can see +developer tools, and you can see under the Emulation tab that we are rendering here in IE7 Document +Mode. + +Now I want to show you another magic trick. Say you have some website that needs to be opened in +Internet Explorer but you're using Edge as your standard. You might not want to have to flipflop +between browsers all the time, but what can you do? You'll just make Internet Explorer open in Edge. +Let me show you how easy this is. I'm going to go here and edit the policy, and while we can render +an IE page in Edge with a specific document mode, I want to do one thing at a time. Let's put this +back into default mode and change this drop down to Open as IE in Edge tab. Alright. We'll say OK, +come back to the end point, and run one last gpupdate. + +Alright, now that that's done, we're going to click on microsoft.com again, and again, last time we +did this, it was opening in Internet Explorer in IE7 Document Mode. This time it's going to open in +Edge as an Internet Explorer tab. Let's see it happen. Here we go. We see that it is opening in Edge +right down here. However, there is your Internet Explorer mode tab. There you have it. That is how +easy it is to set up an Internet Explorer Enterprise or document mode easily and quickly as well as +forcing an Internet Explorer tab open inside of Edge. If this is of interest to you, sign up for our +webinar, and we'll get you started on a free trial right away. Thanks so much. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/ports.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/ports.md new file mode 100644 index 0000000000..a22707888b --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/ports.md @@ -0,0 +1,63 @@ +--- +title: "Endpoint Policy Manager Browser Router and Ports" +description: "Endpoint Policy Manager Browser Router and Ports" +sidebar_position: 50 +--- +# Endpoint Policy Manager Browser Router and Ports + +Need to route specific websites to specific browsers based upon ports? Check out this demo. + + + +### PolicyPak: Browser Router and Ports + +Hi. This is Jeremy Moskowitz, Group Policy MVP and Founder of Netwrix Endpoint Policy Manager +(formerly PolicyPak) Software. In this video, I'm going to show you how if you go to a specific port +on a particular website, you can open up the right browser. + +By way of example, I've got a GPO. It's linked over to my "West Sales Users." Here's the GPO. We're +using "Endpoint Policy Manager Browser Router." There's actually a nifty website called PortQuiz. We +can go to "www.portquiz.net." I'll go ahead and go to that URL. If you specify no ports, let's go to +"Internet Explorer." + +Then let's create another "New Policy" here. Let's say we want to go to "portquiz.net" on port +"1000" or something like that. If we go to "www.portquiz.net" on port "1000," we're going to go to +"Edge." Now, of course, that Edge browser only exists on Windows 10. If we don't detect the Edge +browser, we fall back and use Internet Explorer. + +We'll create another "New Policy" here called "portquiz.net." Let's call it "1001," +"www.portquiz.net" port "1001." We'll go to "Google Chrome" for that one. Then we'll go to +"portquiz.net" "1002," "www.portquiz.net" port "1002" will go to "Firefox." I'm just setting the +stage for a variety pack of these guys. + +Now let's go over to our endpoint. We'll just run GP Update on each of them to get the latest +Endpoint Policy Manager Browser Router routes. We'll wait for this to finish. Okay, that's done. +We'll close that out. We'll go back to our other machine. We'll close that out. + +Let's do an easy one. Let's say we get a link and that link is "www.portquiz.net" and we click on +it, remember, that's straight port 80. That means that's going to open up Internet Explorer, and +that's exactly what happens. If we're in Internet Explorer now and we try to go to web port "1000," +well, that's supposed to be Edge. But this machine doesn't have Edge, so therefore we fall back to +Internet Explorer. + +If we go to Windows 10 and we try that in Windows 10, let's do the same thing. We go to +"www.portquiz.net," start that off again here, it's going to launch Internet Explorer. If we're in +Internet Explorer and we go to "portquiz.net:1000," what should happen? Edge launches exactly the +way we expect. That's exactly what we wanted. + +Let's go back to our other machine. We're in Internet Explorer. We go to "portquiz.net:1001." We +said that was going to be Chrome, and that's exactly what happens here. Here's Chrome launching. If +we're in Chrome and we go to "portquiz.net:1002," that's going to be Firefox. + +That's it. So you can see, on Windows 7 or Windows 10, it doesn't really matter which machine you're +on. If I reopen Internet Explorer here and just give "portquiz.net:1001," it's going to open up the +right browser for the right time. + +There you go. That should give you a quick rundown of how to use Endpoint Policy Manager Browser +Router and specific ports. All you have to do is put in the "URL," put in the port and put in the +"Browser." Remember, this does have to be an exact match. That's the deal with URLs. They have to be +an exact match. + +With that in mind, if you have any questions about how to use Endpoint Policy Manager Browser +Router, we look forward to answering them and hope you get to take advantage of this real soon. +Thanks. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/rightbrowser.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/rightbrowser.md new file mode 100644 index 0000000000..47989d4ede --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/rightbrowser.md @@ -0,0 +1,63 @@ +--- +title: "Ensure users utilize the RIGHT browser for the right website !" +description: "Ensure users utilize the RIGHT browser for the right website !" +sidebar_position: 10 +--- +# Ensure users utilize the RIGHT browser for the right website ! + +Everyone knows that not every browser is the right one for all websites. Problem is, users end up +using the WRONG website most of the time. With PP Browser Router, you create policies (or ROUTES) +where specific websites are launched only into the specific browsers. It couldn't be easier. Check +it out. + + + +Hi, this is Whitney with Netwrix Endpoint Policy Manager (formerly PolicyPak) Software. In this +video, I'm going to show you a gaggle of problems that you can fix using Endpoint Policy Manager's +Browser Router. Let's start with a very simple one. I'm sure you've seen this. Your users launch +Internet Explorer and they get asked that annoying question, would you like to make Internet +Explorer your default browser? Maybe they say yes. Maybe they say no. Then they go to another +browser and what happens? It wants to be the default browser. Again, maybe they say yes. When they +launch the first browser, they'll get asked yet again, do you want this to be the default browser? +That's problem number one that I want to show you how to solve, fixing the browser wars. + +Problem number two is, well, as you know, some of the pages only get rendered correctly in the right +browser. Typically, the problems are things that you have internally or that you use with your +vendors. However, for this example, I'm going to create some easy to remember rules with Google, +Microsoft.com and a few others. The problem right now is that every single link that you click on, +if you get them in an email or a Skype message or inside a WordPad document, when you click on it, +it's going to launch whatever the default browser is. In this case, it's Edge but maybe that's not +what you want. If I go and change my default browser to Google, then all of the websites are going +to go into the new default browser which again, may not be what you want either. + +What you want to do is route the right URL to the right website and that's what Browser Router does. +I'm going to show you very quickly how you can set up several routes using Browser Router. Now for +the sake of time, I've already created some rules over here on my management station but I'll show +you what I've done. First of all, I have set the default browser to be Chrome. Now while I won't be +demoing this part, I do want to mention that you have the option when you set a default browser to +be always the default browser or you can decide if you want to apply once and then let your users +drift to whatever they choose. + +Now I've created some simple rules. Anything with the word Google is going to get opened up in +Chrome. Anything that has the word Mozilla in the URL is going to go to Firefox. Microsoft.com is +going to open up in Internet Explorer. Bing.com is going to open up in Edge. Just for fun, I've gone +ahead and blocked Facebook and created a custom block text that just says, this website it blocked +by company policy. Please contact Support for help. All right, let's close this out. Now I'm going +to connect up the wires and link enable this and we'll go back to the endpoint and run a gpupdate +just to move the hands of time forward a little bit. Then we'll check out what we've done. + +All right. Now you'll notice when I open a link that I click on inside of a document or an email or +a Skype message, we're going to see that it's opening up in what is now our default browser of +Chrome. All right. Now let's go to Mozilla.org and you'll notice that Chrome closed and Firefox is +open. Now note that if a browser has multiple tabs open, it's only going to close the one tab, not +the whole browser. By way of example, let's go ahead and open up a new tab and we will go to +Microsoft.com. The tab closes, Firefox is still open but we're going to Microsoft inside of Internet +Explorer. All right. Now let's go to Bing.com. We saw the Internet Explorer close. Edge is open. +Finally, just to close up this daisy chain, let's go to Google.com in Edge. Watch it close and open +up the site in Chrome. + +Just to circle back to that Facebook block that I mentioned earlier, let's try to go to +Facebook.com. This website is blocked by company policy. Please contact Support for help. There we +have it. We have set a default browser. We routed particular websites to particular browsers and we +even made sure to block Facebook. If this is of interest to you, sign up for our webinar and we'll +get you started on your free trial right away. Thanks so much. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/userselecteddefault.md b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/userselecteddefault.md new file mode 100644 index 0000000000..2d104f873a --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/gettingstarted/userselecteddefault.md @@ -0,0 +1,49 @@ +--- +title: "Endpoint Policy Manager Browser Router User-Selected Default" +description: "Endpoint Policy Manager Browser Router User-Selected Default" +sidebar_position: 60 +--- +# Endpoint Policy Manager Browser Router User-Selected Default + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router now lets you give some power +back to your end-users. They can specify their browser of choice, and Endpoint Policy Manager will +let them utilize it. Here's how to set up the feature. + + + +### PolicyPak: Set up a default browser using PolicyPak Application Manager + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can use Browser Router's +new feature, which is User Selectable default browser. + +Basically, as you know, Browser Router gives you the ability to say when I'm on this website or this +pattern, open up this particular Web page. Well, we've had this ability called "New Default Browser" +for a while, but it has always been able to just say if we don't have a default route specified, +then always use "Internet Explorer" or "Edge" or "Google Chrome" or "Firefox." Now we have a new +thing called "User Selectable." User Selectable basically says let the user decide what their +default browser is. + +The way that this works is pretty simple. Let's go ahead and get "Mozilla Firefox" open for instance +also. The user decides that they want Firefox as their default browser. No problem. They can make +that decision themselves. Inside Firefox, they can click on "Options" and select "Make Default," and +we'll remember that the next time Group Policy is updated. + +I tell you this in case you're wondering, "Whoa. I tried it. I logged off, I logged back on, and it +didn't work." You have to change the default browser, you have to run GP Update or just wait +naturally for Group Policy to take effect. So there's a little micro caveat there. Under normal +circumstances if the user makes a change, they just wait a little while and Group Policy will take +effect. So this isn't a big deal. + +Once we lock in that knowledge of the user's default browser, at this point now we can do some +tests. We can create a little "Write" file, and we can say if we go to "www.microsoft.com" that has +no route, that's going to use the user's default browser. Let's see if that takes effect. We just +said Firefox is the default browser, and we get Firefox as the default browser. + +If we were to, however, go to something that does have a route like "www.google.com" that has a +route to Chrome, let's see what happens there. That should open the Chrome browser. In fact, it +does. We have another route to "www.endpointpolicymanager.com," and that should go to Internet Explorer because +we have a route to that. + +If you use User Selectable, that says anything we don't have a route for and the user has made a +choice to decide what their default browser is, then honor that. That's a good new feature for +Endpoint Policy Manager customers. I hope you like it. We'll talk to you soon. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/methods/_category_.json b/docs/endpointpolicymanager/browser-router/video-learning-center/methods/_category_.json new file mode 100644 index 0000000000..7d17261bb8 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/methods/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Methods Cloud MDM And SCCM", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/methods/cloud.md b/docs/endpointpolicymanager/browser-router/video-learning-center/methods/cloud.md new file mode 100644 index 0000000000..8162a493ac --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/methods/cloud.md @@ -0,0 +1,168 @@ +--- +title: "Use PP Cloud to Manage your browsers and manage your routes to domain joined and non domain joined machines" +description: "Use PP Cloud to Manage your browsers and manage your routes to domain joined and non domain joined machines" +sidebar_position: 20 +--- +# Use PP Cloud to Manage your browsers and manage your routes to domain joined and non domain joined machines + +Deliver your routes to traveling and non-domain joined machines to Use Netwrix Endpoint Policy +Manager (formerly PolicyPak) Cloud to manage your browsers and make routes to your domain joined and +non-domain joined machines. + + + +Hi, this is Jeremy Moskowitz. In this video we're going to use Endpoint Policy Manager Cloud's +in-cloud editors to create browser router routes so that you can get to the right browser, to the +right website lickety-split. What you should probably do first is to create a text file, just sort +of knowing where you're headed, make your little map. + +For instance, if I want everything in Mozilla.org or always open in Firefox, Google Chrome, and +Chrome, and so on, you're off to the races. That's what I'm going to do. Let me show you how I got +here in the first place. I'll just go ahead and close this out. + +Here I am in the Endpoint Policy Manager Cloud universe. If I click on a group like my Work from +Home Group, I want to Create and Link a New Policy here. I can then pick the policy type. We've got +all the Microsoft Group Policy stuff, all the Endpoint Policy Manager things. We're going to focus +here on Browser Router. + +In Browser Router you can put all your ideas into one big policy if you want to or you can break it +up into different policies. That's your choice. I'm going to call this PPBR Demo 1 here. I'm going +to create a New Policy. If I create a New Policy here, the first thing you might want to do is set +your default browser. + +For instance, if you want to start off life and say Chrome is our default browser, that's great. If +later you want to go from Chrome to Edge or Firefox to Chrome, whatever you want to do, you can do +that. We also have a special one called User Selectable. We have a special video on User Selectable. +Go ahead and watch that if you want to understand how a user can make their own choice. + +Same thing with custom; custom is a little bit special as well. I'm just going to stick to the +basics here, and I'm going to show you Chrome first. Then I'll transfer over to Edge after that. +I'll go click on Save here and I've just set my default browser to Chrome. + +The next thing I want to do is I'm going to create a new policy. This is just a standard browser +router policy. This is where you get to make your wishes. If we go back to our Notepad file here, we +want Mozilla.org to go to Firefox. Give it a name like All Things Mozilla to Firefox. + +The URL can be very specific or you can make it a wildcard. I actually like wildcards quite a bit. +If you want to say \*Mozilla\* to go to Firefox, there you go. You've just got to click Save and +you're off to the races. + +Maybe the next thing that we'll do is we'll go ahead and create a new policy here, a new browser +router policy. Let's see what's next on the list. Google go to Chrome, okay, even though that's our +default. We're going to force it anyway. We can say All Google to Chrome. + +We'll do wildcard \*Google\* and Chrome. It's good to have this set because if we change the default +browser later to Edge, at least you know Google will always continue to go to Chrome and not to +Edge. Go to that. Next on the list, why don't we just jump to something unusual, Endpoint Policy +Manager.com. We want to do Internet Explorer in Edge mode and set IE8 mode at the same time. That's +a tall order. + +What are we going to do? Let's go ahead and go to New Policy here, New Browser Router Policy. We'll +call this Endpoint Policy Manager Example Site. If you want to use Internet Explorer Special Mode, +you have to give it an exact URL. I'm going to go ahead and give it https://www.endpointpolicymanager.com. It +should work without the https before it, and it should also work without the www before it. That's +all the same there. + +If I were to go to Browser Mode and Internet Explorer 8 and I want to open it up in IE in Edge Tab, +very good, I'll go ahead and click Save here. There you go. Let's see; what else do we want to do +here? Let's go to Microsoft.com for Edge. We'll go to New Policy, New Browser Router Policy, so MS +to Edge. That's easy. We'll just go to Microsoft.com. We'll do https://www.microsoft.com. We'll go +to Edge. There we go. + +What's our last guy here? Our last guy is MSN.com to Internet Explorer in Standalone mode. Let's do +that. We'll go to a New Policy here for Browser Router, so MSN to IE Standalone. That's going to be +https://www.msn.com, Internet Explorer. Keep that, but we're going to open it in IE Standalone Mode. +We did all the things. We go ahead and click OK. Now we're locked and loaded from our work from home +machines. We've got our browser router stuff set up. + +This computer is already ready to rock. He is joined to Endpoint Policy Manager Cloud. All we're +going to do is run ppcloud/sync or you can wait about an hour, and then you're off to the races. +What we're going to do is we're going to make sure we got the setting. There we go, Endpoint Policy +Manager Browser Router Demo 1. + +Usually you have to count to about ten seconds. There are a couple of caveats. The very first time +that somebody gets some browser router routes, what happens is that browser router needs to install +some of our little helper stuff. Just be aware that the very first time there's a little bit of a +runway to sort of get started. + +We'll start off in Chrome land. We're going to see if the Chrome extension pops into view here. +We'll give it a second or two to kick in. There we go, new background app added. You only see this +the very first time. We're off to the races here with Chrome land. + +Let's go ahead and see what happens. Let's say if we wanted to Google for Mozilla, that's totally +great, Google all day long. When it's time to actually go to Mozilla.org, what's going to happen? +Close the wrong browser and open up the right browser just like that, which is Mozilla.org. + +If we wanted to go from Firefox over to Google, what are we going to do? We're going to close the +wrong browser and open up the right browser, just like that. Once again, that worked perfectly. If +we were to be in this browser and we wanted to Google for Endpoint Policy Manager, that's all fine. +You're allowed to do that. + +When you click on Endpoint Policy Manager, that's where you should open up the correct browser. We +said this browser is going to be Edge, but not just Edge, Edge in Internet Explorer mode. You notice +that that doesn't happen right away. There's a little bit of a hang time for Internet Explorer to +realize that it can do this function. It's in the documentation for Internet Explorer, and it's the +65-second first time. + +You know what? You're a busy IT professional. You don't have 65 seconds. If you know this little +magic trick where you can go to edge://compat/enterprise, you can actually give it a little boost. +You can say give it to me anyway. You can force an update. Once you do that, you should be off to +the races. + +Let's try that one more time. We'll go to Chrome land. We'll go Googling for Endpoint Policy +Manager. Let's do that one more time. We'll Google for Endpoint Policy Manager. Then googling is +fine. That's totally fine. When you click on it, what do we want to do? We want to open the right +browser, which we said is going to be Edge but with Internet Explorer mode and also set it to IE 8. +Let's see if we do all the things. Here we are. We're in Edge. You can see Internet Explorer mode, +and we are Internet Explorer 8, doing all the things. + +What happens for things where we don't have a route? That's going to go to your default browser. I +don't have a route set up for, say, Amazon.com. When I go to Amazon.com, it's going to go to my +default browser. What is that? We set it to be Chrome. + +Let's go ahead and see that. There it is. We can see Chrome opens up and doing what we expect. If we +take a look from the user's perspective of default browser here, go to Default Browser, Choose a +default web browser; what we will do is Endpoint Policy Manager takes over being the default +browser. You can see it says Browser Router. What's that? That's too confusing for your users. +That's not a problem. What we can do is change that. + +We'll go back over to Endpoint Policy Manager Cloud. Here's our browser router policy. We'll click +Edit Policy here. We can add what's called a new Look and Feel Policy. If you want to, you can say +Managed by Your IT Department, whatever you want. Then you can also display the default browser name +in parentheses, if that's interesting for you. + +Then you can go ahead and click OK. While we're here, why don't we also change the default browser +from Chrome to Edge. Maybe you're migrating in that direction. That's totally fine. Let's set both +of these things up at the same time. We'll go ahead and click OK. We'll go back to our endpoint +machine here and run policypakcloud/sync. Count to ten after you get the latest policy. Make sure it +kicks in. Then you can check both things. The first thing we can do is we can check the default +browser, Choose a Default Web Browser. Let's see if our new Look and Feel Policy took it. Yes, +Managed by Your IT Department Microsoft Edge. + +Then lastly, we said when we click on Amazon to go to our default browser. What's that going to be +now? We just changed it over for our work from home people from Chrome to Edge just like that. + +With that in mind, this is how quickly and easily you can get Browser Router up and running for your +non domain-joined machines or even your domain-joined machines no matter where they are using +Endpoint Policy Manager Cloud. I have one more little magic trick I want to talk about, which is +taking existing on-prem directives, if you already have some like in this example in my MMC console. +I have already got similar stuff in Browser Router. That's great. + +If you want to, you can take your collection, right-click, View as XML in Notepad, take a look at +all the things you've done with your on-prem console. You can Copy that. You can then go back to +Endpoint Policy Manager Cloud and maybe for my west sales team or something I want to not Create and +Link a New Policy, but I want to Upload and Link a New XML here. + +What we'll do is when you paste into this block, we're going to recognize all that as Browser Router +directives. We'll do PPBR from OnPrem. We go ahead and click Add here. Now we've done all the +things. + +If you like to use the on-prem MMC Editor, that's totally great. You can use that. Just do the work +there. Do your small scale tests with your domain-joined machine, if that's what you want to do. +Then take those directives and slam them into Endpoint Policy Manager Cloud just like that. + +Once you've done that, if you want to edit it later, you're more than welcome to using the in-cloud +editor. That way you can take your on-prem directive, if you have them, bring them to Endpoint +Policy Manager Cloud, and continue to edit them here in Endpoint Policy Manager Cloud land. I hope +this video helps you out. Looking forward to getting you started with Endpoint Policy Manager +Browser Router and Endpoint Policy Manager Cloud real soon. Thanks so much. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/methods/mdm.md b/docs/endpointpolicymanager/browser-router/video-learning-center/methods/mdm.md new file mode 100644 index 0000000000..a88a0a6e68 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/methods/mdm.md @@ -0,0 +1,79 @@ +--- +title: "Map the Right Website to the Right Browser using your MDM service" +description: "Map the Right Website to the Right Browser using your MDM service" +sidebar_position: 10 +--- +# Map the Right Website to the Right Browser using your MDM service + +Everyone knows that not every browser is the right one for all websites. Problem is, users end up +using the WRONG website most of the time. With PP Browser Router, you create policies (or ROUTES) +where specific websites are launched only into the specific browsers, then deploy those policies +using the MDM service of your choice. It couldn't be easier. Check it out! + + + +Hi, this is Whitney with Netwrix Endpoint Policy Manager (formerly PolicyPak) Software. In a +previous video, we learned how to use the Browser Router component to create policies to route the +right website to the right browser, and we delivered those settings using our group policy addition, +but what if you're using an MDM service, and you want to deliver those settings that way? You're in +luck. In this video, we're going to learn how to export those policies, wrap them up in an MSI, and +then deploy them to your MDM enrolled machine. + +Before we get started on that, though, let's look at our non-domain joined, MDM enrolled machine +here. Just to really drive the point home, let's see that indeed this is not domain joined and is in +a workgroup called, well, WORKGROUP. Now, we can see that I do already have the client-side +extension and the license file already installed on this machine, which we'll also be able to see +when we get ready to deploy the MSI that we're getting ready to create. Okay, so we know we have +this machine ready to receive directives. Now, let's see what our default browser is. When I click +on this link, it opens up in our current default browser, which is Edge. Now, since I don't have any +routes in place, anywhere I try to go in Edge or Firefox or Chrome or what have you, I'm going to, +of course, stay in the same browser I started in. Let's change that behavior. + +Now, coming back over to my management station, I've already created policies that set a default +browser and route the right website to the right browser, so let's take a quick look at those. I've +made the route simple and easy to remember, so we've set our default browser as Chrome first of all. +Then I've sent anything Google is going to go to Chrome, and anything Mozilla is going to go to +Firefox. Microsoft.com is going to open up in Internet Explorer. Bing.com will open up in Edge here, +and finally, just for good measure, I've blocked Facebook, and I've given it a block text that says, +"This website is blocked by company policy." Okay, all of that's great, but how do we get it to your +machines. It's simple. + +First of all, since this is a collection of policies, I'm going to choose to export the whole +collection rather than a bunch of individual settings. I'm going to just right click over the +collection. I'm going to Export Collection as XML, and I'm going to save it right here on the +desktop as Endpoint Policy Manager Browser Router, PPBR, Save, and there it is. Okay, time to make +the MSI that will manage all of the settings that we were just discussing. We've got our XML file +exported, but what are we going to do with it, and how will it become an MSI file? We're going to +use our Endpoint Policy Manager Exporter Tool. It installs alongside the admin console MSI and can +be found under the Endpoint Policy Manager entry on your Start menu. + +We're going to open it up, and we're going to Create a new MSI installer. Click Next, and we are +going to Add Existing Files and grab that XML file we just created. We see that it's installed for +the computer, since we made it on the computer side, and we're going to click Next. At this point, +you can give it a product name, you can specify a manufacturer, but we're just going to leave it as +is and choose Next. Now all we have to do is give the actual MSI file a name, and we'll just call it +Exported GPOs. Alright, and Save. Finish up there. + +Alright. Here's where we'll do just a little bit of movie magic. I'm going to pause my video while I +get into my MEM admin center, and I'll come right back. Here we are. Now, notice that we already +have the client-side extension deployed as well as the license file. Remember, we looked at that at +the beginning of the video and saw that those two files already existed on my endpoint. Now we're +going to go ahead and add the MSI we just created. We'll click Add, then choose that MSI we just +created, select Open, and that's that. Now I'm going to do my movie magic thing again where I pause +my video while I get everything synced, and then I'll come right back. + +We are back. Let's check it out. We now have the file on our endpoint as well as the license file +and the client-side extension. Okay, let's check this out. When I open up a link, let's notice that +it is going to open up in our current default browser, which is now Chrome. Now, let's go to +mozilla.org, and we see that Chrome closed and Firefox is open. Now, note that if the browser has +multiple tabs open, it will only close the one tab, not the whole browser. By way of example, let's +open up this new tab and go to microsoft.com. The tab closes, and Internet Explorer opens. Now let's +go to bing.com. See Internet Explorer close and Edge open. Finally, to close up this daisy chain, +let's go to google.com in Edge and watch it close and open up in Chrome. Just to circle back to that +Facebook block that I mentioned earlier, let's try to go to facebook.com. It says nope, "This +website is blocked by company policy." + +There you have it. We set a default browser. We routed particular websites to particular browsers. +We even made sure to block Facebook. Then after wrapping that all up in an MSI, we delivered the +settings to our MDM enrolled non-domain joined machine. If this is of interest to you, sign up for +our webinar, and we'll get you started on your free trial right away. Thanks so much. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/_category_.json b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/_category_.json new file mode 100644 index 0000000000..f3e4e87352 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips And Tricks", + "position": 40, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/browsericon.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/browsericon.md new file mode 100644 index 0000000000..8e02766a95 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/browsericon.md @@ -0,0 +1,12 @@ +--- +title: "Set the links to icons to actually show the default browser." +description: "Set the links to icons to actually show the default browser." +sidebar_position: 90 +--- +# Set the links to icons to actually show the default browser. + +A little update to PP Browser Router, showing how to set the generic icon to your actual default +browser icon. + + + diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/chrome.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/chrome.md new file mode 100644 index 0000000000..4781465893 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/chrome.md @@ -0,0 +1,84 @@ +--- +title: "Route all sites to Chrome, with some exceptions" +description: "Route all sites to Chrome, with some exceptions" +sidebar_position: 50 +--- +# Route all sites to Chrome, with some exceptions + +Using PP Browser router, you can do a magic trick. Have ALL traffic go thru Chrome, except a handful +of websites (called Exceptions.) Here's how to do it. + + + +### PPBR: Route all sites to Chrome, with some exceptions + +Hi. This is Whitney with Netwrix Endpoint Policy Manager (formerly PolicyPak) software. In this +video, I'm going to talk to you about how you can route all your Internet traffic, with a couple of +exceptions, to one particular browser of your choice. In this case, I'm going to show you how to do +that with Chrome. + +We're going to use a piece of advice here in the form of an XML file to do that. Let me show you how +we'll do that. We'll start with "Create a GPO in this domain, and link it here." We'll call it "All +Sites open in Chrome (with exceptions)." All right, there it is. + +Now let's go ahead and "Edit" that. This particular piece of advice, an XML, is linked over to the +computer side, so we'll start there. We're going to go down to the "Browser Router" here. We're just +going to drag and drop this bad boy right into here, and we have a "Collection." Let's see what's in +there. + +All right, this is actually pretty easy to understand. You see there's your "HTTP" and "HTTPS" +traffic in "Google Chrome." You see we have made a few exceptions for some "Internet Explorer" +options: "msn," "go.microsoft," "about:Tabs" and "endpointpolicymanager.com." Those are all available to use in +"Internet Explorer," which is to say it won't shut down and go into Chrome. It will stay in +Explorer. The same with "Firefox" here. We're going to allow "www.gpanswers.com" to open in +"Firefox" and to stay open in "Firefox." + +Now we have to do a little bit of configuration to really get rolling on this. We need to go to the +"Application Settings Manager" and make sure that the homepage of "Internet Explorer" and of +"Firefox" is one of these exceptions that's available to it. + +Because if "Internet Explorer" tries to open in Bing.com as a homepage, it's going to close it down +and open it back up in "Google Chrome" because Bing isn't one of those exceptions. The same if +"Firefox" tries to open in a Mozilla homepage, then it's going to close and open up in "Google +Chrome" again and not be able to get us to [www.gpanswers.com](https://www.gpanswers.com). + +What we're going to do is copy and paste this homepage right here. Then we're going to go to the +"Application Settings Manager" and we're going to use this "Application Settings Manager" on +"Endpoint Policy Manager for Microsoft Internet Explorer 8 and Later for Windows 7 and Later" and +use this to force set that homepage that we want to see.We'll edit that, that main page. Make sure +that we "Start with home page." We've done that. + +Let's go check on "Firefox." We're going to use "www.gpanswers.com." Let's copy that. Let's go make +sure that's our home page for Firefox. There we go. We're going to say "Show my home page." The +"Home Page" we want is that "www.gpanswers.com," and we're good to go there. Now we've got that set +up. + +So we've said that the homepage in "Mozilla Firefox" is going to be that GPAnswers.com. We've said +that the homepage on "Microsoft Internet Explorer" will be the Microsoft website. We dragged and +dropped that XML which created these exceptions and this route here. Now all we need to do is go to +our endpoint and test it out. + +Let's just do a quick GP Update ("gpupdate"). Give it a second to get through that. All right, let's +close this out. Now let's start by opening "Internet Explorer" here. It's going to open that +Microsoft homepage that we were hoping for. Yes, there we go. + +Now if we scroll down and we click on any of these links, we stay in "www.msn.com" which is one of +the exceptions that's allowed to stay in Internet Explorer. So we're here, and that's what we +expect. But if we try to go to "google.com," it shuts us down and opens us back up in Chrome just +like we expected it to. + +Let's close Chrome. Let's open up "Mozilla Firefox." It should give us the GPAnswers.com homepage. +There it is. It sure did, "www.gpanswers.com" is loading right now. You can clearly see that it's +not shutting us down and throwing us back into Chrome. Let's try going to "nbc.com." We close down, +and it's going to pop back up in Chrome just like we thought. + +As you saw, we had most of our traffic driven through Chrome, but we did have a few exceptions here +and there. Just so you know, the advice we've given you here is just that. It's advice. You can feel +free to go into here and tweak it, add, change, remove, do whatever you want. But this is just a +baseline for you to start with. + +If this sounds interesting to you, if you're interested in checking out Endpoint Policy Manager, +then sign up for a webinar. Then when it's done, we'll hand over the bits and you can get well on +your way to a free trial. + +Thanks so much. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/chromenondomainjoined.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/chromenondomainjoined.md new file mode 100644 index 0000000000..90fe743b13 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/chromenondomainjoined.md @@ -0,0 +1,58 @@ +--- +title: "Browser Router now supports Chrome on Non-Domain Joined machines" +description: "Browser Router now supports Chrome on Non-Domain Joined machines" +sidebar_position: 20 +--- +# Browser Router now supports Chrome on Non-Domain Joined machines + +If you are using PP Cloud and PP Browser router, this is the video to see how to enable Chrome to +"Other" browser routing. (Chrome to FF, Chrome to IE, Chrome to Edge, etc.) + + + +### PolicyPak: Browser Router now supports Chrome on Non-Domain Joined machines + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how we now support the Chrome +browser with non-domain joined machines and Netwrix Endpoint Policy Manager (formerly PolicyPak) +Cloud. In previous instances of Endpoint Policy Manager, we didn't have any support at all for +non-domain joined machines and Browser Router with Chrome. In this video, I'm going to show you how +it's supported. + +First things first, I'm going to download the latest "Endpoint Policy Manager Cloud Client." You +already are probably joined to Endpoint Policy Manager Endpoint Policy Manager Cloud, so you don't +have to do this. Like I said, you've already done this and auto-magically in the background you're +going to get the latest Endpoint Policy Manager client-side extension and it will have the support +built in. + +When you do this, I'm also assuming that you have a route. This is Endpoint Policy Manager Cloud. I +have a route here that says any time I go to Endpoint Policy Manager.com or anything like that open +it up in Firefox ("\*pak\* to Firefox"). I want to show you how to go from Chrome to Firefox or +anything like that. + +Now that I have the Endpoint Policy Manager Cloud Client here, let me show you the before behavior +and the after behavior. If you were to just go into "Google Chrome" here and try to go to +"www.Endpoint Policy Manager.com," it's not going to work. That's still the deal. It's still going +to keep it trapped here in Chrome land. + +Now the end user needs to either click on this little guy right here. It says, "Customize and +control Google Chrome." That's choice number one. You can see where it says "New extension added +(Endpoint Policy Manager Browser Router Chrome Extension)." You can click there. That's the first +choice. There we go: "New extension added (Endpoint Policy Manager Browser Router Chrome +Extension)." You've done that. That's thing number one. + +If you don't want to do that, you can also go to "chrome://extensions" and then down here on the +bottom you can click "Enable." That's a second choice. Now you can see that the Browser Router +Chrome extension is ready to go. + +If we were to now be in "Google Chrome" and we were to say I want to go to "www.endpointpolicymanager.com," what +it's going to do is close Chrome and open up the browser of your choice, which in my case is +Firefox. I don't know if it has ever been run before so it might ask for first run stuff. Yeah, +there we go, first run stuff. + +The point is that if you want Chrome support with your non-domain joined machines in Endpoint Policy +Manager Cloud, that is the deal. The deal is that each user needs to manually specify to turn on the +Chrome extension. That's as far as we could get. There's just no way for us to automatically turn it +on for the user. I hope that gets you at least to the one-yard line and you can show your users how +to get to the goal. + +All right, I hope that helps you out. Take care. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/defaultwindows10.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/defaultwindows10.md new file mode 100644 index 0000000000..af73fbc261 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/defaultwindows10.md @@ -0,0 +1,81 @@ +--- +title: "Endpoint Policy Manager Browser Router: Set the Windows 10 Default Browser (once) then drift" +description: "Endpoint Policy Manager Browser Router: Set the Windows 10 Default Browser (once) then drift" +sidebar_position: 10 +--- +# Endpoint Policy Manager Browser Router: Set the Windows 10 Default Browser (once) then drift + +You want to set the users' Default Browser. Great ! But how can you deliver the setting... one +time... then let the user drift from that configuration? Easy ! + + + +Hi, this is Jeremy Moskowitz. In this video, I'm going to show you how you can use Netwrix Endpoint +Policy Manager (formerly PolicyPak) Browser Router to set a default browser policy and let it drift +after that, so apply once and drift. Here's a bunch of Endpoint Policy Manager Browser Router rules +where I've got routes to certain browsers based upon website patterns. We have a couple of special +policies. One is called the New Default Browser policy. When you select the default browser, let's +pretend you wanted it to be Edge and you wanted to apply exactly Once. If you do that, it's going to +be Edge and then the user can change their default and I'll show you what this looks like. + +The second thing you may want to consider is this policy called the OS Browser Look & Feel policy. +When you do that, you can actually change what the name of the default browser looks like. You can +say, Managed by your organization and also display the default browser name in parenthesis. Let's go +ahead and click OK here. Now I've got the Default browser set to Edge, applying Once and then we've +got the OS Browser Look & Feel policies. Let's run gpupdate and see what this looks like after we do +that. Give this a second to finish up. Let's see if we hit the goal. + +If we open up a WordPad document for instance, then we were to just go to www.abc – actually, I +don't know if I have a route there. Let's do, www.amazon.com. We go to Amazon and I go ahead and +click on it. This is going to open we said to make the default in Edge. Let's see if it actually +happens here. Look at that, Edge magically shows up because that's the default browser we set for +the user to apply one time. Now let's pretend to be the user and change the default browser. What +does that look like? They're going to go here, the operating system and go to default browser. +Choose a default web browser. Again, this is a user doing this. You can see, Managed by your +organization (Microsoft Edge) but let's say they don't like that. They want to change it to Firefox +or Internet Explorer or whatever. + +I'm going to change it to Chrome just for the purposes of this particular demo here. I change it to +Chrome. The user is now doing this. We will record what the user feels is a default browser the next +time Group Policy processes. I'm accelerating the hands of time a little bit by running gpupdate but +if you did nothing and they just sat in the background and did their work, about an hour and a half +later, we're going to automatically record this with the next Group Policy update. If you're not +using Group Policy and you're using say Endpoint Policy Manager Cloud or Endpoint Policy Manager +MDM, we should record it in the next hour. Now the user feels that they've changed the default +browser to Chrome. + +Let's go ahead and click it. Let's see if that is actually accurate. Let's go ahead and see that. +Sure enough, this is Chrome. Now as the default browser, the user feels that's the default browser +but now let's see what does the operating system see if we were to go to default browser again. +Choose a default browser. What does it look like to the user? Once again, it says, Managed by your +organization, shows (Google Chrome) in there. We see, Managed by your organization (Google Chrome). +If they were to change it to something else like Firefox this time, this is the user who's doing +this themselves. They are making the choice to change it. They get exactly the same behavior. They +get to choose the browser of their choice. + +We will record that at gpupdate time. Like I said, we are going to record that at gpupdate time. +Then Endpoint Policy Manager is going to snapback. The operating system is going to see that Browser +Router is in charge but the user is going to feel that they are in charge. This is Endpoint Policy +Manager deploying the default browser one time and then letting the user drift. Now that we set it +up as Firefox, the user rather set it up as Firefox here, what happens when we click Amazon? This +will default the browser to Firefox just like that. If we look again in the operating system as the +default browser here. Choose a default browser. What do we see? We see once again, Endpoint Policy +Manager is in charge. Managed by your organization but the user selected is Firefox. + +The last thing I want to talk about is apply always. If we were to go back to the Default browser +here and change this over from Edge Once to Once or when forced. Now we're making this policy change +here to Once or when forced. Let's go back over here. Let's run gpupdate here. What's going to +happen? Give this another second here. Let's take a look at what the operating system sees. If we go +to default browser here, we changed the policy to Edge Once or when forced but notice how it hasn't +updated here. Now let's do a gpupdate/force and see how the operating system reacts now. Give this +one more second to finish up. Now if we were to go back to default browser here, because we used the +/force command, at that point only did it force it back to Edge. + +Now if we click on Amazon, what's going to happen? We set up the policy to apply Once and when +forced and in that case, it did exactly what you wanted. One more time, the Default browser. There's +a couple of different choices. The default behavior is Always, so you'll always be selecting the +default browser. That's one choice. The second choice is Once. You could also think of it as Once +and drift, so you can deploy this one time after you've rolled out Windows 10, given them the thing +that they want and then let them make the choice afterward. Then finally, Once or when forced will +snap it back to the thing you say when gpupdate/force is run. Hope this helps you out. Looking +forward to getting started real soon with Endpoint Policy Manager. Thanks. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/edge.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/edge.md new file mode 100644 index 0000000000..6c5efab748 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/edge.md @@ -0,0 +1,76 @@ +--- +title: "Route all sites to Edge (with some exceptions)" +description: "Route all sites to Edge (with some exceptions)" +sidebar_position: 60 +--- +# Route all sites to Edge (with some exceptions) + +Using PP Browser router, you can do a magic trick. Have ALL traffic go thru Edge, except a handful +of websites (called Exceptions.) Here's how to do it. + + + +### PPBR: Route all sites to Edge (with some exceptions) + +Hi. This is Whitney with Netwrix Endpoint Policy Manager (formerly PolicyPak) Software. In this +video, I'm going to show you how you can route all of your Internet traffic, with a couple of +exceptions, through one particular browser. In this video, I'm going to show you how to do that +through Edge. + +What we'll do here is we'll first start by creating a GPO and linking it to my "Sales" OU. Let's +call it "All sites to Edge (with exceptions)." We're going to just "Edit" this. Now this particular +XML that I'm going to use is linked over to the computer side, so we'll start there. We'll go to +"Browser Router." I'm just going to take this XML and just drag and drop. It is that easy. + +In this, we'll check this out. This is pretty easy to understand. You can see all HTTP and HTTPS +traffic will go through Edge ("HTTP in Edge" and "HTTPS in Edge"). Then you'll see we have a few +exceptions here. The reason we do this is because we do need to be able to have the other browsers +at least open. + +If we have all traffic through Edge, then when you try to open any of the other browsers – Internet +Explorer, Chrome, Firefox, etc. – then you're going to end up with it shooting straight over to +Edge, which is expected but not what we want to have happen immediately upon opening a new browser. +So we see we have a couple of websites that are allowed to open in "Internet Explorer" and a few +that are allowed to open in "Google Chrome." + +What we're going to do to be able to have these websites work is we need to create a policy in the +Application Settings Manager that means that "Google Chrome" homepage will be "www.gpanswers.com" +and "Internet Explorer" homepage will be this "go.microsoft.com." + +Here's what we're going to do. We're going to copy this. We're going to go over to the "Application +Settings Manager." We're going to right click. We're going to go find out "Endpoint Policy Manager +for Microsoft Internet Explorer 8 and Later for Windows 7 and Later." We're just going to make sure +that we set the homepage to be that link we just copied. "Internet Explorer Main Page" right here. +Make sure we "Start with home page." "OK." + +Let's go back and see what we had set for Google: "www.gpanswers.com." Let's go ahead and copy this. +We're going to go do the same thing we just did. We're going to set a new homepage for Chrome here. +We're going to "Open a specific page or set of pages" here. There we go, and we're good there. + +Now we have where we can open up Internet Explorer and its homepage will be allowed. The same with +Chrome. Its homepage will be allowed. This is what we have going on here. Now what we need to do is +go test it out. We're going to go over to my endpoint here, and we're just going to run a quick GP +Update ("gpupdate"). We'll give it a moment to get through that. All right, let's close this down. + +Now when open up "Google Chrome," if you remember, we decided that we were going to allow +GPAnswers.com to open in Chrome and we also made sure that Chrome's homepage was that GPAnswers.com. +Let's open it up and see if it behaves like we expect it to. There we go. It's opening in Chrome on +"www.gpanswers.com" and it's not immediately shutting down and routing us through to Edge because +this is an exception that's allowed to open in Chrome. However, if we try to go to "Google.com," +we're going to get shut down and routed right through to Edge just like we thought we would. + +Let's close this down. Let's open up "Internet Explorer." That "www.msn.com" homepage that we +anticipated is here. If we click on something inside of here, as long as we're staying in +"www.msn.com," which we are, then we're allowed to stay in Internet Explorer. However, if we try +going to "nbc.com," we're shut down and routed through Edge just like we thought. + +That is exactly how we expected. We wanted everything to go through Edge with the few exceptions +that we noted earlier. Those exceptions are just options for you. We've created them for you in +advance in that XML. But you can always tweak these or add to them as you see fit. For example, we +don't have any exceptions for Firefox, so you may want to route it so that all Mozilla traffic can +go through Firefox but everything else goes through Edge as we have here. + +That's how that works. If this is interesting to you, if you want to try out Endpoint Policy +Manager, just sign up for a webinar and when it's done we will get you all set up with the bits and +you can get started on a trial of your very own. +Thanks. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/firefox.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/firefox.md new file mode 100644 index 0000000000..b509a68351 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/firefox.md @@ -0,0 +1,102 @@ +--- +title: "Use Firefox as default for ALL pages, except some pages" +description: "Use Firefox as default for ALL pages, except some pages" +sidebar_position: 40 +--- +# Use Firefox as default for ALL pages, except some pages + +If you want to force Firefox to be the default browser for EVERYTHING, except some sites, then we +have a special XML file and video to help you out. + + + +### PolicyPak Browser Router: Use Firefox as default for ALL pages, except some pages + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can route all of your +Internet traffic through Firefox except for some exceptions like Internet Explorer or Chrome. + +We have a preconfigured XML file for Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser +Router ("all sites open in FF"). Let me show you how it works. I'm going to "Create a GPO in this +domain, and link it here" over to my computers. For instance, if I want to say "All Web traffic to +FF (except for aaa.com and bbb.com)," we're going to have all our stuff go through Firefox land. + +There are a couple of things you need to do to configure this to make this perfect, but it's not +hard. This particular guy is configured for the computer side, so I'm going to click on computer +side, "Browser Router" and drag and drop this little preconfigured knowledge ("all sites open in +FF") that we've put together for you here. + +It's easy to understand. What you're doing is you're saying all HTTP and HTTPS traffic goes through +Firefox ("HTTP in FF" and "HTTPS in FF"). That's great. Then our exceptions like "aaa.com" to +"Internet Explorer" and "www.bbb.org" to "Google Chrome," that's easy too. + +But then there's a little extra fine detail that we have to deal with which is that when you open up +Internet Explorer or Chrome, what will happen is that it will automatically just shoot over to the +browser of our choice here, which is in this case Firefox. That's a problem. + +What we need to do is say that at least one website is valid for Internet Explorer and Chrome and +declare that here and then also declare what that page is as our homepage for Internet Explorer and +Chrome automatically. + +For instance, in "Internet Explorer" land, this is a perfectly fine link we can use: +"[http://go.microsoft.com/fwlink/p](http://go.microsoft.com/fwlink/p)" as our default. How do we +configure the default? We're going to use "Application Settings Manager" to do that. Right click, +"New application," "Endpoint Policy Manager for Microsoft Internet Explorer 8 and Later for Windows +7 and Later." So this will go all the way up to Internet Explorer 11. + +You're going to set the "Home page" right there just like that. Then you also want to say that you +want to "Start with home page." You don't want to "Start with tabs from last session" or else those +guys are going to automatically jam up your Firefox land. We don't want to do that, so we want to +tell it what the default is and start with this particular "Home page." That's it. That's the first +thing. + +Then we also need to do the same thing for Chrome land. My recommendation in Chrome land is that you +take this entry which is just "https://www.google.com." We're saying that's cool. If we're in Chrome +and we go to www.google.com, then it's okay. + +I'm going to make the recommendation that you do the same thing for Chrome here and set this as your +homepage here. You do that in Chrome land right here. "Open a specific page or set of pages," just +like that. That's it. That's all there is to it. We'll go ahead and click "OK." We're saying that's +a page that we say is valid. That's all there is to it. + +We have the rules in "Browser Router" set up that all traffic goes through Firefox. We have some +exceptions. Those exceptions are the real web pages we want to get to, but then also we need some +exceptions for the default pages that are pretty common in Internet Explorer and Chrome. We have a +couple of those here. + +Okay, with that in mind, let's go over to our endpoint. Let me go ahead and close this first. Then +I'll go ahead and run GP Update ("gpupdate /force") and give this a moment to finish. Let's go ahead +and close this out, and we're ready to test it out. + +Let's start off in "Internet Explorer" land. We've set the homepage, and that's okay in MSN land. +But let's say we go create a new tab here and we go to "www.cnn.com." What do we want to see happen? +We want it to go over to Firefox because we want all traffic to go over to Firefox land. What if we +are in MSN and we start clicking around? Well, I can't remember if we said use child sites or not. +So we click on something that's not in MSN and what happens? It goes over back to Firefox. + +Let's check that out also on Chrome land. If we go to "Google Chrome" right here and we were to go +to some website we haven't traveled to yet, look what we're doing. We're setting the homepage with +Application Settings Manager to "https://www.google.com" first. That's fine. It will stay here. +Everything will be cool, no problem. You can do Google searches like "hello world." That's fine. +Everything on Google is fine. But then when you start clicking around, what do we expect? That's +when it closes and opens up the default browser that we said is Firefox land. + +Lastly since the car is in the shop already, let's just see it also work for Edge. In Edge land, +let's see what the homepage is set to. I can't remember what it is. Okay, so this is still MSN. Then +let's go ahead and see what happens if we click on one. This is MSN. I think it will stay here. But +then if we were to try to go to some external website, there we go. That went to Internet Explorer +because we had a route to Internet Explorer, so that's not a good example. + +Let's do another one because we did say that was cool to do. That's part of our ruleset. Let's go +back over here, and here we go – that's still MSN, MSN, Bing. How about Bing. What should happen is +it closed it there and it's opening it up inside Firefox land. Again, the only reason it was staying +there is that was still on the MSN website and we said anything in MSN is still cool to exist over +there. + +So that's it. That's all there is to it. We've got all the traffic going through the one particular +browser of our choice. This works under most circumstances. If you need to tweak this, you're +welcome to do so. This is just advice for you to use, and I hope this video is helpful in your +scenario. + +Thanks so much for watching. If you're looking to get started with Endpoint Policy Manager, just go +ahead and join us for a webinar and you can get started right away. +Thanks. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/ieedgemode.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/ieedgemode.md new file mode 100644 index 0000000000..9f23e9bb99 --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/ieedgemode.md @@ -0,0 +1,108 @@ +--- +title: "Endpoint Policy Manager Browser Router: Internet Explorer in Edge mode" +description: "Endpoint Policy Manager Browser Router: Internet Explorer in Edge mode" +sidebar_position: 80 +--- +# Endpoint Policy Manager Browser Router: Internet Explorer in Edge mode + +You've heard about Internet Explorer tabs tucked into Edge. But how can you quickly use Netwrix +Endpoint Policy Manager (formerly PolicyPak) Browser Router to make it happen? Here you'll learn +which versions of Windows / Internet Explorer will permit this function, and which won't work. And +learn about the "65 second rule". Definitely "walk before you run" with IE in Edge mode and PPBR by +watching this video. + + + +Hi, this is Jeremy Moskowitz. In this video, we're going to talk about how to do Internet Explorer +in Edge mode using Endpoint Policy Manager Browser Router. There's a lot of details in this video. +I'm sorry. I wish it was just point, click, shoot, done, but there's some stuff you have to know. +That's why we make the video. Let's go over it. + +First and foremost, you need to have the latest Endpoint Policy Manager client set extension +setting, so let's go ahead and make sure you have that on your machine. I've downloaded that, and +that's hanging out here, so I'm going to go ahead and put that on first. Okay, this only takes a +minute. Once you have the latest client set extension – don't try this with some old and crusty +client set extension. Make sure you've got this part first. Okay, you can update it any way you +want. I'm just doing it by hand to just make things go a little faster here. Okay, that's the first +thing. You've got to have the latest client set extension. + +The second thing is that this will – at the time of the recording of this video, it's only +guaranteed to work on Windows 2004 edition. What the heck is that? That's the one that came out in +2020 around May. They're calling it the 2-0-0-4 edition, okay? If you don't know what that means, if +you go to Winver on any given machine here – okay Winver on any given machine, you'll see +Version 2004. What I'm about to show you again is only guaranteed to work in 2004. It may work in +other operating systems, and I have – I'll put a table up here as well about where it will and where +it won't work as of this recording. There's a bug in Internet Explorer that we trap for, and we +won't do the work if we see the bug exists in a version of Internet Explorer, but because the bug +does not ever exist in 2004 edition, I can safely do the demo here, but here's a chart. Here's a +little chart that says where the bug exists and where the bug doesn't exist. I'll leave this on the +screen for a couple more seconds, and let's move on. + +Now what we're going to do is let's go ahead and set our routes. Here's Browser Router here. You've +always been able to right click Add and new policy here, and if you want it to do something like +Endpoint Policy Manager to IE, that's fine. You can go to www.endpointpolicymanager.com to Internet Explorer, +and here is where you get to set if you want to open it up in standalone IE or open it up in IE Edge +tab, so let's go ahead and do that here. What I'm going to also do – I think I've got another +conflicting one. I want to get rid of that one so it doesn't actually conflict. Let me go ahead and +delete that guy. Okay, we should be good to go. Alright, so let's go ahead and do that. + +Then what I want to do is run gpupdate to get the command. Then we're going to test it out. Alright, +so let's go ahead and let's give this a second or two to catch up. Now that that's done, we should +see that our original routes work, so if we go to Google, that's going to go over to Chrome, which +I've already got set up. That's all good to go. Here we go. Chrome, happy as a clam. If I were to +click on mozilla.org, I've set that to go to Firefox. That should be good to go. Let's go ahead and +see that. Go ahead and launch. There we go, mozilla.org over to Firefox. Now we said endpointpolicymanager.com +goes to Internet Explorer in the Edge tab, right? Whoops, let's go ahead and – we don't care about +any of that stuff. + +Now let's go ahead and click on endpointpolicymanager.com, and remember, I said it's guaranteed working in the +2004 edition. Lo and behold, it's not working right away. What is going on? Why doesn't it work +right away? It doesn't work right away because this is something that's built into Edge and Internet +Explorer, which is the enterprise mode site list, which takes two minutes. Let me go ahead and get +the URL here, and I want to show you this in the documentation so you don't think I'm somehow +magically making this up. Here I've got the document here. I just want to show you that this is not +a Endpoint Policy Manager thing. This is a Microsoft thing. This merging ability is something that's +built into Internet Explorer, and Endpoint Policy Manager takes advantage of it, but again, it only +kicks in one or two minutes later. + +If you look on this page for the word "seconds", here's what happens. The internet – IE11 waits 65 +seconds and then checks to see if there's a newer version available. I've recommended to Microsoft +that they maybe speed this up if we know the file's local, which is the way we do it, but as it sits +right now, it's about 65 seconds. Let me say this one more time a slightly different way. You can +set up the policy, the very first time here the way I did, and expect it to work perfectly when you +have all the ducks in a row and it's all working fine. It still won't work unless you run Internet +Explorer and then wait 65 seconds. The second time shouldn't be a big deal. + +Let's go ahead and close all these browsers out. We don't need them anymore. Now let's go and click +on endpointpolicymanager.com. If it doesn't work, you should close – try to close Edge here and then try it +again here. If you go back to Edge – again, should take 65 seconds or so and there we go. If we go +to endpointpolicymanager.com, we can see Edge is – we're now in Edge, but we're in Internet Explorer mode in +Edge, and what's happening underneath the hood, which I think is pretty interesting – if we go to +Task Manager here and we take a look at Edge, Edge is really running the real Internet Explorer. +That's the magic of how they do that. + +A lot of stars need to be aligned for this to work. We're doing all the things we're supposed to do +here, but if you don't see it work, again, the two interlocks or the three interlocks would be one, +latest client set extension, two, make sure you're using a compatible version of Internet Explorer – +again, I'll put the table up here again so that way it's right here so you can check it out. Make +sure you're using a compatible version of Internet Explorer, and then three, if it doesn't work +right away, don't flip out. Just wait for Edge to catch up and know what it's doing, and then 65 +seconds later, maybe a little longer, it should kick into high gear. I didn't make any changes. I +didn't do any other fancy stuff. It should just work. + +Other things from browser to browser should work as well, no changes there. If you Google for +Endpoint Policy Manager, for instance, so we're Googling for Endpoint Policy Manager, that's fine, +but when you click on Endpoint Policy Manager, bang, what should happen, it goes to Edge inside +Internet Explorer. If we wanted to say open up another Chrome tab and say go to Microsoft, which we +said go to Edge directly, what'll that do? That'll go to Edge directly. That's totally fine Like I +said, you could also have a different style as well, so if you wanted to have different policies for +Internet Explorer like you want amazon.com or some internal webpage, go to amazon.com – and you +wanted that to go to Internet Explorer and you wanted that to open up in standalone IE, that's fine. +That should work too. Go ahead and click OK, and then when the route goes there, it'll kick in. +Remember, if you added new route, computer needs to learn about this, that can take some time. +That's not a Endpoint Policy Manager function. That's an Internet Explorer function. That's just +showbiz. + +I hope this give you enough to go on. If you do have any questions, we're here for you. Try to post +them to the forums first, but if you need any one-on-one help, we're happy to help you in the +support channel. Thank you very much, and we'll talk to you soon. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/ieforce.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/ieforce.md new file mode 100644 index 0000000000..21e7fff79a --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/ieforce.md @@ -0,0 +1,103 @@ +--- +title: "Force all websites to IE (but have some exceptions)" +description: "Force all websites to IE (but have some exceptions)" +sidebar_position: 30 +--- +# Force all websites to IE (but have some exceptions) + +Using PP Browser router, you can do a magic trick. Have ALL traffic go thru Internet Explorer, +except a handful of websites (called Exceptions.) Here's how to do it. Two tips: If you cannot find +the XML, just ask support. And, if you want to route all traffic thru, say, Firefox or Chrome… +that's possible, but that's a DIFFERENT video. + + + +### PolicyPak Browser Router: Force all websites to IE(but have some exceptions) + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can us Netwrix Endpoint +Policy Manager (formerly PolicyPak) Browser Router to force all websites to go to a particular +browser. In fact, we have two videos. This video is on how to make all sites open in Internet +Explorer, except for maybe two particular websites. + +We've done all the thinking for you. It's contained right here in this XML file ("all sites open in +IE"). Let me show you and explain how it works. I actually already have Browser Router set up, and +I'm going to decommission what I'm already doing here. + +On my user side here, I actually have a "Browser Router" collection set up that I'm going to +dismantle because I don't want to do this anymore. I'll go ahead and "Delete Collection" first. +That's the first thing. If you already have it set up, you don't want to have a conflict between +what you have and what you want to do. + +This GPO is linked up high enough that I'm going to link it over to computers, and that's good +because that's what this XML is made for. You'll click on the computer side, "Browser Router" here +and just drag and drop. You now have this "Collection 1" on the computer side. + +Let me just explain what it does here. The first thing is that it's going to make all Internet +traffic go to Internet Explorer ("Internet zone in IE"). So if you're in the wrong browser, it will +automatically switch and that's the number one thing it's going to do. + +But if you want to make an exception for certain websites like you're timecard app or some other +weird thing, that's fine. Like in this example, I have Endpoint Policy Manager going to Chrome +("www.endpointpolicymanager.com in CH") and Bing going to Firefox ("www.bing.com in FF"). + +Then we have this unusual one. This is a two-step thing you need to do here. This last item here +basically says when you open Chrome, at least open the new browser tab ("CH new tab in CH") or else +it's not going to fire off at all. If you don't have this rule in place and you don't have the +homepage set to this string, then that's going to be a problem. + +What we'll do is we'll copy that. By the way, if you're in a different country than the U.S., you +might want to put in your country code like ".nz" for New Zealand or whatever your country code is +right here. I'm going to go ahead and copy this and click "OK." That's the first thing I'm going to +do. + +The second thing is in "Endpoint Policy Manager Application Settings Manager" here now. Here I +already have some settings for "Mozilla Firefox." I want to actually add something for "Google +Chrome." I want to set the Chrome homepage because it has to work for that same page that we're +expecting to be in Chrome. + +When I start Chrome, I want to "Open a specific page or set of pages" and I want it to be that +string. See what I did there? I took that last entry that we have selected for you and I'm saying +any time I start off in Google new tab land, then keep the browser open. If I don't, if I have +anything else, then it's going to force open in Internet Explorer. Those are the two moving parts +you need to do that, the "Collection 1" we provide and also creating a rule in Chrome land. + +With that in mind, I'll go ahead and now run GP Update ("gpupdate") and just wait for this to +finish. Now remember, this is on the computer side. So I'm saying for all these computers, go ahead +and do this. You could reproduce all this on the user side, but the XML we've provided is coded for +now anyway on the computer side. + +Okay, now that that's done, let's go ahead and close this out and let's give it a whirl. We'll start +off in "Google Chrome" land something like this. Let's say we go to "www.cnn.com." There we go. Let +me show you that again because remember "Google Chrome" we force set the page to be a blank tab. +That part is really important, and that's happening through Endpoint Policy Manager Application +Settings Manager. That's the first thing. Then if you try to go to "www.msnbc.com" or something like +that, we're going to go from Chrome back to Internet Explorer. + +Okay, let's go to "Mozilla Firefox" land. After I do these base hits, we'll then do the exceptions. +We'll see that the exceptions work the way we expect. You're doing your thing. You decide to go to +"search.yahoo.com." That doesn't work. That goes to Internet Explorer. So we're forcing everything +to Internet Explorer, including Edge. + +If you're in Edge land, you can let Edge start. That's fine. You can do whatever you want here. Then +you click on something and what do we get? Look at that. It goes over to Internet Explorer. So +everything is going to Internet Explorer. That was the homepage feed, but you could also type in +"www.pepsi.com" and what happens? It routes you over to Internet Explorer. So we got everything to +work in Internet Explorer just the way we wanted to. + +But we did say we wanted to make two exceptions to the list. The first exception we have is let's +say you decide you want to go over to Endpoint Policy Manager. It's just an exception that we set. +If we go to "www.endpointpolicymanager.com," what do we get? That opens up in Chrome. We'll just wait for that +finish here for a second. If you're over here in Internet Explorer and you go to "www.bing.com," +we're going to say that's going to open up in Firefox land. + +So that's really all there is to it. You can use the XML that we've provided here and you can put +your own exceptions in for your timecard app or your other specialty apps. Basically, that's all +there is to it. Just like that, you're guaranteeing everything goes to Internet Explorer except for +these handful of things. + +The only trick about it is about Chrome. If you don't have this last entry and also set it in +"Application Settings Manager," then as soon as you open Chrome it automatically just opens up +Internet Explorer, which is probably not what you want. + +That's it. I hope this helps you out and you're ready to get started with Endpoint Policy Manager. +Take care. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/iesitelists.md b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/iesitelists.md new file mode 100644 index 0000000000..c11e67535c --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/tipsandtricks/iesitelists.md @@ -0,0 +1,53 @@ +--- +title: "Internet Explorer to Endpoint Policy Manager Browser Router Site lists" +description: "Internet Explorer to Endpoint Policy Manager Browser Router Site lists" +sidebar_position: 70 +--- +# Internet Explorer to Endpoint Policy Manager Browser Router Site lists + +Use the in-the-box converter utility to take your existing IE Enterprise Site list files and +immediately use them with Browser Router. + + + +### Endpoint Policy Manager:  Internet Explorer to Endpoint Policy Manager Browser Router Site lists + +Hi. This is Jeremy Moskowitz, former 15-year Group Policy MVP and Founder of Netwrix Endpoint Policy +Manager (formerly PolicyPak) Software. In this video, I'm going to show you how you can take a +Microsoft Enterprise Mode Internet Explorer Site List and quickly convert it to be used in Endpoint +Policy Manager Browser Router. + +Here is my "EMIE" file, and you can see the extension is "emie2." Microsoft has a tool to create +these. You might have already done that, and that's sort of the point here. You might have this +list, and now you're going to use Browser Router. What are you going to do? + +All we're going to do is "Create a GPO in this domain, and link it here," and I'll call this "GPO +from IE LIST" and we'll click "Edit." We have an interface right inside Browser Router. You can do +this on the user or the computer side. + +We'll go to "PolicyPak/Browser Router," right click, "Add." Now instead of creating a "New +Collection" or a "New Policy" singular, you're going to simply create it "From Enterprise Mode Site +List" and you're going to point to that file. I've got that file in "XMLs of all kinds" right there. +There's my little guy right there. You can give it a "New collection" name right there. + +We've parsed that file, created a little folder for you, and you can see it does the mapping. Let's +go through these one-by-one and take a look what's happened in the file versus what we did. One of +them says "Open fabrikam.com/products in IE7." Okay, well, there we go: "fabrikam.com/products" open +up in "IE7" "compat-mode." + +Okay, well, let's take a look. Did we actually do that? Yeah. You can see, there's the "Url: +fabrikam.com/products." We're going to "Internet Explorer." And then we're opening it up in the +browser called "IE7 Document Mode." We did just that. + +If we were to take a look at the next one, the next one is open up "fabrikam.com" in "IE8Enterprise" +mode. Let's see if we do that. And we do. There you go. So you can see we're doing what you said to +do. And if you didn't say anything, for instance, just open up something in "IE," that's fine. We'll +parse that and set it for "Internet Explorer." And we also honor if you decide you want to open up +something particularly in "Edge." You can see this file is saying whenever I go to "www.cpandl.com," +then go to "Edge." It's just that simple. + +So with that in mind, if you have an existing Internet Explorer Site List file and you want to start +using Browser Router right away, you don't have to hand convert it over. We'll do that hard work for +you. There you go. Hope that helps you out. + +Thank you very much. Looking forward to getting you started. diff --git a/docs/endpointpolicymanager/browser-router/video-learning-center/videolearningcenter.md b/docs/endpointpolicymanager/browser-router/video-learning-center/videolearningcenter.md new file mode 100644 index 0000000000..2cacae299a --- /dev/null +++ b/docs/endpointpolicymanager/browser-router/video-learning-center/videolearningcenter.md @@ -0,0 +1,41 @@ +--- +title: "Video Learning Center" +description: "Video Learning Center" +sidebar_position: 20 +--- + +# Video Learning Center + +See the following Video topics for Browser Router. + +## Getting started + +- [Ensure users utilize the RIGHT browser for the right website !](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/rightbrowser.md) +- [Browser Router now with support for MS Edge](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/edgesupport.md) +- [Block web sites from opening in all browsers.](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/blockwebsites.md) +- [Endpoint Policy Manager and Edge ‘Special' policies](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/edgespecial.md) +- [Endpoint Policy Manager Browser Router and Ports](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/ports.md) +- [Endpoint Policy Manager Browser Router User-Selected Default](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/userselecteddefault.md) +- [Manage Internet Explorer 11 and Edge Compatibility, Enterprise Modes and IE-in-Edge Mode](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/gettingstarted/ie.md) + +## Methods: Cloud, MDM, and SCCM + +- [Map the Right Website to the Right Browser using your MDM service](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/methods/mdm.md) +- [Use PP Cloud to Manage your browsers and manage your routes to domain joined and non domain joined machines](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/methods/cloud.md) + +## Citrix & Virtual applications + +- [Using PP Browser Router on Citrix or RDS servers with published browser applications](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/citrixvirtualapps/citrix.md) +- [Browser Router with Custom Browsers](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/citrixvirtualapps/custombrowsers.md) + +## Tips and Tricks + +- [Endpoint Policy Manager Browser Router: Set the Windows 10 Default Browser (once) then drift](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/defaultwindows10.md) +- [Browser Router now supports Chrome on Non-Domain Joined machines](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/chromenondomainjoined.md) +- [Force all websites to IE (but have some exceptions)](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/ieforce.md) +- [Use Firefox as default for ALL pages, except some pages](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/firefox.md) +- [Route all sites to Chrome, with some exceptions](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/chrome.md) +- [Route all sites to Edge (with some exceptions)](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/edge.md) +- [Internet Explorer to Endpoint Policy Manager Browser Router Site lists](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/iesitelists.md) +- [Endpoint Policy Manager Browser Router: Internet Explorer in Edge mode](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/ieedgemode.md) +- [Set the links to icons to actually show the default browser.](/docs/endpointpolicymanager/knowledgebase/browserrouter/videolearningcenter/tipsandtricks/browsericon.md) diff --git a/docs/endpointpolicymanager/device-manager/_category_.json b/docs/endpointpolicymanager/device-manager/_category_.json new file mode 100644 index 0000000000..3fe314626b --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Device Manager", + "position": 35, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/device-manager/manual/_category_.json b/docs/endpointpolicymanager/device-manager/manual/_category_.json new file mode 100644 index 0000000000..14e8309762 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Manual", + "position": 10 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/980_2_image-20230725212441-2.webp b/docs/endpointpolicymanager/device-manager/manual/assets/980_2_image-20230725212441-2.webp new file mode 100644 index 0000000000..fd928ac0bd Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/980_2_image-20230725212441-2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/984_1_image-20230725214430-5_950x637.webp b/docs/endpointpolicymanager/device-manager/manual/assets/984_1_image-20230725214430-5_950x637.webp new file mode 100644 index 0000000000..5d2ca6bae6 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/984_1_image-20230725214430-5_950x637.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/984_2_image-20230725214430-6_950x580.webp b/docs/endpointpolicymanager/device-manager/manual/assets/984_2_image-20230725214430-6_950x580.webp new file mode 100644 index 0000000000..4caab7346d Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/984_2_image-20230725214430-6_950x580.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/984_3_image-20230725214430-7_950x691.webp b/docs/endpointpolicymanager/device-manager/manual/assets/984_3_image-20230725214430-7_950x691.webp new file mode 100644 index 0000000000..bb2c35d8ba Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/984_3_image-20230725214430-7_950x691.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/aa1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/aa1.webp new file mode 100644 index 0000000000..01232fc7a2 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/aa1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/aa2.webp b/docs/endpointpolicymanager/device-manager/manual/assets/aa2.webp new file mode 100644 index 0000000000..c9a4546bd2 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/aa2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/deviceinstancepath.webp b/docs/endpointpolicymanager/device-manager/manual/assets/deviceinstancepath.webp new file mode 100644 index 0000000000..15041337eb Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/deviceinstancepath.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager.webp new file mode 100644 index 0000000000..fe647867ea Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa10.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa10.webp new file mode 100644 index 0000000000..1e1d700ae2 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa10.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa11.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa11.webp new file mode 100644 index 0000000000..b0a9e86ec5 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa11.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa12.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa12.webp new file mode 100644 index 0000000000..5979de39e4 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa12.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa13.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa13.webp new file mode 100644 index 0000000000..cddf656065 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa13.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa14.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa14.webp new file mode 100644 index 0000000000..3a531415cc Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa14.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa15.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa15.webp new file mode 100644 index 0000000000..703aeb6064 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa15.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa3.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa3.webp new file mode 100644 index 0000000000..9a013e521c Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa3.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa4.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa4.webp new file mode 100644 index 0000000000..87a9ef5443 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa4.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa5.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa5.webp new file mode 100644 index 0000000000..01d4d1d686 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa5.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa6.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa6.webp new file mode 100644 index 0000000000..284a86029a Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa6.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa7.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa7.webp new file mode 100644 index 0000000000..35166ce170 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa7.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa8.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa8.webp new file mode 100644 index 0000000000..8146a20cb6 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa8.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa9.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa9.webp new file mode 100644 index 0000000000..71f9bdc209 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/aa9.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device01.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device01.webp new file mode 100644 index 0000000000..d57ba52f5d Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device01.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device02.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device02.webp new file mode 100644 index 0000000000..e172446771 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device02.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device03.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device03.webp new file mode 100644 index 0000000000..69ec7cd611 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device03.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device04.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device04.webp new file mode 100644 index 0000000000..66e4c41259 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device04.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device05.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device05.webp new file mode 100644 index 0000000000..19f379cea8 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device05.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device06.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device06.webp new file mode 100644 index 0000000000..83b8212f0a Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device06.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device07.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device07.webp new file mode 100644 index 0000000000..d3813b456c Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device07.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device08.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device08.webp new file mode 100644 index 0000000000..984c4b64c3 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device08.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device09.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device09.webp new file mode 100644 index 0000000000..c74d4eb2fb Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device09.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device10.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device10.webp new file mode 100644 index 0000000000..c21fd3da61 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device10.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device11.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device11.webp new file mode 100644 index 0000000000..a2fbca08a5 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/device11.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/event1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/event1.webp new file mode 100644 index 0000000000..d3cd55fc18 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/event1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/event2.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/event2.webp new file mode 100644 index 0000000000..4940ab9086 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/event2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/execute.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/execute.webp new file mode 100644 index 0000000000..7c541311af Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/execute.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/global1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/global1.webp new file mode 100644 index 0000000000..887a85c341 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/global1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper1.webp new file mode 100644 index 0000000000..3bb9399d7c Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper2.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper2.webp new file mode 100644 index 0000000000..815c16fbb9 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper3.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper3.webp new file mode 100644 index 0000000000..0b54121e2c Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper3.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper4.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper4.webp new file mode 100644 index 0000000000..83e7fe9501 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper4.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper5.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper5.webp new file mode 100644 index 0000000000..b1709877db Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/helper5.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/logging1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/logging1.webp new file mode 100644 index 0000000000..7f9b1de2d6 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/logging1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/ppcloud.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/ppcloud.webp new file mode 100644 index 0000000000..40660d860b Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/ppcloud.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/read1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/read1.webp new file mode 100644 index 0000000000..7fe9681c25 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/read1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/trouble2.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/trouble2.webp new file mode 100644 index 0000000000..6e1c26ff79 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/trouble2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/upd1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/upd1.webp new file mode 100644 index 0000000000..06b44e8082 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/upd1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb1.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb1.webp new file mode 100644 index 0000000000..c7d39f1d0f Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb2.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb2.webp new file mode 100644 index 0000000000..6fa5a4ef30 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb3.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb3.webp new file mode 100644 index 0000000000..1a66f098d8 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb3.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb4.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb4.webp new file mode 100644 index 0000000000..dd2eb85318 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/usb4.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/wpd3.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/wpd3.webp new file mode 100644 index 0000000000..b128ab685a Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/wpd3.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/writeattemppt.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/writeattemppt.webp new file mode 100644 index 0000000000..dc6ece4aeb Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicemanager/writeattemppt.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/assets/devicepath.webp b/docs/endpointpolicymanager/device-manager/manual/assets/devicepath.webp new file mode 100644 index 0000000000..8bcf292bd5 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/manual/assets/devicepath.webp differ diff --git a/docs/endpointpolicymanager/device-manager/manual/devicemanagerpolicies.md b/docs/endpointpolicymanager/device-manager/manual/devicemanagerpolicies.md new file mode 100644 index 0000000000..80b3c0ff8d --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/devicemanagerpolicies.md @@ -0,0 +1,160 @@ +--- +title: "Device Manager Policies" +description: "Device Manager Policies" +sidebar_position: 30 +--- + +# Device Manager Policies + +Now that USB, CD-ROM and Phone devices are all blocked, you may want to configure some policies for +device usage. + +There are two main policy types in Endpoint Policy Manager Device Manager besides Global settings +policy: + +- USB Storage Policy — Manage USB and CD-ROM / DVD device types +- Phone/WPD Policy — Manage Phone / WPD device types + +## USB Storage Policies (for USB and CD-ROMs/DVDs) + +In this section you will create USB Storage policies which are suitable for USB and also CD-ROM and +DVDs. + +![device07](assets/devicemanager/device07.webp) + +Without a Global Settings policy in place, creating a new USB policy will ask you some questions to +guide you down a path to configure both a Global Settings policy and USB policy at the same time. + +![device08](assets/devicemanager/device08.webp) + +With a Global Settings policy already in place, when you create a USB policy, you will be prompted +to select between two options, as shown on the Welcome window. Without going into every permutation +of what's possible in Endpoint Policy Manager Device Manager with regard to USB policy, we will +explore the most popular path, which is Allow Users to use specific devices. + +![usb1](assets/devicemanager/usb1.webp) + +This path lets you configure who will use what devices, and what kind of access will they have on +those devices. + +Allow specific devices with details gained from: + +- The Pop-Up on the endpoint +- The Endpoint Policy Manager Device Manager Helper Tool +- Other Methods like Windows Device Manager or vendor documentation + +![device09](assets/devicemanager/device09.webp) + +The most reliable way to get what you need is either from the Endpoint Policy Manager Pop-Up on the +endpoint or from the Endpoint Policy Manager Device Manager Helper Utility. + +This is an example copy/paste from the pop-up as seen earlier: + +``` +Device Info: Product = Transcend_32GB, Vendor = JetFlash, Revision = 1.00, DevInstPath Serial = 2185988655 +Device Instance Path: USBSTOR\Disk&Ven_JetFlash&Prod_Transcend_32GB&Rev_1.00\2185988655&0 +Policy Info: GpoName = PPDM with AA, GpoId = D13C5DEE-86D4-40A9-AA1A-7A34CFBCC883, Collection = Device Manager, CollectionId = 5896A6F0-F04D-43DB-BD33-FF3B804920DC +``` + +The simplest way to populate the Device Selection Mode screen is to take the Device Instance Path +and copy and paste it into the editor. When you do, the Vendor ID, Product ID, Product Rev and +Serial Number are all auto-detected. + +:::note +You may ignore the **STANDARD** or **COMPLETE** designations in the Endpoint Policy +Manager Device Manager UI. Typically, Endpoint Policy Manager is sold in Enterprise or SaaS editions +and in those configurations you get **COMPLETE** (meaning all the features). +::: + + +![device10](assets/devicemanager/device10.webp) + +At this point, you may use: + +- Allow by Vendor and Model of device — Must have at least Vendor and Product ID to proceed, and + this specifies a USB type to continue +- Allow list with device Serial Numbers — Similar to "Vendor and Model of device" but also + additionally restricts to a specific serial number +- Allow list with volume Bitlocker Key ID — Use the PP Device Manager Helper tool to get the + Bitlocker Key ID and place here to restrict a specific device +- Allow operation for ANY Bitlocker Encrypted volume — A blanket policy to allow for any Bitlocker + Encrypted volume + +For this walkthrough, we suggest you use: Vendor ID and ProductID and in the Product Rev, you +replace it with a \* meaning all revisions. + +![device11](assets/devicemanager/device11.webp) + +On the next screen, you can **Add domain member** meaning an Active Directory user or group. +Alternatively you can select **Add member...** and select a specific SID which can be useful if +you're adding users not-joined to Active Directory, and only using an MDM service. + +:::note +To get an overview of how to acquire SIDs with your MDM service and then use them with +Endpoint Policy Manager Device Manager, see the +[How do I get Azure AD SIDs and use them with Item Level Targeting?](/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/tipstricksandfaqs/entraidsids.md) +and [Block and Allow USB and CD-ROMs with your MDM solution](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/methods/mdm.md) topics for +additional information. +::: + + +![usb2](assets/devicemanager/usb2.webp) + +In this way you're specifying which user gets what permission. For this example, select **Read +Only**. + +The next screen lets you give this policy a name, set the state to **Enabled** or **Disabled**, +and/or use **Item Level Targeting**. + +The final screen shows the writing of the policy. You can click **Finish**. + +![usb3](assets/devicemanager/usb3.webp) + +After the policy is delivered to the endpoint and refreshed (using GPupdate for domain joined +machines for example), the results can be seen on the endpoint. + +![usb4](assets/devicemanager/usb4.webp) + +Now, reading from this USB is allowed, but other operations (like Write and Execute) will produce +errors. + +In this Quickstart you used Vendor and Product ID to allow Read access to a specific user group. +However, as a reminder you may also use Endpoint Policy Manager Device Manager to: + +- Allow specific user(s) to use all devices. This is useful if you want some people to have blanked + access to all devices. Not usually advised. See the + [Allow ONE user (or group) access to USB and/or CD-ROM and DVDs](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/usbdriveallowuser.md) + topic for additional information. +- Allow specific devices based upon Serial Number(s). See the + [Permit specific devices by serial number](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/serialnumber.md) topic for + additional information. +- Allow specific devices based upon BitLocker Key ID (restricts a specific BitLocker device) or + Allow ANY BitLocker encrypted volume (useful if you just want to make sure users are using + Bitlocker to keep data always encrypted). See the + [Restrict access only to Bitlocker drives](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/bitlockerdrives.md) topic for + additional information. + +## Phone / WPD Policies + +WPD stands for Windows Portable Device. WPDS are any kinds of portable storage devices like music +players which may have addressable storage. Phone/WPD policies are only Allow/Deny. There is no way +to dial in the rights to these devices. + +:::note +Not every kind of Phone or WPD device may be immediately supported because they sometimes +use protocols which are unexpected. You may open a support case to investigate if we can attempt to +support your unique Phone/WPD device. +::: + + +If creating a Phone/WPD policy in place with no Global Settings policy, a Wizard will help guide you +to configure both a Global Settings policy and a Phone/WPDpolicy at the same time. + +![upd1](assets/devicemanager/upd1.webp) + +If you already have a Global Settings policy in place, the editor will ask what's seen below, which +is similar to the questions when adding a USB device earlier. + +The typical route is Allow Users to use specific phones or other WPDs. + +![wpd3](assets/devicemanager/wpd3.webp) diff --git a/docs/endpointpolicymanager/device-manager/manual/globaldevicemanager.md b/docs/endpointpolicymanager/device-manager/manual/globaldevicemanager.md new file mode 100644 index 0000000000..b01d112665 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/globaldevicemanager.md @@ -0,0 +1,56 @@ +--- +title: "Global Device Manager Policies" +description: "Global Device Manager Policies" +sidebar_position: 20 +--- + +# Global Device Manager Policies + +To get started, create a Device Manager Global Settings policy. Find the node in **Computer +Configuration** > **Netwrix PolicyPak** > **Device Management Security Pak** > **Device Manager**. + +Add a new global settings policy by selecting **Add** > **New Global settings policy**. + +![device04](assets/devicemanager/device04.webp) + +Configure what device types to manage. For this example, you might want to set the recurring +notifications to a higher number to test what happens if you plug and unplug in a device. In this +example, the value is set to 20. + +By default, Endpoint Policy Manager Device Manager has a simple notification message to the user, +but that is customizable as well. + +![device05](assets/devicemanager/device05.webp) + +Your Global policy is now set in the GPO. + +![device06](assets/devicemanager/device06.webp) + +Once the policy is applied to the endpoint, the immediate result of creating a Global Settings +policy can be seen here on an endpoint when a USB device is inserted. + +The users' access to the USB device Read:No, Write:No, Execute:No, can be seen. + +A user is presented with the following information and a 60 second countdown which will auto-close +unless the user clicks **More Information**. + +![global1](assets/devicemanager/global1.webp) + +If an end user tries to read or write data or execute an application, they will get a variety of +error messages. The following screenshots are examples of what end-users may expect. + +:::note +There is no customization of the errors at this time. Errors may vary depending on how the +system responds. +::: + + +![read1](assets/devicemanager/read1.webp) + +![execute](assets/devicemanager/execute.webp) + +![writeattemppt](assets/devicemanager/writeattemppt.webp) + +Selecting More information shows Device Info which may be used in the next steps to allow a device +type. It is recommended to copy these details to Notepad to keep them handy for use during the +read-through of the manual. diff --git a/docs/endpointpolicymanager/device-manager/manual/helpertool.md b/docs/endpointpolicymanager/device-manager/manual/helpertool.md new file mode 100644 index 0000000000..2619e4746f --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/helpertool.md @@ -0,0 +1,52 @@ +--- +title: "Device Manager Helper Tool" +description: "Device Manager Helper Tool" +sidebar_position: 40 +--- + +# Device Manager Helper Tool + +The Endpoint Policy Manager Device Manager Help Tool can help you gather details from Devices, +including those which have been plugged into a system, but are not plugged in now. This can be +helpful on a machine where the user takes the device with them, and you still need to create a +policy for them. + +The Endpoint Policy Manager Device Manager Help Tool can be found in the download in the Endpoint +Policy Manager Extras folder. + +![helper1](assets/devicemanager/helper1.webp) + +:::note +The Endpoint Policy Manager Device Manager Helper tool may need local administrative +rights to run and also needs the WinRM service started. +::: + + +## Generate a Device List + +Follow the steps to generate a device list that can be used for creating Device Manager policies. + +![helper2](assets/devicemanager/helper2.webp) + +**Step 1 –** Open the Endpoint Policy Manager Device Manager Helper. + +The Device Manager Export Wizard displays details for each selection: Disk Drives, Portable Devices, +and/or CD-ROMs. Only pages for detected devices are shown. + +The Device Manager Helper tool enables you to quickly gather Instance Paths for connected and +non-connected devices. + +![helper3](assets/devicemanager/helper3.webp) + +**Step 2 –** On the Select Disk Devices window, right-click to automatically copy the detail to the +buffer for later pasting. + +![helper4](assets/devicemanager/helper4.webp) + +You can also save the list of all devices at the end of the Wizard using the **Save application list +to this XML** option. + +Then, you may use this list using the previously described wizard pages such as Allow Device by +Serial Number and Allow Device by BitLocker Key, as shown in the example screen below. + +![helper5](assets/devicemanager/helper5.webp) diff --git a/docs/endpointpolicymanager/device-manager/manual/overview.md b/docs/endpointpolicymanager/device-manager/manual/overview.md new file mode 100644 index 0000000000..2bdb9f8d36 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/overview.md @@ -0,0 +1,178 @@ +--- +title: "Device Manager" +description: "Device Manager" +sidebar_position: 10 +--- + +# Device Manager + +This manual is designed to be both an overview of what you can do with Endpoint Policy Manager +Device Manager and a Quickstart guide for getting up and running quickly. + +:::note +You may ignore the standard or complete designations in the Endpoint Policy Manager Device +Manager UI. Typically, Endpoint Policy Manager is sold in Enterprise or SaaS editions and in those +configurations you get complete (meaning all the features). +::: + + +Before reading this section, please ensure you have read Book 2: Installation Quick Start, which +will help you learn to do the following: + +- Install the Admin MSI on your GPMC machine +- Install the CSE on a test Windows machine +- Set up a computer in Trial mode or Licensed mode +- Set up a common OU structure + +Optionally, this manual demonstrates how to use on-prem Active Directory and Group Policy to deploy +Endpoint Policy Manager Device Manager directives. If you don't want to use Group Policy, see the +[MDM & UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/overview.md) topic to deploy directives for additional information. + +:::note +For an overview of Endpoint Policy Manager Device Manager see the +[Video Learning Center](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/videolearningcenter.md) topic for additional information. +::: + + +Endpoint Policy Manager Device Manager will manage USB and other removable media devices like +CD-ROMs, DVD ROMs, and phones which plug in and have storage when attached to Windows. + +For an overview of managing USB and other removeable media devices using Endpoint Policy Manager +Device Manager, see the +[Instantly Put the smackdown on USB sticks and CD-ROMs](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/usbdrive.md) topic for +additional information. + +The basic way to use Endpoint Policy Manager Device Manager is as follows: + +- Block end-users from accessing removable devices +- Create a rule to specify which removable devices a user would need access rights to +- Use On-Prem Group Policy to accept the Endpoint Policy Manager Device Manager policies created + +Alternatively, export the Endpoint Policy Manager Device Manger rules and deliver them in one of +these ways: + +- Microsoft SCCM — See the Deploy Endpoint Policy Manager Settings Using SCCM or Other Management + System! topic for additional information + +- Microsoft Intune — See the + [Block and Allow USB and CD-ROMs with your MDM solution](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/methods/mdm.md) video overview + for additional information + +- PolicyPak Cloud service — See the + [Block USB sticks using Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/methods/cloud.md) topic for + additional information + +Then allow the client machine with the Endpoint Policy Manager client-side extension (CSE) to +receive the directives and perform the work. + +:::note +If you use an MDM service or Endpoint Policy Manager cloud service, you can deliver +Endpoint Policy Manager Device Privilege Manager settings even to non-domain-joined machines over +the Internet. +::: + + +## Endpoint Policy Device Manager Components + +Endpoint Policy Managerhas the following components: + +- A Management Station — The Endpoint Policy Manager Admin Console MSI must be installed on the + management station where you create GPOs. Once it’s installed, you’ll see the **Endpoint Policy + Manager Settings** > **Endpoint Policy Manager Device Privilege Manager** node, as shown below. + +- The Endpoint Policy Manager CSE — This runs on the client (target) machine and is the same CSE for + all Endpoint Policy Manager components (such as Least Privilege Manager, Device Manager, + Application Settings Manager) + +- Windows Endpoints — In order to use these, they must be licensed for Endpoint Policy Manager + Device Manager using one of the licensing methods + +- Also available is Endpoint Policy Manager Cloud when you purchase Enterprise or SaaS + +Endpoint Policy Manager Cloud enables you to create Endpoint Policy Manager Device Manager +directives using the in-cloud editors and connect endpoints to get Endpoint Policy Manager Device +Manager directives. + +![ppcloud](assets/devicemanager/ppcloud.webp) + +While this manual mostly demonstrates concepts using the Group Policy editor, nearly everything can +be done using the Endpoint Policy Manager Cloud editors. Additionally, you can take on-prem MMC +directives and upload them to Endpoint Policy Manager Cloud and take in-cloud directives and +download them back as MMC directives. + +Also, you may use Endpoint Policy Manager Device Manager with any management system you like such as +SCCM, Intune, PDQ deploy or anything else. This is because Endpoint Policy Manager directives may be +exported as XML and wrapped up using the Exporter tool. This A free utility that lets you take +Endpoint Policy Manager Admin Templates Manager and our other products’ XML files and wrap them into +a portable MSI file for deployment using Microsoft Endpoint Manager (SCCM and Intune) or your own +systems management software. + +The [MDM & UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/overview.md) topic explains how to use the Endpoint Policy Manager +Exporter to wrap up any Endpoint Policy Manager directives and deliver them using Microsoft Endpoint +Manager (SCCM and Intune), KACE, your own MDM service, or Endpoint Policy Manager Cloud. + +This topic will get you going with the concepts and results you’re looking for and then you may +choose whatever delivery method makes sense for your organization. + +## Why you need Endpoint Policy Device Manager + +Microsoft makes it easy to turn off all access to USB sticks and other removable devices. With a +simply GPO or MDM setting that can accomplished. + +Here is exactly how to do that (without using Endpoint Policy Manager Device Manager) when using +ADMX settings via GPOs. + +![device01](assets/devicemanager/device01.webp) + +The same may be performed using and MDM service like Intune using similar settings. + +![device02](assets/devicemanager/device02.webp) + +The result will be the same where Removable Devices will be stopped. + +![device03](assets/devicemanager/device03.webp) + +In this way you can completely shut out all devices for all users for all times. + +Unlike Microsoft policies, Endpoint Policy Manager Device Manager allows customized settings for USB +and other removable devices (henceforth written as devices). + +You can perform the following management on devices: + +- Which on-Prem Active Directory or Azure user can use devices +- What access type those devices has (Read, Read/Write, Full) +- Grant access to a device only if the device has Bitlocker on it +- Specify specific device vendors, device IDs and device revisions +- Specify specific serial numbers for devices + +None of this is possible with the in-box settings with Microsoft GPOs or MDM policies (like Intune). + +:::note +Consider integrating with Netwrix Privilege Secure for Endpoints for additional features +when managing devices: +::: + + +- Endpoint Policy Manager Device Manager only deals with aspects of removable data devices. For + other device types, like Bluetooth, Serial Ports, printers and shares, consider Netwrix Endpoint + Protector. See the Device Control topic in the User Manual section of the Netwrix Endpoint + Protector [documentation](https://helpcenter.netwrix.com/category/endpointprotector) for + additional information. +- Endpoint Policy Manager Device Manager doesn't inspect the data as it goes by looking for + patterns. That is, PolicyPak Device Manager is not a traditional "Data Loss Prevention" (DLP) + product. For that functionality, consider Netwrix Endpoint Protector. See the Content Aware + Protection topics in the Administration section of the Netwrix Endpoint Protector + [documentation](https://helpcenter.netwrix.com/category/endpointprotector) for additional + information. +- Endpoint Policy Manager Device Manager isn't trying to protect against non-data devices like + "RubberDucky" devices or similar devices which act as keyboards to perform malicious actions. For + that functionality, consider Netwrix Endpoint Protector. See the Content Aware Protection topics + in the Administration section of the Netwrix Endpoint Protector + [documentation](https://helpcenter.netwrix.com/category/endpointprotector) for additional + information. + +To get started on device policies, create a link a GPO and link it to where your computers are. The +examples use East Sales Desktops. + +You may also use Endpoint Policy Manager Cloud to create these policies, or export your GPOs created +in this example for use with an MDM service like Intune. diff --git a/docs/endpointpolicymanager/device-manager/manual/rules.md b/docs/endpointpolicymanager/device-manager/manual/rules.md new file mode 100644 index 0000000000..d253128e2f --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/rules.md @@ -0,0 +1,192 @@ +--- +title: "Admin Approval, Branding, Customization and Automatically Createing Rules" +description: "Admin Approval, Branding, Customization and Automatically Createing Rules" +sidebar_position: 50 +--- + +# Admin Approval, Branding, Customization and Automatically Createing Rules + +Admin Approval enables you to anticipate devices without rules and enable users to use your service +desk to help authorize sanctioned devices - temporarily or permanently. + +See the +[Device Manager Admin Approval and Automatic Rules Creation](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/dmapprovalautorules.md) +topic for additional information on Admin Approval & Branding and Customization. + +This document refers to the person doing the approval as an Approver. This can be someone on your +help desk, security team or yourself. + +There are three parts to Admin Approval: + +- The Endpoint Policy Manager Device Manager policies, which establish Admin Approval and its secret + key +- Securing the secret key (if using Group Policy method) +- The Endpoint Policy Manager Device Privilege Manager Admin Approval Tool + +Start out by creating an Admin Approval policy, as shown below. + +:::note +You can only have one Admin Approval entry per collection and only one will ultimately +apply. +::: + + +![aa15](assets/devicemanager/aa15.webp) + +Admin Approval has four tabs: + +- General + + - Admin Approval State — **Enable** or **Disable** Admin approval + - Secure Desktop — Endpoint Policy Manager Admin Approval Dialog will present itself by default + on the Windows Secure Desktop. You can change this behavior here. + - Warning message — When a device is schedule to be used for a period of time, this amount of + minutes is when the pop-up notification occurs to the end-user + +- Secret Key + + - Key — Here is where you can create a secret key by choosing either **Derive from Password** or + **Generate Random**. Then, click **Copy**, and, for now, paste the secret key into Notepad. + +- Email + + - Use of Email — **Enabled** or **Disabled**. When Enabled you can provide an email address. + When Disabled you will only get short over the phone codes. + - Send To — The email address you want the long request codes sent to + - Always use email (only) — Turns off the short code method + - Open the message in Notepad Instead — When using the Email method, instead of launching your + desktop's mail app, like Outlook, instead open the request in Notepad. Users can then paste it + into the mail program (Gmail.com) or application of their choice. + +- Misc + + - Custom Message — Optional message to customers about what to do, who to call, what is + permitted etc, to override the default Endpoint Policy Manager Device Manager behavior. + +![aa14](assets/devicemanager/aa14.webp) + +## Brand Dialog Using Global Settings (Optional) + +You can brand your dialogs to your corporate standards. This is done in the Global Settings policy +type you saw earlier. + +Below you can see some example of what you may configure. You can even run a pre-test to see what +the user will see before implementation. + +![aa4](assets/devicemanager/aa4.webp) + +## Test Admin Approval + +When unknown devices are encountered, the following dialog will appear. Users can use your details +to call the service desk and/or send email requests. + +Requests are then fielded by the Device Manager Admin Approval tool. + +![aa3](assets/devicemanager/aa3.webp) + +## Device Manager Admin Approval Tool + +The Device Manager Admin Approval Tool is then used to field requests. This application is +pre-installed whenever the Endpoint Policy Manager Admin Console MSI is installed. Its also +available as a standalone portable application and found in the Endpoint Policy Manager Extras +folder in the download. + +![aa5](assets/devicemanager/aa5.webp) + +The first time set up for an Approver requires that the Secret Key found in the policy is placed +into the tool. The Approver also has his own password to sign into the app to open it up. + +![aa6](assets/devicemanager/aa6.webp) + +## Admin Approval Tool in Simple Mode + +The Approver can field Simple (over the phone) requests or Email requests. In this example, a +Request code is provided over the phone to an Approver. + +An Approver can set: + +- Permissions — Full access, Read, Read & Write, Read & Execute +- Timeframe — After this amount of time, device must be re-authorized. Permanent, 15 minutes, 1 + hour, 2 hours, 4 hours, 8 hours. +- Uses — Once, 5 times, 10 times, Unlimited +- Expires — Amount of time the Response code is valid for Never (Default), 10 minutes, 1 hour, 12 + hours + +![aa7](assets/devicemanager/aa7.webp) + +The Response code will change based upon the Approver inputs. + +:::note +Anytime TimeFrame is set to **Permanent**, it overrides all Uses limits and generates a +warning. For example: Uses set to **Once** and TimeFrame set to **Permanent**. +::: + + +![aa8](assets/devicemanager/aa8.webp) + +In this combination, Timeframe overrides Uses, meaning that whatever access you give the device is +actually Permanent and not Once. + +To get out of this problem if you get into it, you have two choices: + +- Update the policy by disabling the Global Policy or turning off Device Manager. +- Or on a single machine you may erase the value for the device you granted Permanent access to. See + the + [What are the registry settings for Device Manager (and how do I reset Device Manager Admin Approval)?](/docs/endpointpolicymanager/knowledgebase/devicemanager/knowledgebase/registry.md) + topic for additional information. + +## Admin Approval Using Email Method + +You can use Admin Approval requests to go through your service desk as email requests. See the +[Endpoint Policy Device Manager and End-User Emails to Support](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/enduser.md) topic +for additional information. + +The email method will attempt to use your registered mail application. Your email app must be +registered with the .EML extension for this to work as expected. + +## ![aa9](assets/devicemanager/aa9.webp) + +The Approver would then field this request, generate a Response code and send it back via email or +copy paste. + +The Email method has details about what the device actually is, versus the Simple method which +cannot provide those details. + +![aa10](assets/devicemanager/aa10.webp) + +## Admin Approval Create Rule Button + +The Create Rule button allows you to launch a Wizard which will help generate a rule you can then +use permanently and deliver using Group Policy, MDM or Endpoint Policy Manager Cloud. + +Because the Device Details are now known via the Email method, you can create a permanent rule +similar to the Wizard we saw earlier. + +![aa11](assets/devicemanager/aa11.webp) + +In the Wizard you can use the default settings or change the Members and Permissions. + +Finally, save your XML and import it into the MMC editor as a policy or use with Endpoint Policy +Manager Exporter or Endpoint Policy Manager Cloud. + +![aa12](assets/devicemanager/aa12.webp) + +## Making a rule directly from an Email Request Code + +If you'd like you can take a Email request code and immediately generate a rule inside the MMC +console. + +Copy the code and then select **New Policy from Audit Event or Admin Approval Code**. + +Paste in the Request code and follow the Wizard to generate the rule which you need. + +![aa13](assets/devicemanager/aa13.webp) + +## Make a Rule Directly from an Event on the Endpoint + +You can take Event IDs generated from Endpoint Policy Manager Device Manager, such as this and use +it as the basis to start a rule. + +![event1](assets/devicemanager/event1.webp) + +# ![event2](assets/devicemanager/event2.webp) diff --git a/docs/endpointpolicymanager/device-manager/manual/troubleshooting.md b/docs/endpointpolicymanager/device-manager/manual/troubleshooting.md new file mode 100644 index 0000000000..9d4ec535ff --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/manual/troubleshooting.md @@ -0,0 +1,20 @@ +--- +title: "Troubleshooting" +description: "Troubleshooting" +sidebar_position: 60 +--- + +# Troubleshooting + +Logging occurs on the endpoint. Use the Event Log first to look for events. + +![trouble2](assets/devicemanager/trouble2.webp) + +In addition, you can use Endpoint Policy Manager's text based logs. + +You will need admin access to see `c:\ProgramData\PolicyPak\PolicyPak` Device Manager logs. + +Each log occurs when different policy triggering events occur. Special log is +ppComputer_Operational.log which explains what's happening in real-time on the machine. + +![logging1](assets/devicemanager/logging1.webp) diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/_category_.json b/docs/endpointpolicymanager/device-manager/technical-notes/_category_.json new file mode 100644 index 0000000000..ac83484ebc --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/technical-notes/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Technical Notes", + "position": 30 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/980_2_image-20230725212441-2.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/980_2_image-20230725212441-2.webp new file mode 100644 index 0000000000..fd928ac0bd Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/980_2_image-20230725212441-2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_1_image-20230725214430-5_950x637.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_1_image-20230725214430-5_950x637.webp new file mode 100644 index 0000000000..5d2ca6bae6 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_1_image-20230725214430-5_950x637.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_2_image-20230725214430-6_950x580.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_2_image-20230725214430-6_950x580.webp new file mode 100644 index 0000000000..4caab7346d Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_2_image-20230725214430-6_950x580.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_3_image-20230725214430-7_950x691.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_3_image-20230725214430-7_950x691.webp new file mode 100644 index 0000000000..bb2c35d8ba Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/984_3_image-20230725214430-7_950x691.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/aa1.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/aa1.webp new file mode 100644 index 0000000000..01232fc7a2 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/aa1.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/aa2.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/aa2.webp new file mode 100644 index 0000000000..c9a4546bd2 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/aa2.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/deviceinstancepath.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/deviceinstancepath.webp new file mode 100644 index 0000000000..15041337eb Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/deviceinstancepath.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/assets/devicepath.webp b/docs/endpointpolicymanager/device-manager/technical-notes/assets/devicepath.webp new file mode 100644 index 0000000000..8bcf292bd5 Binary files /dev/null and b/docs/endpointpolicymanager/device-manager/technical-notes/assets/devicepath.webp differ diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/knowledgebase.md b/docs/endpointpolicymanager/device-manager/technical-notes/knowledgebase.md new file mode 100644 index 0000000000..9683a2bb74 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/technical-notes/knowledgebase.md @@ -0,0 +1,13 @@ +--- +title: "Knowledge Base" +description: "Knowledge Base" +sidebar_position: 10 +--- + +# Knowledge Base + +See the following Knowledge Base articles for Device Manager. + +- [How to add Devices when serial numbers contain extra characters in the device instance path](/docs/endpointpolicymanager/knowledgebase/devicemanager/knowledgebase/serialnumber.md) +- [Why can MSIs be installed from a USB drive when the only access granted to users is READ access](/docs/endpointpolicymanager/knowledgebase/devicemanager/knowledgebase/usbdrive.md) +- [What are the registry settings for Device Manager (and how do I reset Device Manager Admin Approval)?](/docs/endpointpolicymanager/knowledgebase/devicemanager/knowledgebase/registry.md) diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/registry.md b/docs/endpointpolicymanager/device-manager/technical-notes/registry.md new file mode 100644 index 0000000000..75c5a7d9f4 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/technical-notes/registry.md @@ -0,0 +1,64 @@ +--- +title: "What are the registry settings for Device Manager (and how do I reset Device Manager Admin Approval)?" +description: "What are the registry settings for Device Manager (and how do I reset Device Manager Admin Approval)?" +sidebar_position: 30 +--- + +# What are the registry settings for Device Manager (and how do I reset Device Manager Admin Approval)? + +On any endpoint, details about what USB and other devices have temporary or permanent access are +stored here: + +HKEY_LOCAL_MACHINE\SOFTWARE\PolicyPak\Client-Side +Extensions\{7FA1BDCB-818A-4EF6-A1B7-EF5F85C2D702}\Admin Approval\ApprovedDevicesStorage + +Here is an example of a device which was approved via the Admin Approval tool. + +![aa1](assets/aa1.webp) + +## To determine the Admin Approval End Time for any device: + +**Step 1 –** Grab the **EndTime** and change to **Decimal**. + +**Step 2 –** Input the **EndTime** into this Powershell script. + +``` +$my_time = 1725537001291 +(([System.DateTimeOffset]::FromUnixTimeMilliseconds($my_time)).DateTime.ToLocalTime()).ToString("s") +``` + +An example can be seen here: + +![aa2](assets/aa2.webp) + +## To Determine the Permissions within the Registry: + +Permission bit flags: + +- READ 0x80000000 +- WRITE 0x40000000 +- EXECUTE 0x20000000 +- ALL 0x10000000 + +For example, for READ+WRITE permissions, the value is 0xC0000000. + +## Resetting the Device Manager Admin Approval Values + +From time to time you may want to reset the values on a machine such that all devices are reset, and +new Admin Approval values may be set in the future. To do this: + +**Step 1 –** Download PSExec from +[https://learn.microsoft.com/en-us/sysinternals/downloads/psexec](https://learn.microsoft.com/en-us/sysinternals/downloads/psexec) + +**Step 2 –** Run CMD as administator + +**Step 3 –** Execute psexec.exe -i -s regedit + +**Step 4 –** As SYSTEM open Regedit. Find HKEY_LOCAL_MACHINE\SOFTWARE\PolicyPak\Client-Side +Extensions\{7FA1BDCB-818A-4EF6-A1B7-EF5F85C2D702}\Admin Approval\ApprovedDevicesStorage + +**Step 5 –** Delete the whole key **ApprovedDevicesStorage** to reset AA approvals for all devices, +or chose a specific one and delete it. + +**Step 6 –** Restart PPExtensionService.exe (aka Netwrix Endpoint Policy Manager (formerly +PolicyPak) Helper Service.) diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/serialnumber.md b/docs/endpointpolicymanager/device-manager/technical-notes/serialnumber.md new file mode 100644 index 0000000000..c712b482c6 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/technical-notes/serialnumber.md @@ -0,0 +1,42 @@ +--- +title: "How to add Devices when serial numbers contain extra characters in the device instance path" +description: "How to add Devices when serial numbers contain extra characters in the device instance path" +sidebar_position: 10 +--- + +# How to add Devices when serial numbers contain extra characters in the device instance path + +## Problem + +Some USB devices have trailing extra characters such as &000000 in their serial number when viewed +within the Device instance path. + +Example + +``` +SCSI\Disk&Ven__USB&Prod__SanDisk_3.2Gen1\6&1262c329&0&000000 +``` + +When copying these instance paths to create a policy for this device, the serial numbers are not +correctly applied in the MMC console view. + +![980_2_image-20230725212441-2](assets/980_2_image-20230725212441-2.webp) + +This would not properly target the USB device in question as the serial is configured as **0** in +the policy. + +## Workaround + +Instead of adding the Device Instance Path **As Serial Number**, use **As Instance Path** instead. + +![devicepath](assets/devicepath.webp) + +## Result + +This will result in a configuration that will use the entire Device Instance Path as a whole, +instead of trying to break out the individual parts and force the targeted USB device to get the +permissions as configured in the policy. + +![deviceinstancepath](assets/deviceinstancepath.webp) + +The Device Manager policy now works as expected. diff --git a/docs/endpointpolicymanager/device-manager/technical-notes/usbdrive.md b/docs/endpointpolicymanager/device-manager/technical-notes/usbdrive.md new file mode 100644 index 0000000000..92821be5a4 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/technical-notes/usbdrive.md @@ -0,0 +1,53 @@ +--- +title: "Why can MSIs be installed from a USB drive when the only access granted to users is READ access" +description: "Why can MSIs be installed from a USB drive when the only access granted to users is READ access" +sidebar_position: 20 +--- + +# Why can MSIs be installed from a USB drive when the only access granted to users is READ access + +## Problem + +Users can install MSI (Windows Installer Packages) from a USB drive where they have only been +granted READ access by the Device Manager. + +## Cause + +The Endpoint Policy Manager Device manager is working as expected. You can install an MSI from a USB +drive where the user only has READ access because double-clicking (i.e., launching) an MSI is really +only a READ event by C:\Windows\System32\msiexec.exe, which reads the MSI's database contents and +performs the install. MSIEXEC is doing the executing but only requires READ access to the MSI file +in order to do so. In other words, Endpoint Policy Manager DM is a file filter driver which handles +filters. If you give someone READ access, they have the filter to read the file. Then the MSIEXEC +can pick up the ball and run with it. + +## Possible Resolutions + +In addition to limiting access to the USB drive by using Device Manager, the best way to stop +MSIEXEC is to then use Endpoint Policy Manager Least Privilege Manager (LPM) to block MSIEXEC, since +it is calling the input to the database. + +There are a few ways you can do this using Endpoint Policy Manager Least Privilege Manager: + +1. You can block MSIEXEC directly from an .EXE rule with a DENY Executable policy. + + ![984_1_image-20230725214430-5_950x637](assets/984_1_image-20230725214430-5_950x637.webp) + +2. You can block all .MSIs with a DENY Windows Installer Policy. + + ![984_2_image-20230725214430-6_950x580](assets/984_2_image-20230725214430-6_950x580.webp) + +3. You can turn on Admin Approval. + + ![984_3_image-20230725214430-7_950x691](assets/984_3_image-20230725214430-7_950x691.webp) + +Why is an extra step in Least Privilege Manager needed? Because Endpoint Policy Manager Least +Privilege Manager is a process driver which handles processes. If you specify what to do on a +process level, Endpoint Policy Manager Least Privilege Manager handles it, including elevation and +blocking. + +So, you cannot use Endpoint Policy Manager Device Manager to filter a PROCESS (MSIEXEC), but you +could filter it for NO READ access to files. + +You cannot use Endpoint Policy Manager Least Privilege Manager to filter specific files, but you can +filter it to tell MSIEXEC PROCESS what to do. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/_category_.json b/docs/endpointpolicymanager/device-manager/video-learning-center/_category_.json new file mode 100644 index 0000000000..2ad03511c7 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Video Learning Center", + "position": 20 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/_category_.json b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/_category_.json new file mode 100644 index 0000000000..ee7419d8c4 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Getting Started", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/bitlockerdrives.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/bitlockerdrives.md new file mode 100644 index 0000000000..7a2daea157 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/bitlockerdrives.md @@ -0,0 +1,11 @@ +--- +title: "Restrict access only to Bitlocker drives" +description: "Restrict access only to Bitlocker drives" +sidebar_position: 50 +--- +# Restrict access only to Bitlocker drives + +Got USB sticks and want to ensure they only work with Bitlocker'd devices? See this video to see how +to do it. + + diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/dmapprovalautorules.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/dmapprovalautorules.md new file mode 100644 index 0000000000..2afa51a71e --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/dmapprovalautorules.md @@ -0,0 +1,12 @@ +--- +title: "Device Manager Admin Approval and Automatic Rules Creation" +description: "Device Manager Admin Approval and Automatic Rules Creation" +sidebar_position: 80 +--- + +# Device Manager Admin Approval and Automatic Rules Creation + +Want to allow or deny specific USB devices whenever a user inserts one? And would you like to +automatically create rules based upon these requests? Learn both techniques here. + + diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/dmhelpertool.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/dmhelpertool.md new file mode 100644 index 0000000000..96f8612b74 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/dmhelpertool.md @@ -0,0 +1,12 @@ +--- +title: "Device Manager Helper Tool" +description: "Device Manager Helper Tool" +sidebar_position: 70 +--- + +# Device Manager Helper Tool + +This demo shows you how to enumerate the USB and other devices on the machine to enable quick Device +Manager rules. + + diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/enduser.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/enduser.md new file mode 100644 index 0000000000..614c340981 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/enduser.md @@ -0,0 +1,12 @@ +--- +title: "Endpoint Policy Device Manager and End-User Emails to Support" +description: "Endpoint Policy Device Manager and End-User Emails to Support" +sidebar_position: 60 +--- + +# Endpoint Policy Device Manager and End-User Emails to Support + +Got users out in the field and want them to be able to report their requests for un-blocking their +USBs and other devices? See how to set that up in this video. + + diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/serialnumber.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/serialnumber.md new file mode 100644 index 0000000000..0206c55cc4 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/serialnumber.md @@ -0,0 +1,57 @@ +--- +title: "Permit specific devices by serial number" +description: "Permit specific devices by serial number" +sidebar_position: 40 +--- +# Permit specific devices by serial number + +Use Netwrix Endpoint Policy Manager (formerly PolicyPak) Device Manager to specify exactly which +users can use which serial numbers of USB sticks and DVD devices. This way, you issue the device, +and you know EXACTLY who has USB Read/ Read/Write or Full access. + + + +In a previous video, you saw me limit which USB sticks are allowed by USB vendor type. The problem, +however, even though it works great when you give the correct USB sticks to your end users, is that +if they do end up with a USB stick that's not theirs but does match the vendor type, like this one I +found in the parking lot, what happens then? It still lets me do naughty, naughty things that I +shouldn't be able to do because you said it was okay to open it up by vendor. Instead of opening up +by vendor, why don't we open it up only by serial number? Let's get rid of this rule. We'll say +goodbye to this rule for a second. Now we're putting the smackdown on absolutely everything. We'll +go back to our endpoint. We'll run gpupdate. + +Now the smackdown should be on on all sticks, and let's stick in our – let's go ahead and stick in +our evil USB stick first and then our good USB stick second. This is the evil USB stick. When we do, +we see this evil USB stick, we can see that it – even though it matches the product and vendor, the +serial number is unique here. Let's go ahead and put in our good USB stick, the one that has – that +we've provided from the IT team. Let's go ahead and put that in. What do we see here? We see this +serial number ends in 611. That's the good one. The one that ends in 611 has all the good stuff in +it. What we're going to do is take this line, called the Device Instance Path. Let's go ahead and +copy that. + +We'll go to the rule. We'll create a New Policy here and let's say Allow users to use specific +devices, not by Vendor ID, but if you opt into the Endpoint Policy Manager Device Manager COMPLETE +edition, that enables you to do this magic trick, which is to allow list by device serial numbers. +I'm going to paste it in, click Add, there's the serial number, 611, and now we can dictate who can +use this one. If I want a particular user or if you want to share it amongst a group, that might be +okay. Dictate the user or the group and what permission access they have. This is very particular. +This is saying this user has this access for this particular serial number, and that's it. + +Let's go ahead and do an AB test. I'll go ahead and take out the good one. I'll run gpupdate. +Alright, I'll run gpupdate here. Give this a second to catch up. Now, I'll put in the evil USB +stick, the one I found in the parking lot. Let's see what happens. It's blocked. I can't do anything +here. Read No, Write No, Execute No. Just to prove a point here, you can see the serial number's +not 611. If I were to put in – just see what I can see here in Windows land here. If I were to take +a look and try to be evil and do some malware stuff, what happens? Not letting me do that. I can't +right-click and open it in Notepad. I'm blocked here, which is exactly what I want. This is not a +sanctioned device, but if I were to put in – if I were to put in the good USB stick that I did +sanction with the 611 as the serial number, what do we get? We don't get any pop-ups because it is +allowed, and if we want to do full control on it because those are the rights that we provided, it +just works the way we expect. There is my PDF. If I were to try to copy it to the desktop, I'm good +to go, and that's it. + +With Endpoint Policy Manager Device Manager, you're in charge. You can let particular user do +whatever they want, you can hammer – put the hammer down based upon a device type, or you can really +put the screws it by dictating it by serial number. You can decide which is the most important way +for you to get the job accomplished, and hope this tool helps you out. Thank you very much. Talk to +you soon. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdrive.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdrive.md new file mode 100644 index 0000000000..1f144382ac --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdrive.md @@ -0,0 +1,57 @@ +--- +title: "Instantly Put the smackdown on USB sticks and CD-ROMs" +description: "Instantly Put the smackdown on USB sticks and CD-ROMs" +sidebar_position: 10 +--- +# Instantly Put the smackdown on USB sticks and CD-ROMs + +With Netwrix Endpoint Policy Manager (formerly PolicyPak) Device Manager, it takes one policy to +immediately put the smackdown on USB sticks and CD-ROMs. Yep, it's that easy. + + + +Hi, this is Jeremy Moskowitz, founder and CTO of Endpoint Policy Manager Software. Hey, look, I just +found this USB stick in the parking lot. Let me go ahead and double click on it and see what's +inside. Remember, this is exactly what your users are doing. They find a USB stick or they have +something at home or they got it at a trade show. They just start clicking on stuff... Here's some +malware that could take over your machine. Here's something more sophisticated like a ransomware +simulator. That's not bueno. That's now taking over the network. PowerShell Malware or JAVA Malware, +who knows what's on the USB stick. Your job is to try to block both USB stuff and evil CD-ROMs. +Here's a CD-ROM that I've put in the CD-ROM drive. In this first video, I'm just going to show you +how to put the smackdown on all CD-ROMs and USB sticks just like that. Then in other videos I'm +going to show you the real power of Device Manager – Endpoint Policy Manager Device Manager, which +enables you to open it up for specific use cases. + +This video I'm showing you how to use the Group Policy method to deploy your settings. Again, in +other videos, I'm going to show you how to use your MDM service like InTune or our cloud service to +do so. We're going to create a new Global Settings policy here, and I'm going to just Block all +USB/DVD devices. This is the master on switch. We have a couple little extra flags here to help you +along the way. One of my favorites is show how many times somebody puts in a USB stick. I'm going to +jack this up to five, so if I keep taking – putting in and unplugging a USB stick, they'll see this +five times. You can also change the default messages. I'm going to leave those here. You can +customize it with variables and so on. I'm just going to keep it simple. One policy. Boom. You are +done. + +Let's go over to the endpoint machine. Go ahead and run gpupdate. Give this a second to catch up. +There we go. You can see that because we set the flag for let users know when policy changed, you +can see we've got the JetFlash Transcend drive, Volume E and others. What's happening here? No Read. +No Write. No Execute. Let's go ahead and click OK here. USB stick is still in the drive. Let's go +ahead and go to that one first. Here's the USB in the parking lot. If we were to go to that JAVA - +Malware. Let's go find that JAVA - Malware again. Does that run? Nope. Can't do that. Let's try to +open up one of these files by right-clicking and going to Notepad++. What're we going to get here? +Not that file. You can't access that. That's not available to you. If you were to try to take a look +or try to run anything else, let's try to install some application. What do we get from that? That's +going to be blocked. What if we try to copy something from there to the desktop? What do we get from +there? We're not allowed to do that. What if we try to copy something from the desktop over to the +USB stick? Can't do that. That is it. We put the smackdown on it. + +Let's go ahead and take a look at the CD-ROM as well. If we were to try to take a look at this text +file here – same idea on the CD-ROM – what do we get? That's blocked. All the same exact activities. +You try to copy to and from, try to execute, read and write, you can't do anything. It's all +blocked, okay? In the next video, I'm going to show yo how you can open up the doggy door for some +specific cases. For instance, the next videos are going to show you how you can allow one user to do +whatever they want with any USB sticks, one trusted user. In another video, I'm going to show you +how you can open up one user for specific USB sticks by serial, and then I'll also show you some +other magic tricks with exporting to MDM and our cloud service. Go ahead and watch the rest of the +videos. Looking forward to getting you started with Endpoint Policy Manager Device Manager real +soon. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdriveallowuser.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdriveallowuser.md new file mode 100644 index 0000000000..ce00be7ffb --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdriveallowuser.md @@ -0,0 +1,68 @@ +--- +title: "Allow ONE user (or group) access to USB and/or CD-ROM and DVDs" +description: "Allow ONE user (or group) access to USB and/or CD-ROM and DVDs" +sidebar_position: 20 +--- +# Allow ONE user (or group) access to USB and/or CD-ROM and DVDs + +If you trust one person, like a doctor or consultant, etc. then you can grant the one person (or +group) READ, READ/WRITE, FULL access to all device. + + + +In a previous video, you saw me put the smackdown on CD-ROMs and USB sticks. This blanket is going +to hit every user on this computer, but what if you had one user that you trusted, like a doctor or +somebody on your sales team that you said look, we know and recognize that you need to use USB +sticks. In fact, you should use any USB stick you want. You can do that. Let's go ahead and show – +this is the USB stick I found in the parking lot. Let me go ahead and unplug that. Now I'm going to +plug in a USB stick that they own or that you provided for them, either one. When that happens, of +course, we're going to get the block message because we've blocked everything. + +This is a different USB stick, but let's go ahead and take a look at – we can see it here in +Windows. This is an IT encrypted USB stick. If we take a look, what's on here? A bunch of PDFs, +PowerPoints, some graphics and cool stuff. The problem is that there's no way for them to read it +because you go ahead and – that doesn't work because you've blocked everything, or if you try to +copy to the desktop, that's not going to work because, again, you've blocked everything. In this +video what I want to show you how to do is to trust one user to do the right thing. How do we do +that? + +Right-click Add a New Policy here. The item that you're after here is Allow specific users to use +all devices. If you think that's too wide open, then just watch the next video where I'm going to +show you how to allow users to use specific devices. This one is allow users to use all devices. I'm +going to add a domain member here, that guy who's currently logged on, he's EastSalesUser1. You can +pick a user or a group here, so I'm going to pick EastSalesUser1 can do – you pick the access level. +This is the real superpower of Netwrix Endpoint Policy Manager (formerly PolicyPak) Device Manager, +smacking it down and opening it up just the least amount of privileges required to do their job. If +they only need read access to this USB stick, let's go ahead and do that. Go ahead and click Next. +Now they can read anything on any USB stick that they have, either ones that they have or ones that +they find. + +If you want something more intense than that, that's the next video. I'm just showing you how you +can trust one person for that. Again, I have the pop-up showing up every time a policy changes just +for demonstrations here. You can see that we have agreed now to let this – to let the person get to +the CD-ROM, right, because that counts as a device, and same thing for the USB stick. Here we go. +They've got read for the CD-ROM and read for the USB stick. On the USB stick now, I didn't have to +unplug it or do anything. Let's just go ahead and double-click that same item. What do we get? Boom. +Now we have read access to the USB stick just the way we wanted to. If you want to take an item from +the USB stick and drag it over to the desktop, there we go. That succeeds. If you want to try to +copy it back to make another one, we didn't say you could do that, so that's going to be – that's +going to be blocked. + +If you want to change the behavior and give the person more access, you're welcome to do that. You +just go to the user and group settings, change the permission for the particular user for what they +can do. We can do Read & write, or Execute, or Full Access. I'll just use Full Access just for fun. +Go ahead and click Save there, and we'll do another quick gpupdate, and when this is all caught up, +you should be able to take any item and copy it to the USB stick, and you're off to the races. This +is opening up the doggy door saying one person is sanctioned to do all the things with USB sticks +and CD-ROMs. Now that that's all done, let's go ahead and – if I were to copy this, and it should +just make another copy just like it would regular in Windows. Yep, let's do that. It can replace +that file, or I can take a file from the desktop just copy it into my USB stick. Oh, I already have +that file, so I'll just do one more thing. Try this guy. Here we go. There we go. I've copied stuff +back and forth. I've given myself full access. If I want to be able to delete something, I can +certainly do that too. I'll go ahead and delete this file. I've given myself full – I've given this +particular user full access. + +If you think that is too much access, go ahead and check out the next video where I'm going to show +you how you can allow one user to have specific access to a specific USB stick by serial number. +That's even more cranking it down. Hope this video helps you out. Looking forward to getting you +started with Endpoint Policy Manager real soon. Thanks. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdriveallowvendor.md b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdriveallowvendor.md new file mode 100644 index 0000000000..27eec4f50f --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/gettingstarted/usbdriveallowvendor.md @@ -0,0 +1,56 @@ +--- +title: "Authorize USB Sticks by VENDOR type" +description: "Authorize USB Sticks by VENDOR type" +sidebar_position: 30 +--- +# Authorize USB Sticks by VENDOR type + +If you have a specific USB device vendor you trust, and those devices are always encrypted, use +Netwrix Endpoint Policy Manager (formerly PolicyPak) Device Manager to restrict device use to THOSE +vendor IDs only! + + + +In our first video, we put the smackdown on all evil CD-ROMs and USB sticks. Then we opened it up +for one trusted user to either just read or maybe full access if we really trust them. The thing, +however, is that that's great for when they're doing good things with the USB sticks that you give +them. However, if they fall off the wagon and they put in a naughty USB stick, like this one, the +one I found in the parking lot – remember, you said that it's okay for them to do whatever they want +on all USB sticks, and that's a problem because that could've been malware. What are we going to do? +There's two ways to handle this problem. + +What I'm going to do first is I'm going to just take away this rule just to make it less confusing. +Then let's run gpupdate and put in the evil USB stick again and see what happens. We'll just give +this a second to catch up. Alright, so we'll start off by putting the evil one in, and what do we +get? We get no access. If we put in the good USB stick, what do we get? We get no access, but maybe +we know that the USB sticks that we provide for the customer by a particular vendor, okay, by +JetFlash Transcend_32GB, maybe we know that these are always encrypted, and if they're always +encrypted, then they could be sanctioned, so let's go ahead and create a new rule. We'll leave this +up for a second. + +We'll just right-click Add a New Policy here. We want to allow users to use specific devices, and +this is – comes with the standard edition. You can plug in the Vendor and the Product ID and the +Product Revision, and if it's on your sanctioned list, you can let users do it. Let's go ahead and +do that. We'll take the Vendor ID, which is JetFlash, paste that guy in here. We'll take the Product +ID, which is this Transcend_32GB – go ahead and copy that guy in. Then when it comes to the Product +Revision, sometimes items will have a revision number, sometimes they won't. You can decide if you +want to use it or not. We let you put a \* there, which says JetFlash Transcend_32GB with any +Product Revision is good to go. Alright? + +Let's go ahead and say this particular user, EastSalesUser1 or group, we want to give them access, +Full Access could be fine if you know that it's – that the vendor that you're providing is always +encrypted, so let's go ahead and do that, Full Access here. Go ahead and click Next and click +Finish. Now we're saying let EastSalesUser1 use the USB sticks we provide because we know that they +are always going to be okay. Let's go ahead and run – go back over here to – I'll unplug it just to +– just for fun. I'll go ahead and click gpupdate, give this a second to catch up. Now that that's +done, we'll go ahead and re-plug in our good USB stick here, the one that's always encrypted, and we +don't get any pop-up or anything because it is, in fact, allowed. Now we can see our encrypted USB +stick enables us to do what we said. In this case, we said Full Access. + +The only downside to this is that if somebody picks up a USB stick that maybe they shouldn't, like +once again picking up the evil USB stick and putting it in, the one I found in the parking lot, if +it is in fact exactly the same version that you've sanctioned, that's going to let them do things +that maybe you don't want to do, like read from the device or to run stuff that maybe they shouldn't +be running. If that is super important to you, and I can see where it would be, you can dictate that +particular USB sticks are allowed and controlled because of serial number. Go ahead and take a look +at that video. That's the next one on the list. Thanks so much. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/methods/_category_.json b/docs/endpointpolicymanager/device-manager/video-learning-center/methods/_category_.json new file mode 100644 index 0000000000..7d17261bb8 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/methods/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Methods Cloud MDM And SCCM", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/methods/cloud.md b/docs/endpointpolicymanager/device-manager/video-learning-center/methods/cloud.md new file mode 100644 index 0000000000..a4d24b3e08 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/methods/cloud.md @@ -0,0 +1,74 @@ +--- +title: "Block USB sticks using Endpoint Policy Manager Cloud" +description: "Block USB sticks using Endpoint Policy Manager Cloud" +sidebar_position: 10 +--- +# Block USB sticks using Endpoint Policy Manager Cloud + +Got Endpoint Policy Manager Cloud... and naughty users with USB sticks? See how to take your +policies and get them working with Endpoint Policy Manager Cloud ! + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can use Endpoint +Policy Manager Device Manager and Endpoint Policy Manager Cloud together. First things first, you're +going to want to go over to your machine that has the correct USB stick style that you want to +approve, and you're going to go to Device Manager, and here under the disk drives, you're going to +then go to Properties and look for the details of device instance path. That's the magic formula +here. Go ahead and copy that item, and then bring it over to your management station. Now here, we +don't have a way for you to create new policies in Cloud for Device Manager. Not a problem. That +will be coming soon. For now, what you'll do is take that item here, go over to that item here, and +you'll paste in the string you just got from Device Manager. If you look, you'll see that there's +Vendor, which shows JetFlash, and the product ID which is Transend 32GB. If you wanted to sanction +this device type which is always encrypted or has some other kind of thing that you want, to your +people, that's great. You'll just copy the JetFlash after the word Vendor, and after the PROD\_ +you'll capture the ID of the device type. This is also the serial number that's embedded in here as +well. You could use that too. What we'll do is we'll go over to our management station here, and you +should do some small-scale tests on-prem to make sure that this works the way you expect. We'll go +to Device Manager, right-click Add a New Global Settings Policy, have to have one of those, which +turns it all on and sets some of the defaults including the default messaging and so on. + +Then the next thing we're going to do is add a new policy type. Now the one that I want to show +here, just for example – they all work but the one I just want to show for example is Let Users Use +Specific Devices, and the vendor ID I want to use here is JetFlash. Let's just go ahead and pick +that guy. The product ID, like I said, is this Transcend 32GB guy. Go ahead and pick that, and we'll +pick Product Rev star here. Then I want to add in either a domain member if you're using Endpoint +Policy Manager Cloud with domain-joined, which is unusual. You can add a local member if you know +the exact name, or you can also match by SID. I actually like by SID because I find it to be +incredibly reliable. If I were to go here and do whoami/all for this standard user, there is the +SID. You could do it either that way – and we'll go ahead and do a standard user. That part doesn't +really matter. The SID is what's matching here. We're going to say let this particular user have +read-only access to the device that I say is sanctioned by the IT team. + +Now that we've got the policy ready to go here – again, I humbly suggest that you do some small +scale on-prem testing first, but I'm going to go right for broke and do an export. What you do then +is you right-click over the root node here which contains all the policies, and then View as XML in +Notepad. This gives you what you need to do to then copy it here. We'll go over to Endpoint Policy +Manager Cloud over here. I'm going to go to the all group. You'll probably, again, do some +small-scale testing with a company group. I'm going to create and link a new policy here. Nope, I'm +going to upload and link a new policy here. I'm then going to paste this in, and I'll call this +Device Manager, Specific Users for Sanctioned Devices. Now that I've got those two policies jammed +in there, I can go ahead and click on it here, and I can show the policy settings here. You can see +that it does have the items that I put here. + +Now if I were to go over to my target machine here and run ppcloud/sync – well, the device in there +is sanctioned right now, so you can see there's the Device Manager, Specific Users for Sanctioned +Devices, so I got the policy as expected. I shouldn't see any change here. That totally makes sense. +What I'm going to do is I'm going to unplug the good USB stick, and I'm going to plug in an unknown +or naughty USB stick. Boom, there we go. We can see this does not meet the criteria, different +vendor, different everything, so I get the description of what's going on here. Let's go ahead and +go over to that drive and see what's what there. + +If I were to go to my removable disk here, I can see I've got all sorts of weird stuff here. I don't +know what it is, but I shouldn't be able to copy stuff in. Yup, that doesn't work if I try to do +that, Skip. It's not actually copying the file. It's just trying to copy the file. We're going to +try to take this and copy it over here. Well, I'm not allowed to do that either. We get a USB stick +you find in the parking lot with some weird stuff on it, that's not going to work. Only the devices +that you sanction, the good stuff, is sanctioned, and we said it was good for that user. Let's go +ahead and put in the good USB stick again. The good USB stick is now put in. If we go back to the +IT-encrypted sanctioned USB stick and we try to read a PDF file from here, well that is approved. +We've allowed that, but naughty USB sticks are blocked, and there you go. + +If you want to become a better security admin with Endpoint Policy Manager, hope this video helps +you out. Looking forward to getting you started with Endpoint Policy Manager Cloud and Endpoint +Policy Manager Device Manager real soon. Thanks. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/methods/mdm.md b/docs/endpointpolicymanager/device-manager/video-learning-center/methods/mdm.md new file mode 100644 index 0000000000..ca4dcb9a49 --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/methods/mdm.md @@ -0,0 +1,130 @@ +--- +title: "Block and Allow USB and CD-ROMs with your MDM solution" +description: "Block and Allow USB and CD-ROMs with your MDM solution" +sidebar_position: 20 +--- +# Block and Allow USB and CD-ROMs with your MDM solution + +Got Intune or another MDM service, and users plugging in USB sticks... walking out the door with +data, or worse, introducing malware? Specify exactly WHO can use WHAT USB sticks ... so you don't +have to fight fires everywhere around data and ransomware. + + + +Hi, this is Jeremy Moskowitz. In this video, I'm going to show you how you can use Netwrix Endpoint +Policy Manager (formerly PolicyPak) Device Manager to enable and restrict USB sticks using your MDM +service and Endpoint Policy Manager. How do you do that? This machine is MDM enrolled. You could be +enrolled into Intune or into Workspace ONE or to Citrix, whatever you want. + +This is a good USB stick, one that I am sanctioning and allowing. For instance, maybe you want the +style that Endpoint Policy Manager can deliver, which is enable specific users to use specifically +sanctioned device types. For instance, if this device was always encrypted, you can sanction this +device type. You could say a particular user with a particular device and serial number. I've shown +that in previous videos. This is particularly just how to use it with MDM. + +First things first is that you may want to get that USB stick in hand, and then you can see in +Device Manager if you were to go to Properties here, what you'll do is you'll go to details and go +to the device instance path. Device instance path has the vendor and the particular model and also +the serial number embedded into it. What we'll do is we'll copy this. Let's go over to our MMC +management station. This is my Azure and my Intune, which I'll get to in just a moment. + +Here is where I'm going to take that string and paste it in. Here's where I need the vendor ID, +that's after the VEN*. I need that guy. Then I need the product ID, which is after PROD*. I'll go +ahead and take that right there. There's the revision also. I'm not going to worry about that. I'm +going to say any revision because I know that this particular USB stick is always encrypted. + +What I'll do is then I'll go into my management station here. Using a group policy object just for +the sake of editing purposes, let me go ahead and create a new global settings policy here. I like +raising the number of impressions for bad USB sticks, so I'm going to raise that up pretty high. +Then I'm going to leave the rest the same, show notifications for new devices and policy changes and +so on. + +If you want to change the default messages with customized messages, you can do that too. I'm not +going to worry about that now. That's the first thing, just turning it on. That puts the smack down +on all USB sticks. + +Then I'm going to set a policy to open it up to something specific. I want to allow users to use +specific devices. What am I going to do? I'm going to take that vendor ID that I got earlier; that's +JETFLASH. I'll go ahead and copy and paste that in. + +The product ID that we got earlier, that's TRANSCEND_32GB, this always encrypted drive by way of +example. Then I'm going to keep the product revision just like this. If you wanted to also use +serial numbers, that's fine. You would paste that entire string in. I'm not going to demo that here. + +Then here is where you need to add a member by SID. How do you get the SID of a guy in Azure Active +Directory? Well, we have an article on that. For instance, here is the article, which is called _How +Do I Get Azure SIDs and Use Them with Item Level Targeting?_ This only works for individual users. +This will not work at a group level. + +There is no such thing as an Azure group SID. There is such a thing as an Azure user SID, and you +have to be able to get it. The easiest way to do it is to be logged onto the guy and get whoami/user +and you can get that information. You can also do some additional magic, if you want to, with this +PowerShell script, which can take an Azure ID and convert it over. The PowerShell is in there +somewhere. That's an advanced technique. + +What I'm going to do is just do the simple one here and go to whoami/all, get the guy's SID here. +I'm going to take this SID from Azure. Whoops, I didn't get it. Do it again. Get it from Azure. +There we go. + +Then what I'm going to do is go back to my item here, add member by SID. The name doesn't matter. +You can call them Fred Flintstone. It doesn't matter. Then that's the guy's SID. That's what +matters. + +What I'm going to say is let this person have read access. Once I go ahead and click OK here, click +Next, and that's it. We're done. We've done what we need to do. + +The next thing is to right-click export this policy as XML here. I'm going to export collections as +XML. I'm then going to create a new folder here called EXP3. I'll call this PPDM-EXPORT1. Now that +I've got it exported, the next step is to use our Endpoint Policy Manager exporter tool. + +The exporter tool is automatically installed when you install the MMC snap-in. Let's go ahead and +create a new MSI installer. We'll add an existing file here. We'll then pick our EXP3, our exporter. +There it is, device manager on the computer side. + +It's got all the things we said, the global policy and the unique individual policy there as well. +We'll go ahead and call this PPDM123. We are done. I'll go ahead and call it PPDM123MSI. + +Now that that's done, let's go into Intune. Now remember, in order to make this go, there's three +things that need to happen. The license files need to be delivered, the client-side extension needs +to be delivered, and now what we're going to do is we're going to add in this application, which is +a line of business app. We'll go ahead and click Select here. Select our app package file from the +desktop that we created earlier. That's on desktop EXP3. There's our MSI. + +This is on the device side, very good. Go ahead and click Next. We need to give it a name. We'll +call this PP Company1. Any other things we need to do? No. + +Now what we'll do is we're going to add this to – I'm just going to keep this simple and add it to +all devices. You can target it based upon device group. That's totally fine. Go ahead and click Next +and go ahead and click Create. + +I've locked and loaded this in. If I go back to apps, remember the three things that need to make it +go. Let me go back to Windows apps here. The three things that need to make it go are the license +file, the client-side extension, and the final upload, here we are, of our settings. That's +automatically getting refreshed as we speak. + +With that in mind, we'll go back over to our machine. We'll go ahead and click here, and we'll go to +info. Let's give this the little synchronize that we need to make this work. Now that this is done, +remember, this can take a variable amount of time, depending on how fast or slow your MDM service +wants to go. Let's go ahead and close all this out. + +I'm going to take out the good USB stick. Let's put in an evil USB stick and see what happens. There +we go. It's being managed by Endpoint Policy Manager Device Manager. Read, write, and execute, no. +Why is that? It's different than what we said. This person can't do a thing. + +If we were to go over here and take a look what's on this interesting USB stick, we don't know. +There's all sorts of weird stuff on here. Let's double-click it and see what happens. You can't do +that. + +Let's try to copy this configuration file over to the desktop. No, we can't do that. If we were to +try to copy something in, we can't do that. We've blocked it. We've blocked that USB stick. + +Let's go ahead and put in the good USB stick, the one that meets the correct vendor criteria. There +we go. We can see that we are being managed. We've got read access, which is exactly what we said we +wanted. If we were to try to read something off of here, we'll go ahead and double-click this guy. +What happens? You've got read access, so you're good to go. + +If you try to write something from the desktop over to this USB stick, you've blocked it. This is +not something that you can do inside of Intune or other MDM services. This is an add-on superpower +only available to you with Endpoint Policy Manager. There you go. I hope this helps you out. Looking +forward to getting you started with Endpoint Policy Manager and your MDM service real soon. Thanks +so much. diff --git a/docs/endpointpolicymanager/device-manager/video-learning-center/videolearningcenter.md b/docs/endpointpolicymanager/device-manager/video-learning-center/videolearningcenter.md new file mode 100644 index 0000000000..a37c5aabae --- /dev/null +++ b/docs/endpointpolicymanager/device-manager/video-learning-center/videolearningcenter.md @@ -0,0 +1,25 @@ +--- +title: "Video Learning Center" +description: "Video Learning Center" +sidebar_position: 20 +--- + +# Video Learning Center + +See the following Video topics for Device Manager. + +## Getting Started + +- [Instantly Put the smackdown on USB sticks and CD-ROMs](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/usbdrive.md) +- [Allow ONE user (or group) access to USB and/or CD-ROM and DVDs](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/usbdriveallowuser.md) +- [Authorize USB Sticks by VENDOR type](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/usbdriveallowvendor.md) +- [Permit specific devices by serial number](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/serialnumber.md) +- [Restrict access only to Bitlocker drives](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/bitlockerdrives.md) +- [Endpoint Policy Device Manager and End-User Emails to Support](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/enduser.md) +- [Device Manager Helper Tool](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/dmhelpertool.md) +- [Device Manager Admin Approval and Automatic Rules Creation](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/gettingstarted/dmapprovalautorules.md) + +## Methods: Cloud, MDM and SCCM + +- [Block USB sticks using Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/methods/cloud.md) +- [Block and Allow USB and CD-ROMs with your MDM solution](/docs/endpointpolicymanager/knowledgebase/devicemanager/videolearningcenter/methods/mdm.md) diff --git a/docs/endpointpolicymanager/file-associations-manager/_category_.json b/docs/endpointpolicymanager/file-associations-manager/_category_.json new file mode 100644 index 0000000000..9c18a48832 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "File Associations Manager", + "position": 40 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/_category_.json b/docs/endpointpolicymanager/file-associations-manager/manual/_category_.json new file mode 100644 index 0000000000..14e8309762 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Manual", + "position": 10 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/applymode.md b/docs/endpointpolicymanager/file-associations-manager/manual/applymode.md new file mode 100644 index 0000000000..173a193327 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/applymode.md @@ -0,0 +1,42 @@ +--- +title: "Apply Mode or \"Apply Once and Drift\"" +description: "Apply Mode or \"Apply Once and Drift\"" +sidebar_position: 60 +--- + +# Apply Mode or "Apply Once and Drift" + +You can also create policies that will enforce a given file association one time so that users can +then drift from your configuration and choose their own application. + +:::note +For a video on applying policies only once, see +[Endpoint Policy Manager File Associations Manager: Apply once (and drift)](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/applyonce.md). +::: + + +Let's create a file association policy on the User side so that Adobe Acrobat Reader is the assigned +application for all its associated files. + +![about_policypak_file_associations_27](assets/about_endpointpolicymanager_file_associations_27.webp) + +Notice that you get a popup message alerting you that user-side file and protocol associations are +ignored on Endpoint Policy Manager CSE versions older than 20.2.2361. + +![about_policypak_file_associations_28](assets/about_endpointpolicymanager_file_associations_28.webp) + +You can then choose all of the possible file types for Adobe Acrobat Reader. + +![about_policypak_file_associations_29](assets/about_endpointpolicymanager_file_associations_29.webp) + +Next choose the **Apply once (for policies)** option. + +![about_policypak_file_associations_30](assets/about_endpointpolicymanager_file_associations_30.webp) + +Once the policy has been enforced one time, users can then drift away from the deployed +configuration to make their own choices. + +You can use this Apply once and drift approach for a single policy as well. Simply go to **Add** > +**New Policy** and click the **Apply** drop down menu and select **Once**. + +![about_policypak_file_associations_31](assets/about_endpointpolicymanager_file_associations_31.webp) diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/660_1_faq4-img1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/660_1_faq4-img1.webp new file mode 100644 index 0000000000..a720898fcc Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/660_1_faq4-img1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations.webp new file mode 100644 index 0000000000..8d2dd10597 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_1.webp new file mode 100644 index 0000000000..5f86984874 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_10.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_10.webp new file mode 100644 index 0000000000..453bd79ba8 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_10.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_11.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_11.webp new file mode 100644 index 0000000000..628dbf29d4 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_11.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_12.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_12.webp new file mode 100644 index 0000000000..5dd645ba3c Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_12.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_13.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_13.webp new file mode 100644 index 0000000000..5018d26c46 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_13.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_14.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_14.webp new file mode 100644 index 0000000000..4d2b2b1dce Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_14.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_15.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_15.webp new file mode 100644 index 0000000000..c7cca8355b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_15.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_16.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_16.webp new file mode 100644 index 0000000000..bc5ff419e5 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_16.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_17.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_17.webp new file mode 100644 index 0000000000..2be0c51d78 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_17.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_18.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_18.webp new file mode 100644 index 0000000000..b549b11afe Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_18.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_19.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_19.webp new file mode 100644 index 0000000000..a84e07d6b2 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_19.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_2.webp new file mode 100644 index 0000000000..e2ac54b05d Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_20.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_20.webp new file mode 100644 index 0000000000..e8ebce7090 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_20.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_21.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_21.webp new file mode 100644 index 0000000000..f06f120a32 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_21.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_22.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_22.webp new file mode 100644 index 0000000000..88d963ef46 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_22.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_23.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_23.webp new file mode 100644 index 0000000000..5169074a9c Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_23.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_24.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_24.webp new file mode 100644 index 0000000000..2cbc8ef1ff Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_24.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_25.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_25.webp new file mode 100644 index 0000000000..e5fb2423a2 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_25.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_26.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_26.webp new file mode 100644 index 0000000000..9481333a35 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_26.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_27.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_27.webp new file mode 100644 index 0000000000..d4c18bd0d3 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_27.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_28.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_28.webp new file mode 100644 index 0000000000..0c70b99613 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_28.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_29.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_29.webp new file mode 100644 index 0000000000..cb40d3bb83 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_29.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_3.webp new file mode 100644 index 0000000000..fe6a0f6f05 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_30.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_30.webp new file mode 100644 index 0000000000..807280f19f Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_30.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_31.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_31.webp new file mode 100644 index 0000000000..94299b71d1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_31.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_4.webp new file mode 100644 index 0000000000..421944822b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_5.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_5.webp new file mode 100644 index 0000000000..9beec50621 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_5.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_6.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_6.webp new file mode 100644 index 0000000000..d3a97c7e0c Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_6.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_7.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_7.webp new file mode 100644 index 0000000000..02e2d029b4 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_7.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_8.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_8.webp new file mode 100644 index 0000000000..bbe7bf18f7 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_8.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_9.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_9.webp new file mode 100644 index 0000000000..35021f76a4 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/about_endpointpolicymanager_file_associations_9.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_10.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_10.webp new file mode 100644 index 0000000000..453bd79ba8 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_10.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_4.webp new file mode 100644 index 0000000000..421944822b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_5.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_5.webp new file mode 100644 index 0000000000..9beec50621 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_5.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_6.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_6.webp new file mode 100644 index 0000000000..d3a97c7e0c Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_6.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_7.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_7.webp new file mode 100644 index 0000000000..02e2d029b4 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_7.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_8.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_8.webp new file mode 100644 index 0000000000..bbe7bf18f7 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_8.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_9.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_9.webp new file mode 100644 index 0000000000..35021f76a4 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/about_endpointpolicymanager_file_associations_9.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections.webp new file mode 100644 index 0000000000..8dfe737269 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_1.webp new file mode 100644 index 0000000000..ccb74db736 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_2.webp new file mode 100644 index 0000000000..7fb7cfffb1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_3.webp new file mode 100644 index 0000000000..0218226738 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_4.webp new file mode 100644 index 0000000000..efa55cb537 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_5.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_5.webp new file mode 100644 index 0000000000..1bd3ad4819 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/collections/using_preconfigured_collections_5.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations.webp new file mode 100644 index 0000000000..8d2dd10597 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_1.webp new file mode 100644 index 0000000000..5f86984874 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_2.webp new file mode 100644 index 0000000000..e2ac54b05d Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_3.webp new file mode 100644 index 0000000000..fe6a0f6f05 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/insouts/about_endpointpolicymanager_file_associations_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting.webp new file mode 100644 index 0000000000..5edf10673b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_1.webp new file mode 100644 index 0000000000..7a125f3bdd Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_10.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_10.webp new file mode 100644 index 0000000000..e742bbb1c1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_10.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_2.webp new file mode 100644 index 0000000000..329b19f8f9 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_3.webp new file mode 100644 index 0000000000..b68ce6a55d Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_4.webp new file mode 100644 index 0000000000..afb536530a Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_5.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_5.webp new file mode 100644 index 0000000000..c2392e5502 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_5.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_6.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_6.webp new file mode 100644 index 0000000000..375dc4d83e Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_6.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_7.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_7.webp new file mode 100644 index 0000000000..7a2049f812 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_7.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_8.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_8.webp new file mode 100644 index 0000000000..923b60bd72 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_8.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_9.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_9.webp new file mode 100644 index 0000000000..f227e3f974 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/itemleveltargeting/using_item_level_targeting_9.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting.webp new file mode 100644 index 0000000000..4660e522e7 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting_1.webp new file mode 100644 index 0000000000..92c9168427 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting_2.webp new file mode 100644 index 0000000000..986335b5d1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/troubleshooting_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting.webp new file mode 100644 index 0000000000..5edf10673b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_1.webp new file mode 100644 index 0000000000..7a125f3bdd Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_10.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_10.webp new file mode 100644 index 0000000000..e742bbb1c1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_10.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_2.webp new file mode 100644 index 0000000000..329b19f8f9 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_3.webp new file mode 100644 index 0000000000..b68ce6a55d Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_4.webp new file mode 100644 index 0000000000..afb536530a Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_5.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_5.webp new file mode 100644 index 0000000000..c2392e5502 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_5.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_6.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_6.webp new file mode 100644 index 0000000000..375dc4d83e Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_6.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_7.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_7.webp new file mode 100644 index 0000000000..7a2049f812 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_7.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_8.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_8.webp new file mode 100644 index 0000000000..923b60bd72 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_8.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_9.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_9.webp new file mode 100644 index 0000000000..f227e3f974 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_item_level_targeting_9.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections.webp new file mode 100644 index 0000000000..8dfe737269 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_1.webp new file mode 100644 index 0000000000..ccb74db736 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_2.webp new file mode 100644 index 0000000000..7fb7cfffb1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_3.webp new file mode 100644 index 0000000000..0218226738 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_4.webp new file mode 100644 index 0000000000..efa55cb537 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_5.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_5.webp new file mode 100644 index 0000000000..1bd3ad4819 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_preconfigured_collections_5.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility.webp new file mode 100644 index 0000000000..d9b9a14420 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_1.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_1.webp new file mode 100644 index 0000000000..d0e220e8d3 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_2.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_2.webp new file mode 100644 index 0000000000..486bd29612 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_3.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_3.webp new file mode 100644 index 0000000000..b5d7c60524 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_4.webp b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_4.webp new file mode 100644 index 0000000000..9e3d7c4121 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/manual/assets/using_the_helper_utility_4.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/_category_.json b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/_category_.json new file mode 100644 index 0000000000..590917c135 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Troubleshooting", + "position": 100, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/logs.md b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/logs.md new file mode 100644 index 0000000000..a4366bf000 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/logs.md @@ -0,0 +1,48 @@ +--- +title: "Logging Locations" +description: "Logging Locations" +sidebar_position: 20 +--- + +# Logging Locations + +Endpoint Policy Manager File Associations Manager log files are found in +`%Programdata%\PolicyPak\PolicyPak File Associations Manager.` This is because Endpoint Policy +Manager File Associations Manager affects the computer (and all users on that computer). It's also +possible there might be some user-side logins in +`%appdata%\local\PolicyPak\PolicyPak File Associations Manager`, but they will not be useful since +all Endpoint Policy Manager File Associations Manager work happens on the Computer side. + +There are several files to check in the folder +`%Programdata%\PolicyPak\PolicyPak File Associations Manager.` These files are: + +- `ppUser_OnLogon.log`: This log file is updated when Group Policy applies at the time of login (and + items are set for the User side, not the Computer side). +- `ppUser_Switched.log`: This log file is updated when Group Policy applies at the time of login + (and items are set for the Computer side). +- `ppUser_OnGroupPolicy.log`: This log file is updated when Group Policy applies in the background + (when you run GPupdate or Group Policy applies in the background). +- `ppUser_onPolicyChanged.log`: This log file is updated when Group Policy applies in the background + or when a method other than the Group Policy method is used (e.g., Microsoft Endpoint Manager + [SCCM and Intune] and Endpoint Policy Manager Cloud). + +Start troubleshooting by verifying that the following conditions are true: + +- You have the Group Policy Object (GPO) (or file). +- You have a collection within the GPO. +- You have the rules within the collection. + +Figure 55 and Figure 56 are examples of Endpoint Policy Manager File Associations Manager logs with +some important items highlighted. + +![troubleshooting_1](../assets/troubleshooting_1.webp) + +Figure 55. An example of a Endpoint Policy Manager File Associations Manager log. + +![troubleshooting_2](../assets/troubleshooting_2.webp) + +Figure 56. Highlights from the Endpoint Policy Manager File Associations Manager log. + +If needed, logs can be automatically wrapped up and sent to +[support@endpointpolicymanager.com](mailto:support@endpointpolicymanager.com) with the `PPLOGS.EXE` command on any endpoint +where the client-side extension is installed. \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/overview.md b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/overview.md new file mode 100644 index 0000000000..23789dd918 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/overview.md @@ -0,0 +1,19 @@ +--- +title: "Troubleshooting" +description: "Troubleshooting" +sidebar_position: 100 +--- + +# Troubleshooting + +The most common problem users encounter with Netwrix Endpoint Policy Manager (formerly PolicyPak) +File Associations Manager occurs during initial use when trying to make associations. Here are some +tips when trying to troubleshoot Endpoint Policy Manager File Associations Manager: + +- Do not try to use Microsoft's method and Endpoint Policy Manager's method for managing file + associations on the same Windows 10 endpoints. Only one method will win. +- If deploying policies on the computer side, then Endpoint Policy Manager File Associations Manager + will attempt to map file associations if any user has the registered application you specify (not + only the logged-on user at the moment)>.This is a risk if the program exists at all on the + endpoint, but the user logging on at that moment (say on a Terminal Server/RDS machine) doesn't + have access to that application. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/xmlfile.md b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/xmlfile.md new file mode 100644 index 0000000000..0a82e2be98 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/fileassociations/xmlfile.md @@ -0,0 +1,23 @@ +--- +title: "Inspecting the FileAssociations.XML File" +description: "Inspecting the FileAssociations.XML File" +sidebar_position: 10 +--- + +# Inspecting the FileAssociations.XML File + +Endpoint Policy Manager File Associations Manager will dynamically write the file that Windows needs +to make the file associations. This file is called FileAssociations.XML, and there will be one file +per computer located in `%programdata%\PolicyPak\Common`, as seen in Figure 54. + +![troubleshooting](../assets/troubleshooting.webp) + +Figure 54. FileAssocations.xml shows the actions taken by Endpoint Policy Manager File Associations +Manager. + +A good first troubleshooting step would be to see what the file contains. When you look inside the +FileAssociations.XML file, you can see which file extensions are mapped to which applications by +PolicyPak File Associations Manager. If you are expecting an application extension to launch an +application, but it does not, first check this file to see if what you expected is here or not. If +the association is absent, then the target computer most likely did not get the policy to make the +association. Fixing that should be your next step. \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/helperutility.md b/docs/endpointpolicymanager/file-associations-manager/manual/helperutility.md new file mode 100644 index 0000000000..b4a2f8fe2d --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/helperutility.md @@ -0,0 +1,59 @@ +--- +title: "Using the Helper Utility" +description: "Using the Helper Utility" +sidebar_position: 90 +--- + +# Using the Helper Utility + +In the Netwrix Endpoint Policy Manager (formerly PolicyPak) File Associations Manager Quickstart +examples, we recommended that your management station have the same applications as your target +computers. However, that is not always practical. There are likely instances where you do not want +to install an application on your machine just for the sake of making a File Association. For +instance, someone in the Sales department may be the only one who has "Sales Application 123" +installed. + +That's where the Endpoint Policy Manager File Associations Manager Helper utility comes in. Run the +Endpoint Policy Manager File Associations Manager Helper on an example endpoint with the application +already installed and to which you want to make a policy association with later. + +:::note +For a video overview demonstrating how to use the Endpoint Policy Manager File +Associations Manager Helper utility, watch this video: +[Endpoint Policy Manager File Associations Manager: Helper Application](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helperapplication.md). +::: + + +The Endpoint Policy Manager File Associations Manager Helper is found in the Endpoint Policy Manager +ISO or ZIP download in the Endpoint Policy Manager Extras folder. + +![using_the_helper_utility](assets/using_the_helper_utility.webp) + +Follow these steps to setup the Endpoint Policy ManagerPolicyPak File Associations Manager Helper +utility: + +**Step 1 –** Launch the 11,000 kB EXE. When you do, the Endpoint Policy Manager File Associations +Manager Export wizard appears. + +![using_the_helper_utility_1](assets/using_the_helper_utility_1.webp) + +**Step 2 –** Find a particular file association that already exists on the machine, such as 3mf, and +the application it is already associated with. The application must be registered in order to see it +in the list. + +![using_the_helper_utility_2](assets/using_the_helper_utility_2.webp) + +**Step 3 –** Select **Include icons in the file (Can dramatically increase file size)**. This +setting is recommended even though the XML might be bigger. You must also choose to **Show file in +folder after finished** and **Open XML in Notepad when save is complete** for examination. + +![using_the_helper_utility_3](assets/using_the_helper_utility_3.webp) + +**Step 4 –** Take the exported file and import it into a Endpoint Policy Manager File Associations +Manager Group Policy Object (GPO). Note that the option to import from an XML is available when you +create a new entry and click **Select Program**. + +![using_the_helper_utility_4](assets/using_the_helper_utility_4.webp) + +To import the exported file into a Endpoint Policy Manager File Associations Manager GPO, pull up +the Select Program Association window, and then click on **From XML file** under Import. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/insouts/_category_.json b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/_category_.json new file mode 100644 index 0000000000..cd9b53d08f --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Ins and Outs", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/insouts/advantages.md b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/advantages.md new file mode 100644 index 0000000000..ae12020109 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/advantages.md @@ -0,0 +1,53 @@ +--- +title: "Advantages of Using File Associations Manager" +description: "Advantages of Using File Associations Manager" +sidebar_position: 30 +--- + +# Advantages of Using File Associations Manager + +With Endpoint Policy Manager File Associations Manager, you don't have to build the perfect +workstation and then export all the file associations at one time, making sure to get it all correct +the first time, or rebuilding the perfect workstation over and over again. Additionally, if your +organization makes a change, for example, to 7-Zip instead of WinZip, and wants to quickly change +your .zip associations, you don't have to rebuild your perfect workstation and repeat the process +over and over. + +With Endpoint Policy Manager File Associations Manager, you only need to: + +- deploy your application as you normally would, using Microsoft Endpoint Manager (SCCM and Intune) + or PDQ Deploy, and +- use Endpoint Policy Manager File Associations Manager to make the association between the + extension the application. + +In addition, it is very easy to have different associations for each computer group by making simple +policies for your associations using Endpoint Policy Manager File Associations Manager. Because +Group Policy creation is distributed (that is, different people can create different GPOs), you can +leverage Endpoint Policy Manager File Associations Manager when different people have different +needs. In the case of a conflict of two associations, the rules of Group Policy precedence will take +effect. + +Endpoint Policy Manager File Associations Manager uses the same basic method and policy settings +that the in-box Microsoft method uses. That is, Endpoint Policy Manager File Associations Manager +will create its own associations XML file (one per computer). It works with Microsoft's method +(using the XML file and corresponding Group Policy setting), but adds functionality. + +However, both methods have some known limitations. First, after the associations are set, users can +still work around these methods and try to associate different applications to file extensions. +However, those user-created associations will be wiped out the next time they log on and the policy +is applied again. Next, both methods only take effect when the Group Policy is set on the computer +and the user is required to log off and then log on again. Additionally, both methods only work when +the machine is domain-joined. So even though Endpoint Policy Manager MDM and Endpoint Policy Manager +Cloud can deliver a wide variety of settings to non-domain-joined machines, neither the in-box +Microsoft method, nor Endpoint Policy Manager File Associations Manager, can configure machines +unless the machine is domain-joined. Finally, both methods will not affect a user logging onto the +computer the first time. The policy will take effect on the second login after the computer gets the +Group Policy update. + +:::note +For a video demonstrating how neither Endpoint Policy Manager File Associations Manager +nor Microsoft's method can affect a user until the second login, see the +[Endpoint Policy Manager File Associations Manager: Understanding the First Login](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/firstlogin.md) +topic for additional information.. + +::: diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/insouts/overview.md b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/overview.md new file mode 100644 index 0000000000..c9f9302857 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/overview.md @@ -0,0 +1,13 @@ +--- +title: "Ins and Outs" +description: "Ins and Outs" +sidebar_position: 10 +--- + +# Ins and Outs + +Endpoint Policy Manager File Associations Manager solves several important Windows 10 issues, but +the basic goal is to map a file extension, like .pdf, to an application, like Adobe Acrobat Reader. +This sounds easy to do, but it is actually very difficult. In this section, we'll examine the +history around file associations, explain Microsoft's way to perform file associations, and explain +how Endpoint Policy Manager File Associations Manager works and what its limitations are. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/insouts/windows10.md b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/windows10.md new file mode 100644 index 0000000000..7f5e2dcf38 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/windows10.md @@ -0,0 +1,65 @@ +--- +title: "Managing Windows 10 File Associations with the In-Box Method" +description: "Managing Windows 10 File Associations with the In-Box Method" +sidebar_position: 20 +--- + +# Managing Windows 10 File Associations with the In-Box Method + +If you didn't have Endpoint Policy Manager File Associations Manager, you could still manage +file associations on Windows 10 and later. However, the process can be difficult and is not +particularly user-friendly. + +:::note +The following steps outline what you could do without Endpoint Policy Manager File +Associations Manager. Do not perform these steps with Endpoint Policy Manager File Associations +Manager because this will result in conflicts. +::: + + +The following is the Microsoft-sanctioned way to establish file associations for Windows 8.1 and +Windows 10: + +**Step 1 –** Create machine with all applications you might need. + +**Step 2 –** Correctly set all of the file associations. + +**Step 3 –** Use the built-in command `DISM` and export the associations to an XML file. The command +would be something like: + +``` +Dism /Online /Export-DefaultAppAssociations:\AppAssoc.xml +``` + +**Step 4 –** Use Group Policy to ensure that specific computers use this XML file. + +The exported file from this process might look something like this: + +![about_policypak_file_associations_2](../assets/about_endpointpolicymanager_file_associations_2.webp) + +**Step 5 –** Next, you would use the Group Policy setting called **Set a default associations +configuration file**. + +![about_policypak_file_associations_3](../assets/about_endpointpolicymanager_file_associations_3.webp) + +The disadvantages of using the in-box method for Windows 10 are as follows: + +- You need a perfectly set machine for each new application deployment +- You will likely need different exported XML files, one for each different machine or organization + type +- You might need to segment your computers into different organizational units (OUs) if you have + different associations +- You need to follow this process even if you have just one or two applications you want to map +- To get the best experience, you need to do this for all associations a user is ever going to click + on +- The entire XML file must be perfect and not have any variations + +In summary, + +- When your needs change, there is nothing dynamic about the process +- This process is entirely manual +- This process requires a lot of effort to build the perfect machine for each different computer + group, export the files one by one for each group, and ensure all computers get the correct file + +All this becomes time consuming every time you update and roll out an application that will be the +registered extension or protocol. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/insouts/windows7.md b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/windows7.md new file mode 100644 index 0000000000..2a416b34af --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/insouts/windows7.md @@ -0,0 +1,29 @@ +--- +title: "Managing Windows 7 File Associations with Group Policy Preferences" +description: "Managing Windows 7 File Associations with Group Policy Preferences" +sidebar_position: 10 +--- + +# Managing Windows 7 File Associations with Group Policy Preferences + +Several years ago, managing file associations with Group Policy used to be quite easy. Group Policy +Preferences had a specific item type that dynamically set which extensions would open in which +applications. This is still available within the Microsoft Group Policy Editor by going to **User +Configuration** > **Preferences** > **Control Panel Settings** > **Folder Options** > **New** > +**Open With**. + +![about_policypak_file_associations](../assets/about_endpointpolicymanager_file_associations.webp) + +This older method of setting file associations is still available in the Microsoft Group Policy +Editor on the User side with Windows 7 and 8. + +Next, select the file extension and the associated program. You can also choose to **Set as +Default**. + +![about_policypak_file_associations_1](../assets/about_endpointpolicymanager_file_associations_1.webp) + +This method worked well on Windows XP to Windows 8, but stopped working with Windows 8.1. + +Endpoint Policy Manager File Associations Manager fills in this gap. If you are already accustomed +to using Group Policy (with Group Policy Preferences) to manage file associations, then Endpoint +Policy Manager File Associations Manager will be a familiar way to perform that work. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/_category_.json b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/_category_.json new file mode 100644 index 0000000000..5423db039b --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Using Item-Level Targeting with Collections and Policies", + "position": 70, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/exportcollection.md b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/exportcollection.md new file mode 100644 index 0000000000..83f9e7a787 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/exportcollection.md @@ -0,0 +1,50 @@ +--- +title: "Exporting Collections" +description: "Exporting Collections" +sidebar_position: 20 +--- + +# Exporting Collections + +[Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md) explains how to use +the Endpoint Policy Manager Exporter to wrap up any Endpoint Policy Manager directives and deliver +them using Microsoft Endpoint Manager (SCCM and Intune), KACE, you own MDM service, or Endpoint +Policy Manager Cloud. However, we recommend NOT using Endpoint Policy Manager File Associations +Manager directives with Endpoint Policy Manager Cloud or an MDM service. This is because Endpoint +Policy Manager File Associations Manager directives cannot work with non-domain-joined machines. +Regardless, all Endpoint Policy Manager Cloud customers are licensed for Endpoint Policy Manager +File Associations Manager, so if you decide to use Endpoint Policy Manager Cloud with some +domain-joined machines, Endpoint Policy Manager File Associations Manager will function as expected +using Endpoint Policy Manager Cloud. + +![using_item_level_targeting_8](../assets/using_item_level_targeting_8.webp) + +:::note +For a video demonstrating the use of Endpoint Policy Manager Cloud with domain-joined +machines. See the +[Endpoint Policy Manager Cloud and Endpoint Policy Manager OnPremise – Together using PPCloud Licenses](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/usingwithothermethods/onpremise.md) +topic for additional information. +::: + + +To export a policy for later use with Endpoint Policy Manager Exporter or Endpoint Policy Manager +Cloud, right-click the collection or the policy, and select **Export to XML**. + +:::note +For a video showing how to export policies and how to use Endpoint Policy Manager +Exporter. See the +[Deploying Endpoint Policy Manager directives without Group Policy (Endpoint Policy Manager Exporter Utility)](/docs/endpointpolicymanager/knowledgebase/gettingstartedmdm/videolearningcenter/exportingtips/exporterutility.md) +topic for additional information. +::: + + +![using_item_level_targeting_9](../assets/using_item_level_targeting_9.webp) + +![using_item_level_targeting_10](../assets/using_item_level_targeting_10.webp) + +:::note +Exported collections or policies maintain any Item-Level Targeting set within them. If +you've used items that represent Group Membership in Active Directory, then those items will only +function when the machine is domain-joined. + +::: diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/overview.md b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/overview.md new file mode 100644 index 0000000000..1529e19e68 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/overview.md @@ -0,0 +1,80 @@ +--- +title: "Using Item-Level Targeting with Collections and Policies" +description: "Using Item-Level Targeting with Collections and Policies" +sidebar_position: 70 +--- + +# Using Item-Level Targeting with Collections and Policies + +Item-Level Targeting is used in Microsoft Group Policy Preferences and other areas of Netwrix +Endpoint Policy Manager (formerly PolicyPak) to target or filter where specific items will apply. +With Endpoint Policy Manager File Associations Manager, Item-Level Targeting can be used on +collections, as well as Endpoint Policy Manager File Associations Manager policies within +collections. + +A collection enables you to group together Endpoint Policy Manager File Associations Manager +policies so they can act together. For instance, you might want to create one collection that +targets only your East Sales computers, and another collection that targets your West Sales +computers. Or you might want to create a collection for Windows 10 machines and one for Windows +Server 2016 RDS. + +![using_item_level_targeting](../assets/using_item_level_targeting.webp) + +![using_item_level_targeting_1](../assets/using_item_level_targeting_1.webp) + +Below you can see the two collections that we have created that can hold other collections or +policies. It also shows how you can apply Item-Level Targeting for a collection. + +![using_item_level_targeting_2](../assets/using_item_level_targeting_2.webp) + +To change the Item-Level Targeting, right-click any Endpoint Policy Manager File Associations +Manager policy, and select **Edit Item Level Targeting**. + +![using_item_level_targeting_3](../assets/using_item_level_targeting_3.webp) + +The Edit Item Level Targeting menu item brings up the Targeting Editor. You can select any +combination of characteristics you want to test for. Administrators familiar with Group Policy +Preferences' Item-Level Targeting will be at home in this interface as it is functionally +equivalent. + +You can apply one or more targeting items to a policy, which enables targeting items to be joined +logically. You can also add targeting collections, which group together targeting items in much the +same way parentheses are used in an equation. In this way, you can create a complex determination +about where a policy will be applied. Collections may be set to **And**, **Or**, **Is**, or **Is +Not**. + +The screenshot below demonstrates the basic capabilities of the Targeting Editor. Also, note that +Endpoint Policy Manager File Associations Manager cannot filter by user group since the node is only +available on the Computer side, and Endpoint Policy Manager File Associations Manager is only valid +for Windows 8.1 and later. + +![using_item_level_targeting_4](../assets/using_item_level_targeting_4.webp) + +In this example, the Pak would only apply to Windows 10 machines when the machine is portable, and +the user is in the FABRIKAM\Traveling Sales Users group. + +Below are some real-world examples of how you can use Item-Level Targeting. + +- Software prerequisites — If you want to configure an application's settings, first make sure the + application is installed on the user's computer before configuring it. You can use File Match or + Registry Match targeting items (or both) to verify a specific version of a file or a registry + entry is present. (For an example of this, look in the Uninstall registry key.) +- Mobile computers — If you want to deploy settings exclusively for users on mobile PCs, then filter + the rule to apply only to mobile PCs by using the **Portable Computer** targeting item. +- Operating system version — You can specify different settings for applications based on the + operating system version. To do this, create one rule for each operating system. Then filter each + rule using the **Operating System** targeting item. +- Group membership — You can link the Group Policy Object (GPO) to the whole domain or + organizational unit (OU), but only members within a specific group will pick up and process the + rule settings. +- IP range — You can specify different settings for various IP ranges, like different settings for + the home office and each field office. + +Close the editor when you are done. Note that the icon for the policy or collection has changed to +orange, which shows that it now has Item-Level Targeting. + +![using_item_level_targeting_5](../assets/using_item_level_targeting_5.webp) + +When Item-Level Targeting is on, the policy won't apply unless the conditions evaluate to True, and +if Item-Level Targeting is on for a collection, then none of the items in the collection will apply +unless the Item-Level Targeting on the collection evaluates to True. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/processorderprecedence.md b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/processorderprecedence.md new file mode 100644 index 0000000000..2a9e2fc2c9 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/itemleveltargeting/processorderprecedence.md @@ -0,0 +1,48 @@ +--- +title: "Understanding Processing Order and Precedence" +description: "Understanding Processing Order and Precedence" +sidebar_position: 10 +--- + +# Understanding Processing Order and Precedence + +Within a particular GPO (Computer or User side), the processing order is counted in numerical order. +So lower-numbered collections attempt to process first, and higher-numbered collections attempt to +process last. Then, within any collection, each policy is processed in numerical order from lowest +to highest. + +![using_item_level_targeting_6](../assets/using_item_level_targeting_6.webp) + +![using_item_level_targeting_7](../assets/using_item_level_targeting_7.webp) + +## Merging and Conflicts + +Endpoint Policy Manager File Associations Manager will merge all GPOs (or non-Group Policy methods) +and collections, unless there is a conflict. This is especially important because, instead of having +one flat file that everyone must use and agree upon, you can distribute the directives across +Endpoint Policy Manager collections or GPOs. Then, everything that doesn't conflict will merge +perfectly. + +For example, let's consider that you have two GPOs (or collections) that look like the following: + +- `GPO1/Collection1: "TXT -> Notepad.exe", "LOG -> Notepad.exe"` +- `GPO2/Collection2: "TXT -> Sublime.exe", "CFG -> Sublime.exe"` + +Assuming GPO 2 or Collection 2 is processed last (based upon natural GP precedence), the result will +be the following association list: + +- `TXT -> Sublime.exe` (because GPO2 "wins" in the conflict) +- `LOG -> Notepad.exe` (because there are no conflicts) +- `CFG -> Sublime.exe` (because there are no conflicts) + +## Precedence + +Policies can be delivered by Group Policy and non-Group Policy methods such as Microsoft Endpoint +Manager (SCCM and Intune) via Endpoint Policy Manager Exporter or Endpoint Policy Manager Cloud. As +such, the Endpoint Policy Manager engine needs to make a final determination whether there is any +overlap of policies. Here is how the precedence works: + +- Policies delivered through Endpoint Policy Manager Cloud have the lowest precedence. +- Policies delivered through Endpoint Policy Manager files have the next highest precedence. +- Policies delivered through Endpoint Policy Manager Group Policy directives have the highest + precedence. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/mapextensions.md b/docs/endpointpolicymanager/file-associations-manager/manual/mapextensions.md new file mode 100644 index 0000000000..56afc17eca --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/mapextensions.md @@ -0,0 +1,92 @@ +--- +title: "Quick Start - Mapping Extensions to Applications" +description: "Quick Start - Mapping Extensions to Applications" +sidebar_position: 30 +--- + +# Quick Start - Mapping Extensions to Applications + +:::note +For some video overviews of Endpoint Policy Manager File Associations Manager, see the +[Endpoint Policy Manager Cloud: Managing File Assocations](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloud.md) topic +for additional information. +::: + + +Even after applications such as Acrobat, Metro Media Player, and Outlook are installed, those +applications are not associated by default with the appropriate file extensions. + +Using Endpoint Policy Manager File Associations Manager, we want to make the following maps: + +- PDF — Acrobat Reader (MSI version) +- MAILTO — Outlook or Claws Mail (MSI version) +- MP4 — Metro Media Player (UWP version) + +Follow these steps to associate the extensions: + +**Step 1 –** Create a GPO and link it to where your computers are. For example, a GPO named PPFAM +Policies is linked to the East Sales Computers OU. + +**Step 2 –** In **Computer Configuration** > **PolicyPak** > **File Associations Manager**, select +**Add** > **New Policy**. + +![about_policypak_file_associations_11](assets/about_endpointpolicymanager_file_associations_11.webp) + +**Step 3 –** The Endpoint Policy Manager File Associations Manager policy editor displays, showing +the most common configuration. For this Quickstart, make the following selections: + +- Filter Type: File Type +- File Extension: PDF +- Action Type: Registered application +- Select Program: Since you typed PDF earlier, clicking **Select Program** automatically show + applications on your machine (the one with the Group Policy editor) that are capable of opening + PDF files. Since you already installed Adobe Reader, the program is selectable. + +**Step 4 –** The Associated Program (ProgID) and Application Name are automatically filled in. + +![about_policypak_file_associations_12](assets/about_endpointpolicymanager_file_associations_12.webp) + +**Step 5 –** When you click **OK** to save the policy, the entry looks like this: + +![about_policypak_file_associations_13](assets/about_endpointpolicymanager_file_associations_13.webp) + +**Step 6 –** Create another policy to map MAILTO: to Outlook or Claws Mail (your machine must have +Outlook or Claws Mail already installed). Go to **Add** > **New Policy**. For this policy, choose +**Network Protocol** as the filter type, then type in `mailto` (using either lowercase or uppercase) +in the **Network Protocol** field. Click **Select Program** and locate Claws Mail. + +![about_policypak_file_associations_14](assets/about_endpointpolicymanager_file_associations_14.webp) + +You now have two entries, one for PDF and one for MAILTO: + +![about_policypak_file_associations_15](assets/about_endpointpolicymanager_file_associations_15.webp) + +Now we create a map from MP4 to the UWP version of Metro Media Player. You must have the UWP +(Windows Universal/Windows store) version of Metro Media Player on your management station for these +steps. + +**Step 7 –** Create a new policy to map all videos to the UWP version of Metro Media Player. To do +this, click the **Windows 10 Category** radio button, and then select **Video Player**. Click +**Select Program**, find an instance of Metro Media Player (UWP), and select it. When you do, the +Associated Program (Progid) and Application Name are automatically filled in. + +![about_policypak_file_associations_16](assets/about_endpointpolicymanager_file_associations_16.webp) + +Now, you'll have a new entry. + +![about_policypak_file_associations_17](assets/about_endpointpolicymanager_file_associations_17.webp) + +Make sure the endpoint has the same programs installed as the management station and also has the +Endpoint Policy Manager CSE installed. + +**Step 8 –** Run `GPupdate`. Note that when settings are applied using Group Policy they do not take +effect until that user logs off and then logs on again. Also note that after `GPupdate `is run there +is no discernible change in the icons of the newly registered file types. + +![about_policypak_file_associations_18](assets/about_endpointpolicymanager_file_associations_18.webp) + +Once you run `GPupdate` you should see the PDF icon change. After this, double-clicking on a PDF +should open Acrobat Reader, double-clicking on the MP4 should open Metro Media Player, and opening +your Wordpad doc, which has a MAILTO: email address, should open Claws Mail (or Outlook). + +![about_policypak_file_associations_19](assets/about_endpointpolicymanager_file_associations_19.webp) diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/overview.md b/docs/endpointpolicymanager/file-associations-manager/manual/overview.md new file mode 100644 index 0000000000..0e5755ce3b --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/overview.md @@ -0,0 +1,88 @@ +--- +title: "File Associations Manager" +description: "File Associations Manager" +sidebar_position: 10 +--- + +# File Associations Manager + +:::warning +Even though Endpoint Policy Manager MDM and Endpoint Policy Manager Cloud can deliver a +wide variety of Endpoint Policy Manager and Group Policy settings to non-domain-joined machines, +neither the in-box Microsoft method, nor Endpoint Policy Manager File Associations Manager, can +configure machines unless the machine is domain-joined. +::: + + +This is a self-imposed limitation by Microsoft on this Windows 10 feature. + +## About File Associations Manager + +:::note +Before reading this section, please ensure you have read +[Installation Quick Start](/docs/endpointpolicymanager/manuals/introductionandquick/overviewinstall/overviewinstall.md), which will help you +learn to do the following: +::: + + +- Install the Admin MSI on your GPMC machine +- Install the CSE on a test Windows machine +- Set up a computer in Trial mode or Licensed mode +- Set up a common OU structure + +Optionally, if you don't want to use Group Policy, read the section on Advanced Concepts on Group +Policy and non–Group Policy methods (MEMCM, KACE, and MDM service or Netwrix Endpoint Policy Manager +(formerly PolicyPak) Cloud), located in the +[Endpoint Privilege Manager Implementation QuickStart Guide](/docs/endpointpolicymanager/manuals/leastprivilegesecuri/pplpmimplementationguide.md) +to deploy your directives. + +Endpoint Policy Manager File Associations Manager enables you to perform the following operations in +Windows 10: + +- Set up file associations for extensions such as .pdf with Acrobat Reader or FoxIT Pro Reader, or + .zip with WinZip or 7-Zip +- Set up protocol associations like MAILTO: or FTP: to specific applications +- Map an entire category of Windows 10 items +- Map a file extension to a Windows 10 "universal" application, such as Universal Windows Platform + (UWP)/Metro applications + +:::note +For an overview of Endpoint Policy Manager File Associations Manager, see +[https://www.endpointpolicymanager.com/products/endpointpolicymanager-file-associations-manager.html](https://www.endpointpolicymanager.com/products/endpointpolicymanager-file-associations-manager.html). +::: + + +The basic way to use Endpoint Policy Manager File Associations Manager is as follows: + +- Create rules to express which file extensions should launch which applications. +- Export the Endpoint Policy Manager File Associations Manager rules and deliver them using: + + - Microsoft Endpoint Manager (SCCM and Intune) or your own on-prem systems management software + - A mobile device management (MDM) service + - Endpoint Policy Manager Cloud service + +- Allow the client machine with the Endpoint Policy Manager client-side extension (CSE) to embrace + the directives and perform the work. + +:::note +If you use the Endpoint Policy Manager Cloud service, you can even deliver Group Policy +settings to non-domain-joined machines over the Internet. +::: + + +## Moving Parts + +- A management station: The Endpoint Policy Manager Admin Console MSI must be installed on the + management station where you create Group Policy Objects (GPOs). Once installed, you'll see the + Endpoint Policy Manager | Endpoint Policy Manager File Associations Manager node. +- The Endpoint Policy Manager CSE: This runs on the client (target) machine and is the same CSE for + all Endpoint Policy Manager products. There isn't anything separate to install, and the Endpoint + Policy Manager CSE must be present in order to accept Endpoint Policy Manager File Associations + Manager directives via Group Policy, or when using Microsoft Endpoint Manager (SCCM and Intune), + KACE, MDM, or similar utilities. +- Endpoints: In order to use these, they must be licensed for Endpoint Policy Manager File + Associations Manager using one of the licensing methods. +- The Endpoint Policy Manager Exporter (optional): A free utility that lets you take Endpoint Policy + Manager Admin Templates Manager and our other products' XML files and wrap them into a "portable" + MSI file for deployment using Microsoft Endpoint Manager (SCCM and Intune), an MDM service, or + your own systems management software. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/policies.md b/docs/endpointpolicymanager/file-associations-manager/manual/policies.md new file mode 100644 index 0000000000..f25bfb1e79 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/policies.md @@ -0,0 +1,97 @@ +--- +title: "Collections and Policies" +description: "Collections and Policies" +sidebar_position: 20 +--- + +# Collections and Policies + +Endpoint Policy Manager File Associations Manager is contained within the Endpoint Policy Manager +node. Endpoint Policy Manager File Associations Manager MMC snap-in enables you to create a new +Endpoint Policy Manager File Associations Manager policy or collection. You can create policies on +the Computer side or User side. + +:::note +You will only see the Endpoint Policy Manager File Associations Manager node when the +latest Admin Console MSI is installed on the management station. +::: + + +The functions of collections and policies are as follows: + +- Collections are groupings of policies. +- Policies are the rules that perform the work. + +Below you can see how to add a new collection or policy. + +![about_policypak_file_associations_4](assets/about_endpointpolicymanager_file_associations_4.webp) + +If you want to follow along with the Quickstart for Endpoint Policy Manager File Associations +Manager in the next section, we suggest you download some applications on your Windows 10 management +station and on your endpoint. + +On the endpoint, add some common file types to the Windows 10 Desktop. We suggest adding the +following files: + +- A PDF file +- An MP4 file +- An XML file +- A Wordpad document with a `MAILTO:` command in it + +Below is an example of all four types of files on the sample Desktop. + +![about_policypak_file_associations_5](assets/about_endpointpolicymanager_file_associations_5.webp) + +Endpoint Policy Manager File Associations Manager is the quickest way to set up, test, and manage +file associations on your machine (the Group Policy Editor machine) if it has the same applications +as the target machines. It is recommended you install the following applications twice, once on your +management station and another on your Windows 10 endpoint. + +- Adobe Acrobat DC (11 or 10) — We suggest the offline MSI installer package, which can be found at + Adobe's [MSI Installer Package](https://get.adobe.com/reader/enterprise/) download. +- A mail program such as Outlook — If that's too much to download and install, you can use something + smaller such as Claws Mail for a quick test. Claws Mail can be downloaded at + [Download Claws Mail](http://www.claws-mail.org/win32/). +- The UWP version of Metro Media Player from the Windows store. + +Acrobat Reader asks if it can be the default PDF viewe. Yet, after the installation occurs, the PDF +is not associated with Acrobat Reader. Instead, Windows 10 Edge is typically the default program to +open PDF files, or Edge is recommended, and the user must make a choice. + +![about_policypak_file_associations_6](assets/about_endpointpolicymanager_file_associations_6.webp) + +When installing Adobe Acrobat Reader DC, the installer asks to be the default PDF viewer. + +![about_policypak_file_associations_7](assets/about_endpointpolicymanager_file_associations_7.webp) + +Edge generally becomes the default when a user opens a PDF file. + +The same problem occurs when you install Outlook or Claws Mail. Outlook and Claws Mail try to +register themselves as a provider for the `MAILTO: protocol`. But after Claws Mail or Outlook is +installed, it is not actually correctly set as the default for `MAILTO: emails`. You can quickly +test this by opening up Wordpad and typing `MAILTO:you@email.com`. Click the link, and you will +see that it will launch the Windows 10 default mail application instead of Outlook or Claws Mail. + +![about_policypak_file_associations_8](assets/about_endpointpolicymanager_file_associations_8.webp) + +After installing Claws Mail, the program tries to make itself the default for opening emails. + +![about_policypak_file_associations_9](assets/about_endpointpolicymanager_file_associations_9.webp) + +Opening Wordpad and typing `MAILTO:you@email.com` shows that Outlook or Claws Mail is not actually +the default email program. + +The UWP (Windows Universal App in the Windows store) for Metro Media Player Pro is shown below. + +![about_policypak_file_associations_10](assets/about_endpointpolicymanager_file_associations_10.webp) + +In order to successfully complete the Quickstart with Endpoint Policy Manager File Associations +Manager in the next section, make sure you have the following machines set up with the programs and +files listed here: + +- Your machine with the GPMC should have Acrobat Reader, Claws Mail (or Outlook), and the UWP + version of Metro Media Player. +- An example endpoint machine with the Endpoint Policy Manager CSE should have Acrobat Reader, Claws + Mail (or Outlook), and the UWP version of Metro Media Player. +- An example endpoint machine with a PDF file, a MP4 file, a MAILTO: example, and an XML file loaded + on the Desktop. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/preconfigured.md b/docs/endpointpolicymanager/file-associations-manager/manual/preconfigured.md new file mode 100644 index 0000000000..4f792d08a1 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/preconfigured.md @@ -0,0 +1,63 @@ +--- +title: "Using Preconfigured Collections and File Associations" +description: "Using Preconfigured Collections and File Associations" +sidebar_position: 80 +--- + +# Using Preconfigured Collections and File Associations + +Netwrix Endpoint Policy Manager (formerly PolicyPak) File Associations Manager ships with several +preconfigured collections that you can use immediately. The Endpoint Policy Manager Portal also has +a download that contains some prepackaged file associations for selected common utilities (and their +usual settings). + +:::note +For a video overview demonstrating how to use preconfigured Endpoint Policy Manager File +Associations Manager items, see +[Endpoint Policy Manager File Associations Manager: Use our preconfigured advice](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/preconfiguredadvice.md) +topic for additional information. +::: + + +For instance, for all the common Adobe products, Adobe has some advice that we have we've repackaged +as file associations for use with Endpoint Policy Manager File Associations Manager. See Adobe's +article +[Setting the Default PDF Viewer](https://www.adobe.com/devnet-docs/acrobatetk/tools/AdminGuide/pdfviewer.html) for additional information. +The image below shows their guidance on associating file types to ProgIDs. + +![using_preconfigured_collections](assets/using_preconfigured_collections.webp) + +You could try to set all of this yourself, but here at Endpoint Policy Manager, we've done the work +so you don't have to. To locate the Endpoint Policy Manager File Associations Manager preconfigured +settings based on the manufacturer's guidance, follow these steps: + +![using_preconfigured_collections_1](assets/using_preconfigured_collections_1.webp) + +**Step 1 –** Go to the Endpoint Policy Manager Portal and locate the Guidance XMLs ZIP file. + +![using_preconfigured_collections_2](assets/using_preconfigured_collections_2.webp) + +**Step 2 –** Download and unpack the ZIP file. Look for the folder called Endpoint Policy Manager +File Associations Manager XMLs. + +![using_preconfigured_collections_3](assets/using_preconfigured_collections_3.webp) + +**Step 3 –** Inside that folder, you'll see XMLs, which are ready for immediate import into Endpoint +Policy Manager File Associations Manager. + +![using_preconfigured_collections_4](assets/using_preconfigured_collections_4.webp) + +**Step 4 –** To import the XML files, drag and drop them into the Endpoint Policy Manager File +Associations Manager console. This creates a collection for applications such as Adobe Reader DC, +Adobe Reader 11, and others. + +![using_preconfigured_collections_5](assets/using_preconfigured_collections_5.webp) + +**Step 5 –** The orange color of the icon denotes that the collections have Item-Level Targeting on +them to ensure that they will only apply when the application is actually present on the machine. If +you enter a collection to see what is inside, you'll find something similar to what is show above. + +In this way, it's very easy to download the files and immediately get started, without having to +figure out how each file type should be mapped for an application. We're increasing the number of +our Endpoint Policy Manager File Associations Manager manufacturer's advice files, so check for +updates periodically. diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/productwizard.md b/docs/endpointpolicymanager/file-associations-manager/manual/productwizard.md new file mode 100644 index 0000000000..d084329473 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/productwizard.md @@ -0,0 +1,35 @@ +--- +title: "Add Policies for Product Wizard" +description: "Add Policies for Product Wizard" +sidebar_position: 50 +--- + +# Add Policies for Product Wizard + +Sometimes an application has dozens of associations. For instance, Acrobat Reader doesn't just open +PDF files, it also manages many other file types. And the popular VLC Media Player doesn't just open +MP4 files, it can open several dozen kinds of files. In these cases you might want to use the Add +Policies for Product wizard. + +:::note +For more information on the Add Policies for Product wizard, see the +[Manage all File Associations with the PPFAM Wizard](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/wizard.md) topic for +additional information.. +::: + + +![about_policypak_file_associations_24](assets/about_endpointpolicymanager_file_associations_24.webp) + +The Add Policies for Product wizard allows you to adjust policies for one program (in Simple mode), +or multiple programs (in Combo mode). It also lets you to quickly specify which extensions you want +to associate with which applications. + +Simply locate the application or applications, and then select the extensions. In the examples below +we have selected VLC Media Player and specified all of the extensions it has tried to register for. + +![about_policypak_file_associations_25](assets/about_endpointpolicymanager_file_associations_25.webp) + +When you are done, you have , a collection that contains all the selected extensions you want VLC +Media Player to use. + +![about_policypak_file_associations_26](assets/about_endpointpolicymanager_file_associations_26.webp) diff --git a/docs/endpointpolicymanager/file-associations-manager/manual/registeredextensions.md b/docs/endpointpolicymanager/file-associations-manager/manual/registeredextensions.md new file mode 100644 index 0000000000..496fd95e55 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/manual/registeredextensions.md @@ -0,0 +1,63 @@ +--- +title: "Registered Extensions Versus Custom Application Mappings" +description: "Registered Extensions Versus Custom Application Mappings" +sidebar_position: 40 +--- + +# Registered Extensions Versus Custom Application Mappings + +In the previous section, we mapped three file extensions to three different applications. As you +might have noted, all three policies used the Registered Extension action type. In all the previous +examples, when you used your GPMC machine and clicked **Select Program**, you could choose from a +list of applications, and the associated program and application name were automatically entered in +for you. + +Registered programs are usually the best way to map file extensions. This is because when a program +is registered, it doesn't matter where the program is actually installed. For instance, when mapping +PDF to Acrobat Reader, it didn't particularly matter where Acrobat Reader was installed on the +source machine or, more importantly, the endpoint machine. Because the application was registered, +you only needed to specify the file extension and the application, which pointed to the Associated +Program (ProgID), and Windows launched it. + +However, there might be some times when you want to map an extension to one of the following: + +- a program that isn't installed at all, like a portable application +- an application that doesn't appear to be installed +- an application that is virtualized and doesn't register its extensions + +In these cases, you would choose the Custom Application action type. Custom Application mappings +specifically marry a file extension to a program that must exist on the target machine in a +specific, expected location. + +If you want to follow along with a Custom Application example, follow these steps: + +**Step 1 –** Download Notepad++ Portable edition from +[https://portableapps.com/apps/development/notepadpp_portable](https://portableapps.com/apps/development/notepadpp_portable), +and unpack it at `c:\Notepad++ Portable` on your machine (with the GPMC) and on the example +endpoint. + +**Step 2 –** Create a policy in Endpoint Policy Manager File Associations Manager to map the XML +file extension to this custom application. + +**Step 3 –** Click **Select Program**, and select **From EXE File** (not shown). Find the +`Notepad++Portable.exe` program. When that file is selected, the **Application Icon field**is +automatically filled in. + +![about_policypak_file_associations_20](assets/about_endpointpolicymanager_file_associations_20.webp) + +**Step 4 –** Now you should have a total of four file association policies. + +![about_policypak_file_associations_21](assets/about_endpointpolicymanager_file_associations_21.webp) + +:::note +The XML file type on the endpoint has no icon in particular. +::: + + +![about_policypak_file_associations_23](assets/about_endpointpolicymanager_file_associations_23.webp) + +**Step 5 –** To continue, run `GPupdate` on the endpoint. Then, to see it take effect, log off and +log on again. When you do, you'll see the XML file icon change to Notepad++. Double-clicking the +icon will launch Notepad++ Portable. + +![about_policypak_file_associations_22](assets/about_endpointpolicymanager_file_associations_22.webp) diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/_category_.json b/docs/endpointpolicymanager/file-associations-manager/technical-notes/_category_.json new file mode 100644 index 0000000000..ac83484ebc --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Technical Notes", + "position": 30 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_1_faq-03-img-01.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_1_faq-03-img-01.webp new file mode 100644 index 0000000000..7545e35c24 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_1_faq-03-img-01.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_2_faq-03-img-02.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_2_faq-03-img-02.webp new file mode 100644 index 0000000000..59fc6634a1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_2_faq-03-img-02.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_3_faq-03-img-03.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_3_faq-03-img-03.webp new file mode 100644 index 0000000000..3187e3f36f Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/523_3_faq-03-img-03.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/660_1_faq4-img1.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/660_1_faq4-img1.webp new file mode 100644 index 0000000000..a720898fcc Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/660_1_faq4-img1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/715_1_image-20210421203400-1_950x594.jpeg b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/715_1_image-20210421203400-1_950x594.jpeg new file mode 100644 index 0000000000..99cbccffd1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/715_1_image-20210421203400-1_950x594.jpeg differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/715_2_image-20210421203400-2.jpeg b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/715_2_image-20210421203400-2.jpeg new file mode 100644 index 0000000000..d89f547dcd Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/715_2_image-20210421203400-2.jpeg differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/730_1_ddfgdsfgfg.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/730_1_ddfgdsfgfg.webp new file mode 100644 index 0000000000..70879fddaa Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/730_1_ddfgdsfgfg.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/837_1_image-20201027212337-3.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/837_1_image-20201027212337-3.webp new file mode 100644 index 0000000000..18793b822b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/837_1_image-20201027212337-3.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting.webp new file mode 100644 index 0000000000..4660e522e7 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting_1.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting_1.webp new file mode 100644 index 0000000000..92c9168427 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting_1.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting_2.webp b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting_2.webp new file mode 100644 index 0000000000..986335b5d1 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/technical-notes/assets/troubleshooting_2.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/knowledgebase.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/knowledgebase.md new file mode 100644 index 0000000000..517e180e6b --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/knowledgebase.md @@ -0,0 +1,23 @@ +--- +title: "Knowledge Base" +description: "Knowledge Base" +sidebar_position: 10 +--- + +# Knowledge Base + +See the following Knowledge Base articles for File Associations Manager. + +## Troubleshooting + +- [Can I use Endpoint Policy ManagerBrowser Router and/or Endpoint Policy Manager File Associations Manager to set the default browser?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultbrowser.md) +- [How does PP File Associations Manager merge between GPOs and/or Collections?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/gpos.md) +- [What happens if I use MDT, or in-box Group Policy or MDM to set OEMDefaultAssociations.XML BEFORE Endpoint Policy Manager File Associations Manager ?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/oemdefaultassociations.md) +- [Why is Browser Router's "Default Browser" or File Associations Manager's configuration not working when I also have a Default Associations Configuration file?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultassociationsconfiguration.md) +- [How do I revert to "Legacy File Associations Methods & Features" if directed (especially for LTSB/LTSC)?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/legacy.md) + +## Tips and Tricks + +- [How can I make Cortana and other web searches to use system default browser instead of Microsoft Edge?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/cortana.md) +- [How can I associate .HTM files with a specific browser, like Internet Explorer?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/specificbrowser.md) +- [How can I open images with Windows Photo Viewer?](/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/windowsphotoviewer.md) diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/_category_.json b/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/_category_.json new file mode 100644 index 0000000000..a6d7d9b805 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips And Tricks", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/cortana.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/cortana.md new file mode 100644 index 0000000000..cd7ce93064 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/tipsandtricks/cortana.md @@ -0,0 +1,24 @@ +--- +title: "How can I make Cortana and other web searches to use system default browser instead of Microsoft Edge?" +description: "How can I make Cortana and other web searches to use system default browser instead of Microsoft Edge?" +sidebar_position: 10 +--- + +# How can I make Cortana and other web searches to use system default browser instead of Microsoft Edge? + +Microsoft created a protocol that masks the URLs so that they can be opened in Microsoft Edge in Windows 10. So instead of https://www.endpointpolicymanager.com, Windows 10 would prepend microsoft-edge: to the URL i.e. microsoft-edge:https://www.endpointpolicymanager.com. + +So no browser but Microsoft Edge supports this protocol, and these URLs are opened in Edge automatically and not the default system browser you set through Netwrix Endpoint Policy Manager (formerly PolicyPak) software. + +How to solve it? + +You will need to install EdgeDeflector before you can send search queries from Cortana to the default browser, set through Endpoint Policy Manager software. + +Then set the Policy for PPFAM as shown in the following screenshot: + +![730_1_ddfgdsfgfg](../assets/730_1_ddfgdsfgfg.webp) + +:::note +The path for EdgeDeflector. That has to be same on client computers. +Apply the policy on the client computers and reboot. +::: \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/_category_.json b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/_category_.json new file mode 100644 index 0000000000..51f22c0d00 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Troubleshooting", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultassociationsconfiguration.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultassociationsconfiguration.md new file mode 100644 index 0000000000..7ed8539b3e --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultassociationsconfiguration.md @@ -0,0 +1,31 @@ +--- +title: "Why is Browser Router's \"Default Browser\" or File Associations Manager's configuration not working when I also have a Default Associations Configuration file?" +description: "Why is Browser Router's \"Default Browser\" or File Associations Manager's configuration not working when I also have a Default Associations Configuration file?" +sidebar_position: 40 +--- + +# Why is Browser Router's "Default Browser" or File Associations Manager's configuration not working when I also have a Default Associations Configuration file? + +If you're using Netwrix Endpoint Policy Manager (formerly PolicyPak) Browser Router -OR- you're +using Endpoint Policy Manager File Associations Manager to make associations, you CANNOT also use +the Group Policy or MDM method for setting default associations files, like what's seen here. + +![523_1_faq-03-img-01](assets/523_1_faq-03-img-01.webp) + +Underneath the hood, you are "fighting" with Endpoint Policy Manager Browser Router and/or File +Associations manager, like this. + +![523_2_faq-03-img-02](assets/523_2_faq-03-img-02.webp) + +For Endpoint Policy Manager Browser Router, Endpoint Policy Manager Browser Router must "become" the +default OS browser like what's seen here. If Endpoint Policy Manager Browser Router is not set as +the Default Browser (automatically, using Endpoint Policy Manager …) then you will get unusual +behavior. + +![523_3_faq-03-img-03](assets/523_3_faq-03-img-03.webp) + +For Endpoint Policy Manager File Associations Manager, you must remove any Group Policy File +Associations file for it to work reliably. +Summary: Use only Endpoint Policy Manager … when using Endpoint Policy Manager Browser Router and +also Endpoint Policy Manager File Associations Manager and don't try to use a Group Policy or MDM +File Associations alongside it. diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultbrowser.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultbrowser.md new file mode 100644 index 0000000000..fd199320cc --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/defaultbrowser.md @@ -0,0 +1,13 @@ +--- +title: "Can I use Endpoint Policy ManagerBrowser Router and/or Endpoint Policy Manager File Associations Manager to set the default browser?" +description: "Can I use Endpoint Policy ManagerBrowser Router and/or Endpoint Policy Manager File Associations Manager to set the default browser?" +sidebar_position: 10 +--- + +# Can I use Endpoint Policy ManagerBrowser Router and/or Endpoint Policy Manager File Associations Manager to set the default browser? + +Since File Associations Manager handles protocol associations as well as file type associations, it +may be tempting to map http or https to a particular browser as a way of enforcing a default +browser. That will work until Browser Router has any rules at all in that component, and then +Browser Router takes over. If you want to set a default browser, use Browser Router instead of File +Associations Manager. diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/gpos.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/gpos.md new file mode 100644 index 0000000000..da10d7b561 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/gpos.md @@ -0,0 +1,24 @@ +--- +title: "How does PP File Associations Manager merge between GPOs and/or Collections?" +description: "How does PP File Associations Manager merge between GPOs and/or Collections?" +sidebar_position: 20 +--- + +# How does PP File Associations Manager merge between GPOs and/or Collections? + +Netwrix Endpoint Policy Manager (formerly PolicyPak) File Associations Manager works particularly +well, because instead of having one flat file which everyone must use and agree upon, it allows the +use to distribute the directives across Endpoint Policy Manager Collections or GPOs. + +For example, if you have 2 GPOs (or Collections): + +**Step 1 –** GPO1 / Collection1: .`txt -> Notepad.exe`, .`log -> Notepad.exe` + +**Step 2 –** GPO2 / Colleciton2: .`txt -> Sublime.exe`, .`cfg -> Sublime.exe` + +and assuming GPO 2 is processed last based upon natural GP precedence, then you get the following +resulting association list: + +- .`txt -> Sublime.exe`, (Because GPO2 wins in the conflict.) +- .`log-> Notepad.exe`, (Because there are no conflicts.) +- `.cfg -> Sublime.exe` (Because there are no conflicts.) diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/legacy.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/legacy.md new file mode 100644 index 0000000000..ccf1bc7fb1 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/legacy.md @@ -0,0 +1,48 @@ +--- +title: "How do I revert to \"Legacy File Associations Methods & Features\" if directed (especially for LTSB/LTSC)?" +description: "How do I revert to \"Legacy File Associations Methods & Features\" if directed (especially for LTSB/LTSC)?" +sidebar_position: 50 +--- + +# How do I revert to "Legacy File Associations Methods & Features" if directed (especially for LTSB/LTSC)? + +If you are having a problem with Netwrix Endpoint Policy Manager (formerly PolicyPak) File +Associations Manager (PPFAM) not working as expected, you may be asked by tech support to "Revert to +Legacy File Assoc Method & Features". + +This might be required if you are attempting to use Endpoint Policy Manager File Associations +Manager on an older version of Windows 10, say, LTSB or LTSC. You can still get Endpoint Policy +Manager File Associations Manager to work, but you must utilize the Legacy behavior. + +First, be sure you are eligible to use this function by copying the latest Endpoint Policy Manager +ADMX files to your Central Store or using Endpoint Policy Manager Cloud. + +Directions for Central Store: +[Troubleshooting with ADMX files](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/admxfiles.md) + +Directions for Endpoint Policy Manager Cloud (if they are not already pre-placed there): +[PolicyPak Cloud: Upload and use your own ADMX files to PolicyPak Cloud](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/admxfiles.md) + +Then, the setting you should use if directed by support is entitled: + +`Computer Configuration | Policies | Admin Templates | PolicyPak ADMX Settings | Client-side Extensions | File Associations Manager | Revert to Legacy File Assoc Method & Features` +and set to Enabled to return back to the legacy behavior. + +![837_1_image-20201027212337-3](assets/837_1_image-20201027212337-3.webp) + +## What does "Revert to Legacy File Assoc Method & Features" mean? + +By establishing to use Legacy File Assoc Method & Features the following occurs: + +- Endpoint Policy Manager File Associations Manager policies will ONLY apply on the COMPUTER side. + + :::note + The MMC and/or Cloud editors cannot know you've enabled this setting; and as such + those editors will still work, but the CSE will then ignore the USER side directives. + ::: + + +- Endpoint Policy Manager File Associations Manager policies can only take effect on DOMAIN JOINED + machines. +- Endpoint Policy Manager File Associations Manager policies can only take effect when you log out + and back in. diff --git a/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/oemdefaultassociations.md b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/oemdefaultassociations.md new file mode 100644 index 0000000000..4f314539e0 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/technical-notes/troubleshooting/oemdefaultassociations.md @@ -0,0 +1,22 @@ +--- +title: "What happens if I use MDT, or in-box Group Policy or MDM to set OEMDefaultAssociations.XML BEFORE Endpoint Policy Manager File Associations Manager ?" +description: "What happens if I use MDT, or in-box Group Policy or MDM to set OEMDefaultAssociations.XML BEFORE Endpoint Policy Manager File Associations Manager ?" +sidebar_position: 30 +--- + +# What happens if I use MDT, or in-box Group Policy or MDM to set OEMDefaultAssociations.XML BEFORE Endpoint Policy Manager File Associations Manager ? + +If you attempt to: + +- Pre-set the file associations in the image or +- Set using Group Policy via the "Set a default associations configuration file" or +- Attempt to set it using MDM… + +Then that method will win over Endpoint Policy Manager File Associations Manager, and you will not +get the Endpoint Policy Manager File Associations Manager benefits. + +Therefore, use only Endpoint Policy Manager File Associations Manager and not the above methods to +achieve File Associations goals. Remove any in-box Group Policy settings, etc, which are attempting +to set File Associations and use only Endpoint Policy Manager to do it. + +![660_1_faq4-img1](../assets/660_1_faq4-img1.webp) diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/_category_.json b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/_category_.json new file mode 100644 index 0000000000..2ad03511c7 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Video Learning Center", + "position": 20 +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_10_create-windows-10-file-association-policy-with-endpointpolicymanager.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_10_create-windows-10-file-association-policy-with-endpointpolicymanager.webp new file mode 100644 index 0000000000..7dcda7dcad Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_10_create-windows-10-file-association-policy-with-endpointpolicymanager.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_11_windows-10-file-association-pdf-to-acrobat.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_11_windows-10-file-association-pdf-to-acrobat.webp new file mode 100644 index 0000000000..f892d96df3 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_11_windows-10-file-association-pdf-to-acrobat.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_12_create-windows-10-file-association-policy-for-mp4-with-endpointpolicymanager-file-associations-manager.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_12_create-windows-10-file-association-policy-for-mp4-with-endpointpolicymanager-file-associations-manager.webp new file mode 100644 index 0000000000..bb5f1e2483 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_12_create-windows-10-file-association-policy-for-mp4-with-endpointpolicymanager-file-associations-manager.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_13_windows-10-file-association-for-mp4-changed-to-vlc-player.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_13_windows-10-file-association-for-mp4-changed-to-vlc-player.webp new file mode 100644 index 0000000000..c3b2285f72 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_13_windows-10-file-association-for-mp4-changed-to-vlc-player.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_14_windows-10-file-association-changed-mailto-outlook.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_14_windows-10-file-association-changed-mailto-outlook.webp new file mode 100644 index 0000000000..18d8600839 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_14_windows-10-file-association-changed-mailto-outlook.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_15_windows-10-file-association-for-mailto-set-with-endpointpolicymanager.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_15_windows-10-file-association-for-mailto-set-with-endpointpolicymanager.webp new file mode 100644 index 0000000000..b933ff4dc8 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_15_windows-10-file-association-for-mailto-set-with-endpointpolicymanager.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_16_windows-10-file-association-custome-application.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_16_windows-10-file-association-custome-application.webp new file mode 100644 index 0000000000..c9ca1550d7 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_16_windows-10-file-association-custome-application.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_17_windows-10-file-association-notepad-confirmation.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_17_windows-10-file-association-notepad-confirmation.webp new file mode 100644 index 0000000000..e81e1de0b0 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_17_windows-10-file-association-notepad-confirmation.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_18_windows-10-file-association-group-policy-update-successful.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_18_windows-10-file-association-group-policy-update-successful.webp new file mode 100644 index 0000000000..6fdaede5b5 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_18_windows-10-file-association-group-policy-update-successful.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_1_windows-10-file-association-demo-admin-machine.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_1_windows-10-file-association-demo-admin-machine.webp new file mode 100644 index 0000000000..cbcd5f6819 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_1_windows-10-file-association-demo-admin-machine.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_2_windows-10-file-association-endpoint-machine.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_2_windows-10-file-association-endpoint-machine.webp new file mode 100644 index 0000000000..3492c2cde7 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_2_windows-10-file-association-endpoint-machine.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_3_windows-10-file-association-pdf-edge.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_3_windows-10-file-association-pdf-edge.webp new file mode 100644 index 0000000000..8f0ec84c5e Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_3_windows-10-file-association-pdf-edge.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_4_windows-10-file-association-for-mp4-files.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_4_windows-10-file-association-for-mp4-files.webp new file mode 100644 index 0000000000..0de3afdd14 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_4_windows-10-file-association-for-mp4-files.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_5_windows-10-file-association-mailto-default.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_5_windows-10-file-association-mailto-default.webp new file mode 100644 index 0000000000..eab931890b Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_5_windows-10-file-association-mailto-default.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_6_windows-10-file-association-mailto-mailer.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_6_windows-10-file-association-mailto-mailer.webp new file mode 100644 index 0000000000..d143cbdf1c Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_6_windows-10-file-association-mailto-mailer.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_7_windows-10-file-association-unknown-application.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_7_windows-10-file-association-unknown-application.webp new file mode 100644 index 0000000000..a3cbda203e Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_7_windows-10-file-association-unknown-application.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_8_policy-pak-file-association-manager-for-windows-10.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_8_policy-pak-file-association-manager-for-windows-10.webp new file mode 100644 index 0000000000..33da50546f Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_8_policy-pak-file-association-manager-for-windows-10.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_9_start-with-gpmc-endpointpolicymanager-file-association-manager.webp b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_9_start-with-gpmc-endpointpolicymanager-file-association-manager.webp new file mode 100644 index 0000000000..6665912966 Binary files /dev/null and b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/assets/21_9_start-with-gpmc-endpointpolicymanager-file-association-manager.webp differ diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/_category_.json b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/_category_.json new file mode 100644 index 0000000000..ee7419d8c4 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Getting Started", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/applyonce.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/applyonce.md new file mode 100644 index 0000000000..d2da88d3bf --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/applyonce.md @@ -0,0 +1,57 @@ +--- +title: "Endpoint Policy Manager File Associations Manager: Apply once (and drift)" +description: "Endpoint Policy Manager File Associations Manager: Apply once (and drift)" +sidebar_position: 20 +--- +# Endpoint Policy Manager File Associations Manager: Apply once (and drift) + +Want to lay down one set of File Associations for some apps, but leave others to the end user to +change themselves? Use Endpoint Policy Manager File Associations Manager to "apply once" and let +those settings drift after you set them with the tips in this video. + + + +Hi, this is Jeremy Moskowitz. In this video, I'm going to show you how you can use Endpoint Policy +Manager File Associations Manager to set up your user or computer side file associations and do it +one time so that users can then drift from your configuration. This Group Policy object is already +linked over to my East Sales Users. You might have seen videos like this before where we can Add a +New Policy or Policy for Product (wizard). I love using the Wizard because you can interrogate an +application such as Adobe Reader and then ask it what it has to offer. It's got all these things to +offer but users might want to choose a different thing after you've made this choice. + +I'll go ahead and do this. Apply once. We can say Always, Once or Once when forced. For instance, we +can set this one to Once. Then we can click Finish. If we want to set another Policy for Product +(wizard), let's say we want to do VLC media player as a different example here. We can say all the +items in VLC media player are going to be always reapplied. Let's go ahead and see that two +different types of behavior. These settings will be always applied. You can see that these are set +here for every single one of these policies. You can see that, if I were to double-click on the PDF +one for instance, you can see that this is applied Once. Each of the items that we use the Wizard +for are going to be applied Once. + +If we were to go to VLC media Policies, each of those items are going to be applied Always. If we go +over to our target machine here and we run – actually, we can see first that the PDF reader is +currently set as Edge. Maybe the user likes Edge, I don't know. Then they go ahead and they wait for +group policy to process here. Go ahead and watch these icons. They're going to change in real time +as we set the file associations the way we need to. Boom. We set them in real time. The user says, +you know what, I'm not interested in using Acrobat Reader. Instead, I want to use Edge. That's fine. +We said that the PDF Policies are going to be Once and not again.  We said the VLC media player +policies, those are always going to be snapbacks. Let's go ahead and make those two changes and see +what happens when we reapply policy here. + +What I'm going to do is I'm going to right-click and I'm going to Open with a different app and I'm +going to pick Always open with Edge or Chrome. It doesn't really matter. Maybe that's even a better +example. Let's go ahead and open it up with Chrome as a different thing here. You can see that PDF +opens up with Chrome and that's fine. If we were to change the VLC media player to Open with a +different app and we were to pick the Photos app here. Let's see what happens when we do that. We +can see that that's going to open just fine in the Photos app. There's my little video file. We +said, what happens on gpupdate? On gpupdate, we said that the PDF, that's going to stay put. +Whatever the user changes it to, let them go ahead and do that. + +You can see that the VLC media player for the MP4 has come back. For some policies, we made them +apply once and for other policies, we made it snapback. You can see the PDF is Chrome and we can see +the video is snapped back to MP4. Just to finish up here, I do want to point out that the policies +actually have a third setting. If you wanted to, you have an option to also do Once or when forced. +The idea here is you could set it one time which will work fine and then if you do a gpupdate/force, +then and only then will it snapback. That will be a gpupdate/force and I have to set the policy to +make that work. Hope this apply once for file associations then drift helps you out. Looking forward +to getting you started with Endpoint Policy Manager real soon. Thanks so much. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/preconfiguredadvice.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/preconfiguredadvice.md new file mode 100644 index 0000000000..fc4632c27a --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/preconfiguredadvice.md @@ -0,0 +1,74 @@ +--- +title: "Endpoint Policy Manager File Associations Manager: Use our preconfigured advice" +description: "Endpoint Policy Manager File Associations Manager: Use our preconfigured advice" +sidebar_position: 50 +--- +# Endpoint Policy Manager File Associations Manager: Use our preconfigured advice + +Endpoint Policy Manager File Associations Manager comes with some preconfigure advice. It's super +easy to use. Here's the how to video, to associate Adobe Reader, Writer and other applications in +Windows 10. + + + +### Endpoint Policy Manager File Associations Manager: Use our preconfigured advice + +Hi. This is Jeremy Moskowitz. In previous videos, you saw me associate things like PDF to Acrobat +Reader, but it turns out there's actually more than meets the eye there. In fact, there are a bunch +of things that Acrobat Reader needs in order to get as efficient as possible with regards to when +people send different file types around. We've preconfigured some advice for you. Let me show you +how to get, download and use our preconfigured advice. + +What you can do is log into the "Endpoint Policy Manager Portal" and do what's called "Download +Advice XMLs." It's actually a big download because it has a bunch of things in it. The thing you're +after is what's called the "Endpoint Policy Manager File Associations Manager XMLs." Here are some +of them. These are the ones we're starting off with as of this video. + +The idea is that we have "Acrobat," "DC," "Classic," "Continuous," "Adobe Reader 11" and so on. +Here's the deal: it's very simple to use. You simply have "Endpoint Policy Manager File Associations +Manager" up and running here inside you're Group Policy Object. You're going to click on "Import +Collection," and then I have this hanging out on the "Desktop" over here. Then you're going to pick +the thing you want. For instance, I have Acrobat Reader 11 on my endpoint, so I'm going to go ahead +and pick "Adobe Reader 11" right there. + +When you do this, you see we've got a little collection. Inside the collection are all the proper +associations you need, not just "pdf" but also all sorts of unusual things that you might not have +even known you needed to associate. It's all right there. + +What if you also have Acrobat Reader DC? What are you going to do? Very simple. You just click on +"Import Collection" and pick the one you want, "Reader DC (Classic)," and there you go. But how do +you make it so that these things don't collide into each other? That's what the little orange is +about. That's item-level targeting. + +If we click on this, you'll see we have preconfigured item-level targeting into it. You can click on +"Collection Level Targeting," and you can see we're looking for Acrobat Reader 11 either in "x86" or +not x86. The point is that Acrobat Reader 11 exists here, and that means you have Acrobat Reader 11. + +If we look at this one, and we can look it a different way by clicking on "Edit Collection" or +"Change Item Level Targeting" here, if you look at it, you can see that we're looking for Acrobat +Reader DC which is 2015 in this location. In other words, you can't have both, and if you have +whichever one, we're going to detect it and put it in the right place. + +With that in mind, I'm going to go ahead and just leave these two in place and do their thing. Then +I'm just going to run GP Update ("gpupdate"). It will autodetect which collection is the right one +based item-level targeting, perform the associations and the next time we log on we're going to see +this PDF get to the right icon and launch the right application. + +Okay, let's go ahead and "Sign out." We'll log back on, and there we go. In fact, let's see all the +associations that it made. If we were to go to here and type in "file" for "Choose a default app for +each type of file," this takes a second so we'll just give it a moment here. +Now what we're looking to do is find all those items. These are the DOT extensions, and we're +looking for all the Acrobat ones. We're going to go all the way down to P for PDF by way of example. +There we go. There's ".pdf" and ".pdx" and all sorts of other unusual things that have to be done. + +If you wanted to, you could certainly go one-by-one and take a look to see if we actually did the +work. We're looking for ".fdf," whatever that is. We can go back and here we go, ".fdf" for "Adobe +Acrobat Forms Document." + +So we've done all the hard work for you. We've got the preconfigured advice, and in this way you +know you've got it exactly right the first time. No brain power involved. I hope that helps you out. + +If you're looking to get started with Endpoint Policy Manager File Associations Manager, join us for +a webinar, we'll hand over the bits and you can get started right away. + +Thanks so much. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/universalwindowsapps.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/universalwindowsapps.md new file mode 100644 index 0000000000..e5477f3e6d --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/universalwindowsapps.md @@ -0,0 +1,73 @@ +--- +title: "Associate Programs to Universal Windows Apps (Metro Apps)" +description: "Associate Programs to Universal Windows Apps (Metro Apps)" +sidebar_position: 30 +--- +# Associate Programs to Universal Windows Apps (Metro Apps) + +Once you have your Windows Universal applications installed on an endpoint, how to manage the file +associations? Watch this video to make it 1-2-3 easy ! + + + +### Endpoint Policy Manager: Associate Programs to Universal Windows Apps (Metro Apps) + +Hi. This is Jeremy Moskowitz. In previous videos, you saw me use Endpoint Policy Manager File +Associations Manager to map a file extension like PDF over to Acrobat Reader ("Adobe Reader") or an +MP4 over to "VLC media player." This is a different video. What I'm doing here is demonstrating here +how any user or you can get a universal Windows application like this one, "Metro Media Player Pro," +installed and when a user double clicks on an MP4 they still get prompted and don't get what they +want. + +What I'm going to show you is how to use Endpoint Policy Manager File Associations Manager so that +it's guaranteed to hit the actual application you want, whether that's "Metro Media Player Pro" or +if it's "VLC media player" or whatever. The point is that in this video, I'm going to show you how +to dictate it to a Windows universal application, in fact, not just MP4 but all of the Windows 10 +movie types. I'll show you how to do that in one fell swoop. It's very easy. + +To get started, your endpoint has to have the application already installed. We're not going to do +that here. I'm going to assume your endpoint already has that. The other key takeaway is that your +machine with the GPMC installed also needs to have that application. + +This is you on your machine. If I go to the Windows "Store" here, I'm going to install that "Metro +Media Player Pro." I'll go ahead and wait for this to finish. Now that that's done, we don't even +have to "Launch" it on our machine. That's not really what we need to do here. + +What we'll do is we'll just go to our "East Sales Desktops" and "Create a GPO in this domain, and +link it here." We'll call this "PPFAM Windows 10 Movie Type to MMPP." Right click and click "Edit" +here. We'll dive down under computer side, "PolicyPak/File Associations Manager." We'll right click, +"Add/New Policy." + +We'll call this "Windows 10 Media Pro for MP4." I'm going to pick the "Windows 10 Category." This is +where we get the dropdown of the entire category. I'm going to pick "Video Player" here. I'm going +to use a "Registered application" because this machine and that machine both have the same +application. I'll pick "Select Program" here. + +You can pick "Universal Windows Platform," and you're just going to look for that application. There +it is: "Metro Media Player Pro." As soon as you find it, you can click "OK" here. You can see we +automatically put in the "Associated Program" ID and the "Application Name." It's as simple as that. + +Now we'll go over to our endpoint here. When we run GP Update ("gpupdate"), we are not going to see +this instantly take effect. You need to run GP Update and then after GP Update is performed, I'll +log off and log back on. Then you'll see that this application which right this second doesn't know +what to do, once we log back on we'll see that it's all cleared up and should run in the program +that we asked for. + +Let's go ahead and close that out. We'll then go ahead and log off ("Sign out"), and we'll go ahead +and log back on. Here we are all logged on. You can even see if you hover over it, it says the video +name will now fire off in "Metro Media Player Pro." There we go. Just double click, it launches and +plays and the video is nice and happy. + +Another way to see this is if we were to go to the "Settings" app here and if were to go to click on +"Apps" and click on "Default apps," what we'll see here is that we've now associated the thing we +wanted ("Metro Media Player Pro") as the default "Video player." + +If a user were to try to change this during the session, that works fine which is great. But when +the user logs off ("Sign out") and logs back on and now it's time to run it again, it's back +associated with what we had them do. + +With that in mind, I hope you get to try out Endpoint Policy Manager File Associations Manager and +get started with it right away. If you're ready to get started, join us for a webinar and we'll hand +over the bits and get started as soon as you can. + +Thanks. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/windows10.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/windows10.md new file mode 100644 index 0000000000..69734c6a3c --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/windows10.md @@ -0,0 +1,113 @@ +--- +title: "Endpoint Policy Manager File Associations Manager: Manage Windows 10 & 11 File Associations" +description: "Endpoint Policy Manager File Associations Manager: Manage Windows 10 & 11 File Associations" +sidebar_position: 10 +--- +# Endpoint Policy Manager File Associations Manager: Manage Windows 10 & 11 File Associations + +Windows 10 File Associations shouldn't be done via XML file. That's a total waste of time, and +doesn't help you out when your needs change. Instead, use Endpoint Policy Manager File Associations +Manager to manage both COMPUTER and USER file associations. You're gonna love it. + + + +Hi, this is Jeremy Moskowitz, Founder and CTO of Endpoint Policy Manager Software, and in this video +I'm going to show you how you can manage the heck out of your Windows 10 file associations. Boy +howdy, this is a real hard problem to solve. For instance, if you double-click on a PDF file, you +know what happens; probably your browser opens, Edge or maybe it's Chrome depending on how you're +set up. You probably don't like that. You probably want it to be Acrobat Reader. In this case, my +browser's opening, and you probably want it to be something more useful like your Acrobat Reader. + +If I double-click this, well, you can have an error or you can have a user, when they double-click +it, go to Open With and maybe pick the thing that they know they need. For instance, you might have +it defaulting to the Windows Inbox Media Player thing like this. That might be okay; it might not be +okay. You might want some specialty application. Or when they double-click on a Mail To item – this +is my least favorite thing that happens. When you click on a Mail To item, what happens? Well, they +get prompted and users just lose their mind. They're like, where's my Outlook? I see Outlook. What +is this? This is the Windows inbox mailer, which is definitely not what you want. + +That's problem number one. Problem number two is you might have different situations where you want +some things to happen for the entirety of the computer and other things to happen for an individual +user, and I'm going to show you both of those in this video. To get warmed up, what we'll do is go +to our East Sales desktops here, and let's right-click and create a GPO against them and say PPFAM +Desktop Demo 1. This is File Associations Manager on the computer side first. Then I'm going to do +user side second in this same video. + +What we're going to say is everybody on this computer – we'll go to Endpoint Policy Manager, File +Associations Manager. What we'll do is just dictate – right-click, Add. You got a couple of choices +here. My favorite – you can dictate a particular policy. If you just wanted to do PDF, that's fine. +You could just say PDF Rule. Then you can say the file type extension PDF and pick a program. This +is a perfectly fine way of driving in one association. This works awesome. I think there's actually +a better way. Check this out. + +What we can do is we can interrogate your application. We can say Add Policies for Product Wizard +here, and we're going to ask Acrobat Reader to tell us everything you got. Stick up your hands and +tell us everything you got. Look, Acrobat Reader has all these settings. Let's go ahead and check +all those. Just like that, we're associating all of those file extensions, .PDF, .FDF, .XPD, and so +on, all those things right into this little bucket just like that. Everybody on this computer's +going to get exactly these settings. That's pretty nifty. + +Let's do another one as well. I'll just add a new policy here, and this one I'll do for Mail Tos. +I'll say Mail To Rule 2 Outlook. Actually, I don't have Outlook, so I'm going to use a stand-in, +this thing called Clause Mail. That's a network protocol, and I'm going to do Mail To and select a +program. I've already got that here on this management station, so I'm going to just go ahead and +select that. These things are going to take effect for everybody on this computer. + +Let's stop right there and see if that's true. These two items here – so let's go ahead and just run +GP Update and watch what happens in real time. This icon should change in real time to the Adobe +icon, bang, just like that, and then we'll see the Mail To change over when we click it as well. Now +let's go ahead and double-click this Acrobat file. What happens? Instead of it opening in the +browser, look at that. Now it opens up in Acrobat, which is really where we wanted to go. If we go +to Mail To here, we go ahead and click this. Before, it opened up the inside Windows mailer. Now +it's opening up in the mailer of our choice, which is Clause Mail, and it can – in your world, it'll +probably be Outlook, which is awesome. + +We still have this problem of the file associations on the – for mp4 files. Maybe we want east sales +users to use, say, VLC Media Player, but we want west sales users to use RealPlayer. Let's go ahead +and do that. We'll close that out and we'll go for east sales users and we'll say PPFAM MP4 to VLC +Media Player. I'm actually going to pre-stage this other GPO for my west sales users. Why not? I'm +right here anyway. I'll go ahead and do this. I'll do PPFAM MP4 to RealPlayer. We'll come back to +that one in just a second. + +Let's go ahead and right-click over the one on the File Associations Manager on the user side for – +let's go over to User Side, Endpoint Policy Manager. We'll go over to File Associations Manager, and +we will now right-click, Add a New. Let's go ahead and use that cool interrogation wizard again and +let's say hey, VLC Media Player, what do you have to offer us? Let's go ahead and pick VLC Media +Player because I happen to have it on my management station already. Look at that. It's got all +these extensions, mp4, and MKV, mp3, all that stuff. Let's just say yes, let's take them all. We +want all those things. + +Any time we see any of these file associations and I'm an east sales user, bang, we're going to use +VLC Media Player. Put that in a little bucket and we're ready to go. Let's leave that right there. + +Then we'll do the same thing for West Sales User 4, but this time we're going to use RealPlayer. +We'll go over to User Side, Endpoint Policy Manager, File Associations Manager again. Right-click +Add and we'll do that interrogation wizard for the product. We'll go ahead and pick RealPlayer this +time. There we go, RealPlayer, and what does it have to offer? Well, it has a lot to offer there, +too. Of course, it has mp4 and so on. Go ahead and click all those. Click Next and we've got +RealPlayer all ready to go if we're a west sales user. + +Now let's see this in action. We are an east sales user and right now, we're not really associated +with anything Let's run GP Update and what we should see is that this icon instantly changes to the +VLC Media Player icon, and we'll go ahead and test that out. Bang, there it is, VLC Media Player now +associated with mp4s for the east sales users. That's perfect just like that. Now let's log off and +then let's log on as our West Sales User 1, and we said our West Sales User 1 is going to use +RealPlayer. Let's see if that works. Give this a guy a second to log on. Okay, now that we're logged +on, let's go ahead and see the results As we can see, everybody on the machine gets Acrobat as their +PDF reader just the way we want. Everybody gets the same thing there. Same thing for when we click +on a Mail To item, we're going to get Clause Mail to open up. That's what we want to see there as +well for our west sales user. + +We said we want something different for our west sales for mp4 files, and that's going to be +RealPlayer. You can see the little R icon there; that's the RealPlayer. I think this video has no +audio, so it's looking for the audio track. Sure enough, RealPlayer does the thing and we're off to +the races. + +In this way, we can use File Associations Manager from Endpoint Policy Manager on both the computer +side and the user side. This is awesome not just for real PCs but also for Citrix, RDS, VDI, and +also multi-session Windows like in Microsoft Windows Virtual Desktop as well. You can say whenever +Johnny logs onto the machine, he gets his settings or underneath the hood, anybody on this machine +gets exactly the same settings. + +This is amazing. I hope you love it as much as we love to bring it to you. Thank you very much for +watching, and hope to get you started with a trial real soon. Take care. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/wizard.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/wizard.md new file mode 100644 index 0000000000..f660b1248f --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/wizard.md @@ -0,0 +1,83 @@ +--- +title: "Manage all File Associations with the PPFAM Wizard" +description: "Manage all File Associations with the PPFAM Wizard" +sidebar_position: 40 +--- +# Manage all File Associations with the PPFAM Wizard + +If an application has a LOT of file extensions, this built-in PPFAM Wizard enables you to quickly +find them all, and make them a collection. Couldn't be simpler! + + + +### Endpoint Policy Manager: Manage all File Associations with the PPFAM Wizard + +Hi. This is Jeremy Moskowitz. In previous demonstrations, you saw me map a particular file +association to a particular application, and you also saw me do that with entire categories like for +Windows 10 playing videos and stuff. I'm actually going to show you a different technique. The idea +is you can do what's called our "Add Policies for Product (wizard)." This is great if you have an +application and you don't even know how many things you need to associate it with. + +By way of example, let's take an application. Let's continue with VLC. I'm going to talk about both +"Simple Mode" and "Combo Mode" in a second. Let's just start with "Simple Mode" here. Let's go ahead +and click VLC. I'm just going to find the application "VLC." I actually have both versions of VLC +installed. I have the new Windows 10 style universal app and I have the older MSI version. + +Let's start with the older MSI version for a second here. We click "Next." Wow! Look at all the +stuff that "VLC media player" wants to be in charge of, all these things, and that's fine. If you +want to, you can check some or you can "Check All" and it will check all the checkboxes here. We'll +go ahead and click "Next." + +You can call this "VLC media player Policies for MSI Version" or whatever it is. Also, by the way, +you can set "Item Level Targeting" right here if you only wanted these things to hit developers or +when the machine had some particular "Computer Name" or something like that. You can do that. I'm +not going to do that here, but the idea is you're instantly creating a collection. + +When this is over, we'll just click "Finish" here, you can see we have "VLC media player Policies +for MSI Version." We double click, and there they are. All those file associations that VLC wanted +to manage, you can now do that so it makes it super easy. You just get VLC media player on a +representative machine like this, use the wizard and create the association, and you're done. It +couldn't be simpler. + +Another example of this might be something like Acrobat. Acrobat is not just for PDFs; it's for lots +of things. So we can click "Simple Mode." Here's "Adobe Reader." On this machine, Acrobat got its +hands into all of these little items, all these things. So I'll go ahead and "Check All" here. I'll +go ahead and click "Next," and I'll click "Next" again, and I'll click "Finish." There we go, "Adobe +Reader Policies," we've got all the items that we need right there for Acrobat. + +"Now, what the heck is Combo Mode?" I hear you cry. Combo Mode lets you select multiple +applications. In fact, I'm going to go ahead and do that now. I'll go to "Combo Mode" here, and I'll +go ahead and pick "VLC" again. Now wait a second. I have two versions of VLC. I have the MSI version +we saw earlier, and I also have the Windows universal program version here too. What you're able to +do is mix and match between multiple applications. + +So on this here I have the universal version, and here I have the MSI version. If you were to "Check +All" on both of these, you're going to have some conflicts. Does that make sense? Only one of them +can be the right association. + +Let's go ahead and pick the top five and also ".mp4" because we all know what that one is. I'll do +the same thing here, top five and also ".mp4." I'm also going to click some things don't overlap. +I'm picking some things that don't overlap here. So we have some things that do overlap and some +things that don't overlap. Let me go ahead and click "Next" here. + +Now the things that don't overlap don't matter. If they don't overlap, there's not a problem. What +you do need to fix is things called "Resolve Conflicts." Any time you do have a conflict, you have +to decide which one is going to win. Maybe you want the "MSI" version of "VLC media player" to win +for ".mp4" but you want these other unusual extensions to win for the universal version of "VLC" +media player. + +That's it. You just resolved the conflict. Click "Next." Give it a name. I'll call this "Ultimate +Media Selector" or something. It doesn't really matter what it's called. I'll go ahead and click +"Next," and I'll click "Finish." That's it. We have our "Ultimate Media Selector" here. You can see +some of the associations that we selected are going to go toward the Windows universal – that's the +"AppX" things – and some are going to go toward the MSI version that we selected as well. + +It's as simple as that. With that in mind, the "File Associations Manager" wizard, the "Add Policies +for Product (wizard)," it's job is to help you find all the stuff you have across a particular +application. It lets you figure out what file associations it has. It lets you build a collection so +you can make sure that all those things are associated with that application. It's as simple as +that. + +I hope this helps you out. Looking forward to getting you started real soon. + +Take care. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/_category_.json b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/_category_.json new file mode 100644 index 0000000000..7bdacf3b44 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Methods Cloud MDM SCCM PDQ Etc", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloud.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloud.md new file mode 100644 index 0000000000..2b9882709c --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloud.md @@ -0,0 +1,46 @@ +--- +title: "Endpoint Policy Manager Cloud: Managing File Assocations" +description: "Endpoint Policy Manager Cloud: Managing File Assocations" +sidebar_position: 20 +--- +# Endpoint Policy Manager Cloud: Managing File Assocations + +Got PDF? And don't want Edge to open it? Or MP4, and don't want the built-in movie player to open +it? How about protocols like MAILTO: .. want to map those to Outlook? It's drop dead easy.. with +Endpoint Policy Manager File Associations Manager. Trying to manage with "Set a default associations +configuration" is for the birds, and isn't flexible. Instead, manage it quickly using Group Policy, +and PolicyPak. + + + +If you've got not domain-joined machines, as I have here, and you're using Endpoint Policy Manager +Cloud, how do you use Endpoint Policy Manager File Associations Manager with it? Well, it's super +easy. As you know, we've got the cloud client here. We're going to get to that in a second. + +First things first, before you get to Endpoint Policy Manager Cloud, you're going to take your file +associations and simply view as XML in Notepad and here they are just hanging out here, all your +file associations. Copy that. Then go into Endpoint Policy Manager Cloud. You can use whatever group +you want in Endpoint Policy Manager Cloud. I'm going to use the special All group, which is going to +hit every computer. I'm then going to create a link – upload and link a new XML here, and I'll call +this PPFAM All Computers File Allocation. You just hit paste and bam, we recognize it as a File +Associations Manager XML, and you're off to the races. Literally, that's all there is to it. After +you've created your XML, export and upload and you're off to the races. + +Let's go over to our not domain-joined machine or even if it is a domain-joined machine, you can see +in this scenario, you can see PDF is still associated with Edge. This is the built-in video player +and the mail-to isn't set yet. Let's go ahead and install the Cloud client. When we do, we're going +to download the latest client site extension. We're then going to also install the policy settings. +Just watch right here, and you should immediately see those items change about five or ten seconds +after it's registered and hits the All group. We'll go ahead and give this a second to finish up. +Boom, just like that, it hit it and we're off and running. + +This can be done for all users or if you want to be specific with specific users, you can do that as +well. In this demonstration, I'm just showing all users, but that's the great part about Endpoint +Policy Manager Cloud:  very, very flexible, works with your domain-joined and not domain-joined +machines. Get your file associations as soon as those files you want are available and you're off to +the races. Let me go ahead and just finish that last one here and show that my mail is not the goofy +emailer. Instead, it is the Clause Mail, which is what I wanted. + +There you go; that's it. we've done our file associations This is one of the shortest videos ever. +Hope this makes sense and hope you love Endpoint Policy Manager as much as we love bringing it to +you. Thanks so much. Take care. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloudusage.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloudusage.md new file mode 100644 index 0000000000..df1a9006b0 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloudusage.md @@ -0,0 +1,55 @@ +--- +title: "Using File Association Manager in the Endpoint Policy Manager Cloud environment" +description: "Using File Association Manager in the Endpoint Policy Manager Cloud environment" +sidebar_position: 40 +--- +# Using File Association Manager in the Endpoint Policy Manager Cloud environment + +When you don't have a "Fake DC" to create file association policies on-prem to export to the cloud, +Endpoint Policy Manager's File Association Manager Helper utility can be used to create the desired +associations on a sample workstation. + + + +Hi, this is John at Endpoint Policy Manager, and in this video, we're going to take a look at +setting up File Association Manager in the cloud. I have here my non-domain joined machine here, and +we can see we have some common files. A PDF file that opens up in Edge. We have an mp4 file that +opens up in the Windows audio/video player, and a mail link that opens up in standard Windows mail. +We want to go ahead and change all of these. One of the problems is that File Association Manager by +default in the cloud is only associated with Microsoft applications, so if we go ahead and create a +New Policy – create a policy here and say we want to register PDFs to open up with Adobe Reader, you +can see we don't have the option here to do that. What we're going to have to do is we're going to +have to go to a machine that has the application installed on it, run the free utility that we give +you called File Association Manager Helper, and we'll import this configuration. I will Cancel this. + +Let's start up that application. We want to Export registered applications, and we're going to look +for anything on this computer that opens up in PDF. There'll be readers, the first one – and this +can be any application, Chrome, AdobePRO if you had it. Click on Next. I like to include the icons +in here because why not. We'll call it adobe-pdf. Save and Finish. Okay, now we want to do the next +one. Here we're going to do the mp4 file. We'll apply the filter to see what we have that can open +it, and for this we want to use VLC media player. Browse, then we want to change the file name to +vlc-mp4 and Finish. Here it's created the xml for that particular file. Now we want to do one more. +This time, we're going to find a network protocol mailto. I don't have Outlook installed on here, so +what I'm going to do, I'm just going to choose something else. In this case, I'm just going to +choose Google Chrome, so it's going to open up in Google Chrome now. Click on Next, Browse, +chrome-mailto. + +Alright, so now we have all our associations. I can cancel out of this, and I can go back to my +cloud interface. Let's create a new policy again, File Association Manager, New Policy, and I'm +going to go PDF to Adobe, look for PDFs. Again, doesn't show up here because it's not a Microsoft +application. It's a third-party app, so I'm going to import my adobe-pdf, click OK, and now I can +see it's here. It's available for me to select, so I'm going to select that, just confirm +everything's alright, and then click OK. Now we're going to Create a New Policy and import the mp4 +to VLC. Type is mp4. Let's find an application. We'll Import vlc-mp4, OK, and there we go. Click OK. +There we have it. Now we'll do our final one, one more policy, Mailto to Chrome. This would normally +be something like Outlook or some other mail application you have. I don't have any installed in my +demo environment, so I'm just going to use this to show that it's actually making the change. This +is a Network Protocol, so we have to make the change here. Mailto, and let's find the applications, +so we'll import chrome-mailto, OK, successful. There we have it here, so we're going to click OK. +Then we have three policies. + +Click OK to save these policy. Now we're going to minimize this. We're going to run cloudsync, and +you're going to see these applications change before your very eyes. There we go. Now we've got PDFs +opening up now in Adobe Reader. We've got this little video opening up in VLC now. You can see the +little pylon there. We've got our mailto link opening up in Chrome. It doesn't actually do anything +in Chrome, but the change was made. That's it. Thank you very much for watching. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/mdm.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/mdm.md new file mode 100644 index 0000000000..9b00952163 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/mdm.md @@ -0,0 +1,71 @@ +--- +title: "Managing File Associations with an MDM service" +description: "Managing File Associations with an MDM service" +sidebar_position: 10 +--- +# Managing File Associations with an MDM service + +Got PDF? And don't want Edge to open it? Or MP4, and don't want the built-in movie player to open +it? How about protocols like MAILTO: .. want to map those to Outlook? It's drop-dead easy.. with +Netwrix Endpoint Policy Manager (formerly PolicyPak) File Associations Manager. Trying to manage +with "Set a default associations configuration" is for the birds, and isn't flexible. Instead, +manage it quickly using Group Policy, and Endpoint Policy Manager. + + + +In a previous video, you saw me send file associations down to the right applications at the right +time for user side and computers using Group Policy. In this video, I'm going to show you how to do +it using your MDM service. Once you've got the file associations you want locked and loaded here in +the Group Policy editor, you're going to export the collection as an XML file. Then I'm going to +just drop it right on the desktop here. + +I already have one – no, I guess I don't. I'll do this PPFAM-EXPORT1. Once you've got that, the next +thing you're going to do is wrap it up into an MSI. To get ready to take anything in Endpoint Policy +Manager land or Group Policy and get it ready for MDM, first you have to get those items as an XML. + +Then we're going to use our Endpoint Policy Manager exporter utility, as you can see here. We're +going to Create a New MSI Installer. Then we're going to add those files after they've been dropped +down to XML. Then we're going to install them on the computer side. + +Typically you want all the settings to hit everybody on the computer, so we're going to install on +the computer side. Then we're going to save this out as a MSI file. There it is, and it's ready to +go. + +Next step is to get into Microsoft Endpoint Manager or your MDM service. In this example I've +already got the Client-Side Extension being deployed by Microsoft Endpoint Manager. I've already got +the Endpoint Policy Manager license by Endpoint Manager. + +What's next? You need to add the MSI file that you just exported and it's all wrapped up and ready +to go. Now it's time to go over to the client. Microsoft Endpoint Manager or your MDM service is +deploying all three of these things. They're assigned and you're ready to rock. + +Let's go over to the endpoint, and it's time to see the result. Here we are on the client. At this +point we're going to just take Microsoft Endpoint Manager or any MDM out of the equation, and you +can see what do we have? We've got Edge currently being the PDF viewer. + +We have the inbox video player and still asking questions, how do you want to open files? This is +not what you want to have when the user is on the road. Same thing for mail to; when they +double-click it, they're going to get the inbox Windows mailer. Not what you want. You don't want +these things. + +What we're going to do instead is we're going to use MDM to deploy the wrapped up Endpoint Policy +Manager directives. We're going to cut out the middleman for this example. We're going to +double-click on the MSI. You're using your imagination here. + +This is where MEM or your MDM service would do the work. Just wait a couple seconds here. Just like +that Endpoint Policy Manager does the magic, and you can see this is now associated with PDF. If we +double-click it, what do we get? You get Adobe Reader pop up, just the way we expect. The document +loads perfectly in Acrobat Reader. + +If we go ahead and double-click on this, what do we see? Instead of the inbox video player, we get +our video player that we want, which is VLC Media Player. There we go. There's our happy little +video. + +If we double-click on mail to, instead of getting the inbox mailer, we get the mailer of our choice. +I don't have Outlook. I use this thing called Claws Mail instead. You can see there's Claws Mail +running the first time. We're happy campers just like that. + +If you want to take your file associations on the road with you to your non domain-joined machines, +you can do it with Endpoint Policy Manager File Associations Manager and your MDM service like +Microsoft Endpoint Manager. Hope this video helps you out. Looking forward to getting you started +real soon. Take care. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/pdqdeploy.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/pdqdeploy.md new file mode 100644 index 0000000000..6ed6450223 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/pdqdeploy.md @@ -0,0 +1,221 @@ +--- +title: "Setting Default File Associations with Endpoint Policy Manager and PDQ Deploy" +description: "Setting Default File Associations with Endpoint Policy Manager and PDQ Deploy" +sidebar_position: 30 +--- +# Setting Default File Associations with Endpoint Policy Manager and PDQ Deploy + +PDQ is legendary when it comes to deploying applications. But when those applications are deployed, +the file associations you expect still don't magically work. That's why you should check out +Endpoint Policy Manager, and the Endpoint Policy Manager File Associations Manager. With Endpoint +Policy Manager File Associations Manager, after your applications are deployed, it's only a few +clicks to get ALL of your associations handled. Check out this video to see how to map everything +from Acrobat Reader to Outlook. + + + +### Setting Default File Associations with Endpoint Policy Manager and PDQ Deploy + +Katie: Hi, I'm Katie. + +Jeremy: Hi, I'm Jeremy. + +Katie: We're here to talk to you about setting file associations by default using Endpoint Policy +Manager and PDQ Deploy. + +Jeremy: That's right. + +Katie: We've all seen this before. You have a PDF and… + +Jeremy: What opens? + +Katie: In Windows 10, Edge. + +Jeremy: Everybody loves that, right? + +Katie: No. + +Jeremy: No. What do people really want? + +Katie: Probably Adobe Reader. + +Jeremy: I think so too. + +Katie: Usually do. We have another example. Over here we have a video. Chances are you are expecting +that to open up in Windows Media Player. + +Jeremy: Or something that you want like maybe VLC Media Player. + +Katie: Yeah. And last, you want to send an e-mail to somebody by clicking on a MAILTO: link. "Yes," +we would love to send some mail, but we didn't really want it to open up in Window 10 Mail. + +Jeremy: Probably Outlook or Thunderbird or something like that, right? + +Katie: Yeah. So we're going to show you how to deploy the applications so they're installed on your +target machines and then set the file associations with Endpoint Policy Manager. + +Jeremy: That sounds great. Why don't you go first. Let's have you deploy Acrobat Reader, VLC Media +Player and Thunderbird to "WIN10COMPUTER1." + +Katie: Yeah. So I've got my three packages here from the "Package Library," all the latest versions. +We're going to "Deploy Once" to "WIN10COMPUTER1." + +Jeremy: Great. If I wanted to do this on 100 machines at once, that's easy to do, right? + +Katie: Oh, yeah. You can pick them from inventory, Active Directory. You can pick them from +anywhere. + +Jeremy: Great. + +Katie: One machine is easy to type. We're going to deploy those guys. + +Jeremy: Just wait for this to finish, and we're off to the races, right? + +Katie: Yeah. + +Jeremy: Okay. Well, while we're doing that, why don't we get started with the Endpoint Policy +Manager part. We'll just leave this in the background, if that's okay. + +Katie: Yeah. + +Jeremy: We'll head over to our management station. Now to save a little bit of time, I preinstalled +those same applications on my management station. However, if you have a weird scenario where you +want to take some other machine that you don't have an application preinstalled, we have that +covered too. That's a different video. + +We'll go ahead for our Endpoint Policy Manager computers here, let's "Create a GPO in this domain, +and link it here" and call it "Everyone wants these associations." + +Katie: Just to be clear, this "WIN10COMPUTER6" would be like your machine or wherever you manage +your Group Policy from currently. + +Jeremy: Exactly right. Wherever you have the GPMC, you have the Endpoint Policy Manager management +console built right into the GPMC right here. + +We'll do this on the computer side. We'll go to "Endpoint Policy Manager" and we'll go to "File +Associations Manager for Windows 10." If you ever tried this on Windows 7, it was really pretty +easy. On Windows 10, it's like near impossible, which is why we try to make it drop-dead easy. + +What we'll do is we'll click "Add" a "New Policy" here. Most people don't know what I'm about to +say. PDF is not the only thing that Acrobat Reader can do. If you say "pdf rule" by way of example +and just type "pdf" here, we're going to note when we click on "Select Program" we're going to look +at all the things on this machine that claim they can do PDF. It turns out there are a couple of +things that can do that. + +But I'm going to go the next mile. Actually, I don't want to just do PDF. I want to all the things +Acrobat Reader can do. + +Katie: You're going to do all of its defaults. + +Jeremy: All of it. Exactly. You got it right. Select "Add" and then select "Add Policies for Product +(wizard)." I'm going to pick the same application, so "Simple Mode." We'll pick "Adobe Acrobat +Reader DC." It's not just PDF. It's like seven things. Look at all these things that Acrobat Reader +really wants in order to be perfectly associated. We'll "Check All" those guys. Click "Next." We +make a little collection for you and click "Finish" and you are done. If we look inside here, we've +got all seven ready to go. + +Let's talk about VLC Media Player next. Let's do that exact same step for VLC Media Player. We'll do +"Add" and then "Add Policies for Product (wizard)." We'll click on "Simple Mode" here. We'll pick +VLC. It's probably toward the bottom, so I'll just type it out: "vlc." Take a guess. How many +associations does VLC Media Player have? + +Katie: Oh, it can have so many. + +Jeremy: "So many." That is a perfectly fine answer. Let's take a look. It is a freaking lot of them, +so we'll just click on "Check All," click on "Next." We've got the little thing ready to go here. +Click on "Finish." Let's take a look at the actual number when we click on it here. + +Katie: Let the computers do my counting. + +Jeremy: Yes. We go all the way to the bottom. It's so many: mp4, mp3, etc. It's 125 things they +claim that it can do. + +The last thing we said we wanted to do was to change over the mail program from the Windows internal +mail to something more graceful. We'll go to "Add" a "New Policy." This will be a simple one. This +is actually not an association. This is a network protocol. We'll call this "mailto rule." Then +we'll make "Network Protocol" here, and we'll call this "mailto." + +We'll "Select Program." Again, on my machine – the machine I'm on – we're going to figure out what +applications claim they can do mailto rules. There we go. We'll go ahead and pick "Thunderbird" as +our thing. We have a customer that says, "We're going to the all Google channel. We're doing the all +Google thing." Sure enough, if you want to make "Google Chrome" be you're mailer, it will absolutely +do that. We're going to use "Thunderbird" in this example. Click "OK" and we're ready to go. It's as +simple as that. + +Can you tell me if the package has made it there? + +Katie: Sure. Let's pop open Deploy and look. + +Jeremy: Go ahead. Let's pop open Deploy and look. + +Katie: We're back over here. + +Jeremy: I can see, yeah. + +Katie: It looks like we are about partway done with Thunderbird. + +Jeremy: Okay, so we still have Thunderbird in the wings. While that's cooking with gas, let's take a +look at it from another angle. Let's go to "Control Panel" because I like to see it this way because +I'm an old-school guy. + +Katie: Probably by the time we get that open, we should see Thunderbird installed. + +Jeremy: Almost there. Not quite. Okay. + +Katie: All right. It looks like all of our deployments are done here. We have "Adobe Reader," "VLC +Media Player" and "Mozilla Thunderbird" all successful, all done. + +Jeremy: Nice. Super nice. + +Katie: Yeah, so let's go back over to the computer and look at the Control Panel. + +Jeremy: I would love to do that. Let's go back to "Control Panel" here. I like to check it out +because I'm an old-school kind of guy. Yes, I see all the things that I am expecting. + +Now in order for this policy to kick in, two things have to happen. The first one is you have to get +the actual Group Policy Object down to the machine. + +Katie: It has to apply. + +Jeremy: It has to apply first. This one is a little extra special. You have to log off and log back +on to see the actual final results. So we're going to get the GP Update ("gpupdate /force") first, +log off, log back on, and then we're going to see the final results in play here. + +We'll wait for this to finish. We'll then go ahead and close the window and then log off. There we +go. We'll go ahead and log off here. We'll "Sign out." Then we'll go ahead and relaunch +"WIN10COMPUTER1." I think I know the password. I have a little cheat sheet here. Here we go. + +Katie: That's good because I don't know that password. I do like the account name though: +"toni.blurp." + +Jeremy: All right, now we're logging back on and just like that. + +Katie: Everybody's changed. + +Jeremy: Let's go ahead. PDF, do you think it's going to launch the right thing? It certainly looks +like it. + +Katie: Yeah. Right icon right there. + +Jeremy: Yeah, that looks like the right thing. + +Katie: That's promising. + +Jeremy: There we go. Acrobat Reader is doing good. Now you can even see the little VLC Media Player +kicking in right there, and there we go. There's VLC doing its thing. + +Katie: Check that out. + +Jeremy: Then finally, mailto. We're going to click on the link. Before, it was running Windows Mail, +and now Thunderbird. There we go. + +So just like that, you can use PDQ Deploy to deploy the applications you want on your endpoints and +use Endpoint Policy Manager to do the magic to marry the right association to the right file type. + +Katie: Yeah, so simple. + +Jeremy: So simple. That's it for us. + +Katie: I'm Katie. + +Jeremy: I'm Jeremy. Thanks for watching. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/_category_.json b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/_category_.json new file mode 100644 index 0000000000..ec873edc2f --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips And Tricks", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/acroreader.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/acroreader.md new file mode 100644 index 0000000000..c894db660a --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/acroreader.md @@ -0,0 +1,173 @@ +--- +title: "Endpoint Policy Manager File Associations Trick: Acro Reader AND Writer" +description: "Endpoint Policy Manager File Associations Trick: Acro Reader AND Writer" +sidebar_position: 70 +--- +# Endpoint Policy Manager File Associations Trick: Acro Reader AND Writer + +How do you make PP File Associations "think" about what to do, and have one group of associations +with Acrobat READER and another with Acrobat WRITER. Here's how. + + + +### PolicyPak File Associations Trick – Acro Reader AND Writer + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Endpoint Policy Manager +Software. In this video, I'm going to show you how you can use Endpoint Policy Manager File +Associations Manager to have a bunch of brains and figure out I want to associate PDFs with Acrobat +Reader when I see only that and I want to associate PDFs with Acrobat Writer when I see that. + +What I've just done just to prove a point is I've installed Acrobat Writer all the way to the end. +You can see even then it doesn't actually make it the viewer. It asks you "How do you want to open +this file?" I actually am not going to select anything in particular to "Always use this app to open +.pdf files." I just want to show you what the default is, which is still "Microsoft Edge." + +You'll probably end up getting this exact same experience when you deploy Acrobat Reader and Writer +using your SCCM or PDQ Deploy or whatever. It just doesn't change underneath the hood because that's +changed in Windows land. + +Let me continue to explain my set up here. This machine has Reader and Writer. I happen to have an +old version of Reader, but the kind of stuff we're going to do here is exactly the same. In fact, I +love this: "Make Adobe Reader my default PDF application." Go ahead, sure. Say "OK." What happens? +It doesn't actually do it. It forces you to do it through the system. That's what we're going to do, +but we're going to do it programmatically. + +Again, my lash up here is that this machine has Reader and Writer. They're two totally different +versions, and it doesn't matter. That part is not important. On my own machine, my own management +station here, I have "Adobe Reader," but I'm too poor to install a second copy for Writer. I'm not +going to do that. I'm making this demo hard on myself, which is going to make it a little longer but +it will be worth it. + +Let me go over to my third machine here. Actually, nobody is logged on here yet. Let me go ahead and +do that: "eastsalesuser1." This guy is also going to have just Reader. There we go. Now I'm logged +on, and you can see "Adobe Reader" here. In fact, let me drag a PDF file in there. Okay, just to +prove a point, here we go. There's "Microsoft Edge" running here and, of course, we want it to open +up in Acrobat Reader. + +So to set the stage one last time, I've got my management station. My management station has "Adobe +Reader" but not Writer. I have machine number one. He has "Adobe Reader," and machine number two has +Reader and Writer. Okay, that's the stage. + +The first thing is, let's make it so that PDF associates with Acrobat Reader. In order to do that, +we're going to do this where our computers live. I actually have to move one of my computers into +the right place. Let me go ahead and move my "COMPUTER10," this new guy, into "Sales/East Sales/East +Sales Desktops." This dude has to go here. + +Now my computers are in the same place. These two computers are hanging out. They're in the same +place. That's what we wanted. Just to make this guy know that has happened, I'm going to run +"gpupdate /force" or else he won't know that he has made that change. We'll let that cook for a +second. + +Now over here, we're going to do this for our "East Sales Desktops." We're going to right click, +"Create a GPO in this domain, and link it here" and say "PPFAM for Acro Reader and Writer." We'll +right click, click "Edit" on this guy. This has to be done on the computer side. We'll dive down +under computer side, "Endpoint Policy Manager /File Associations Manager for Windows 10," right +click, "Add" a "New Collection." + +Actually, you know what? Hold on. Let me not do that. Let me show you we can actually do this thing +first called "Add Policies for Product (wizard)." I'm going to pick "Simple Mode" and pick the +"Adobe Reader" on this machine. When I do, look at all that stuff that lights up because Acrobat +Reader is more than just PDFs. I'm going to "Check All." I'm going to select "Next." I'm going to +make my own collection in real time called "Adobe Reader Policies" and click "Next" and slam it all +in. + +Now if I did nothing at all, these two machines would automatically now associate PDF and all this +other stuff with Acrobat Reader. But how do I separate it? Because I'm about to do Reader and +Writer. Well, it's easy enough. + +Right click. We're going to "Change Item Level Targeting" on the folder. We're going to say only do +this stuff when I see Acrobat Reader. Now there are a couple ways you can do this. One way is by +"MSI Query." You can say if I'm looking for Acrobat Reader. That's one way to do it. + +But I actually think a better way to do this is by "New Item/File Match." On this machine and +hopefully on your machine also, it has to be in this place: "Program Files/Adobe/Reader." It has to +match up. We're looking for "Reader/AcroRd32." So if "AcroRd32" exists in this place, that matches +the version of Acrobat Reader. When I click "OK," it lights up orange. These things are only going +to take effect when I see Acrobat Reader. If I don't have Acrobat Reader at all, it's just not going +to take effect. + +Let's stop right there and just see that this part works. In fact, I can do it on both machines. +I'll run GP Update ("gpupdate") on the first machine and I'll run GP Update ("gpupdate") on the +second machine. We're going to see because I haven't set up anything yet for Acrobat Writer, this is +going to associate everything directly to Acrobat Reader. + +Let's just start here and make sure this works. File Associations Manager only works after a GP +Update and then a log off and a log on. So you won't see it happen in real time. You have to run GP +Update, then log off, then log back on. So I'll go ahead and do that here. I'll go ahead and "Sign +out" of each of these machines, and my expectation is that I'll get the same exact results. Let me +go ahead and "Sign out" here, "eastsalesuser1." The same guy is going to be logging on to this other +machine here. + +Now if I go back to machine one, it worked perfectly. The machine that has Acrobat Reader launches +the PDF with Acrobat Reader just the way we would expect and life is good. There we go. There's our +PDF. If we go over to the machine that has Reader and Writer, hey, look at that. That's exactly what +I said it was going to do. It's using Acrobat Reader. + +Now the next part of this demo is, how do we get it for machines that have Reader and Writer or just +Writer to take the PDF instead of that? Remember, I made this demo on purpose hard for myself. I +said my very own machine doesn't have Acrobat Writer. That makes this demo a little harder. + +I have to go over to the machine that actually has Acrobat Writer on it. On the downloaded bits from +Endpoint Policy Manager land here, when I click in the download here, we have a little program in +the "Endpoint Policy Manager Extras" folder called the "Endpoint Policy Manager File Associations +Manager Helper." + +Remember, I don't have Acrobat Writer, so I have to go over a machine that does have it. That's what +this program helps you do. We're going to suck out it's brains by selecting "Export associations +(per product)." What product am I going to do this time? Not Reader but Writer this time. + +I'm going to find my application which is Acrobat Writer ("Adobe Acrobat DC" or whichever version +you're using.) We're doing the exact same steps as we were doing earlier. We're going to "Check All" +the associations. There's PDF and there's all this other great stuff. Once I click "Next," I have to +"Export to XML" because I don't have the ability to edit GPOs as a standard user. So I'm going to +"Export to XML." + +I'm going to chuck it on the server: "\dc2016sharePPFAM-acro-export." Now it's over there waiting +for me on the server. I'll go back over here. Let's go ahead and find it. It's now in "C:share." +Here it is: "PPFAM-acro-export." Let me try this. Can I just drag and drop this here? Why, yes, I +can. + +Now I've got one folder with the Reader policies ("Adobe Reader Policies") and one folder with the +Writer policies ("Adobe Acrobat DC Policies"). What do I need to do? I need to say "Change Item +Level Targeting" to make that stuff kick in. What stuff if that? All these associations. Make those +associations kick off, when I can see Acrobat Writer. + +How do I know what Acrobat Writer is? Let's go ahead and right click, go to "Properties" here. We're +going to take this "Target" location and match that as the string. I'll "Copy" that guy over here. +I'll go back over here to the folder, the collection. I want to "Change Item Level Targeting" on the +folder and only do this thing when I have a "File Match," so we're saying when I see the full Writer +version of Acrobat. + +Now that I've got all that ready to go, let's look at it. We have this batting order that says when +I see Acrobat Reader do this first, and then when I see Writer do that second. The batting order +here matters. You're going to do the stuff in "1" first. Because that computer has Reader and Writer +on it, it's going to do the Reader thing first but it's going to get overwritten by the Writer thing +second. That's all there is to it. + +Let's go back over to this machine that currently has Reader associated with the PDF. Let's run GP +Update ("gpupdate") here. Remember, we won't see this in real time. We have to log off and log back +on. At that point when we double click it, it shouldn't be Reader anymore. It should be Writer. +Let's go ahead and see if that is all true. We'll go ahead and "Sign out." We'll sign back in. + +Just like that, it worked perfectly. We double click here and what fires out? Acrobat Writer. It's +making me sign in, but I don't want to. But that's the gist. It's actually using Acrobat Writer to +do the work and not Acrobat Reader. + +Back on this machine here just to prove that I'm not pulling a fast one on you here and it still +works on this machine, I can show you that if I were to run GP Update ("gpupdate"), log off and log +back on, it's not going to change. It's now stuck correctly with Acrobat Reader. I'll go ahead and +just prove that real fast. Let's go ahead and "Sign out." When we log back on, absolutely nothing +interesting should happen. That's the whole point. It should just keep on working. There we go. + +Just to lay it out one more time, using Endpoint Policy Manager +for [Endpoint Policy Manager File Associations Manager: Manage Windows 10 & 11 File Associations](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/windows10.md) with +collections, the collections have the brains. The brains are you're going to use "Change Item Level +Targeting" and say do the stuff in the collection when I see the application I want to manage. For +instance, this one is Acrobat Reader. This one is Acrobat Writer. Once you have that, you've +utilized either a machine that has the associations already built into it or you've used our little +helper utility to suck its brains out and push it in here. + +With that in mind, that's all there is really to it. Hope this helps you get on the road with +Endpoint Policy Manager File Associations Manager. Looking forward to getting you started real +soon. +Thanks so much. Take care. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/adobereader.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/adobereader.md new file mode 100644 index 0000000000..5f0b13a72b --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/adobereader.md @@ -0,0 +1,49 @@ +--- +title: "Force IE to use Adobe Reader for PDFs" +description: "Force IE to use Adobe Reader for PDFs" +sidebar_position: 10 +--- +# Force IE to use Adobe Reader for PDFs + +Ever wished you could force Internet Explorer to open PDFs in Adobe Reader instead of the IE +browser? Using the Netwrix Endpoint Policy Manager (formerly PolicyPak) Application Manager and File +Associations Manager combo, you can. + + + +### Endpoint Policy Manager: Force IE to user Adobe Reader for PDFs + +Hello. This is Sal from Endpoint Policy Manager technical support. In this video, I'm going to show +you how you can set up your Internet browser. Whenever you open a PDF file, it should open in the +Adobe program. It should not open that into the Internet Explorer browser. + +Right now, when we click on the link which has a PDF file, it straightaway gets us into the Internet +Explorer browser in a PDF reader. The reason we are seeing that is because if we go into "Manage +add-ons" and if we launch the add-ons "Run without permission," you'll see that "Adobe PDF Reader" +is installed and it is "Enabled." That's the thing which is preventing the Adobe program to launch +whenever there's a PDF file link. + +We're going to demonstrate in the next part how we can make the Adobe program launch PDF files. I'll +go into my domain controller. The first thing I'm going to do is under "File Associations Manager +for Windows 10" under "PolicyPak" I'm going to configure a policy where it says whenever there's a +"pdf" "File Extension," open that into "Adobe Acrobat 2017." + +Once that is configured, the next thing you want to do is go into the "Application Settings Manager" +and place in the class ID of Adobe PDF Reader add-on. The way you can extract that is if we go back +to the machine and launch IE again, go into "Manage add-ons," "Run without permission," and double +click on "Adobe PDF Reader." Just "Copy" that information, and then you can paste that into +"notepad." We just need to extract that information, "Class ID." + +Once you have that on your clipboard, you can close everything out here. Going back to your domain +controller where you are going to configure the policy, go into the "Programs" tab of "Microsoft +Internet Explorer 8 and Later for Windows 7 and Later Settings" preconfigured Pak from Endpoint +Policy Manager. Then go into "Manage add-ons" and that's where you're going to put that Class ID for +Adobe PDF Reader add-on for IE and comma, space, "disable." That's all that you need to do. + +Once it's there, you can go back to your machine and run GP Update ("gpupdate"). I'm going to do +that now. Once it's done, you can launch IE again. Just to verify, let's go into "Manage add-ons" +and "Run without permission" and you'll see that "Status" is now "Disabled" for "Adobe PDF Reader." +If now we click on the link to a PDF file, it will now launch that PDF file into the Adobe program +itself. + +Okay, I hope it helps. Thank you. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/firstlogin.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/firstlogin.md new file mode 100644 index 0000000000..9124174fcf --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/firstlogin.md @@ -0,0 +1,73 @@ +--- +title: "Endpoint Policy Manager File Associations Manager: Understanding the First Login" +description: "Endpoint Policy Manager File Associations Manager: Understanding the First Login" +sidebar_position: 50 +--- +# Endpoint Policy Manager File Associations Manager: Understanding the First Login + +This isn't a problem with Endpoint Policy Manager File Associations Manager, but it's worth noting +the behavior of what occurs at very first login. Good news: There's a quick fix; just log out and +back on, and then.. boom. Problem solved for good! + + + +:::note +This is OLD behavior; Endpoint Policy Manager doesn't require logoff and back on for File +Associations unless the old method is specifically enabled. This would only be requested by Endpoint +Policy Manager support team. +::: + + +### Endpoint Policy Manager File Associations Manager: Understanding the First Login + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Endpoint Policy Manager +Software. In a previous video, you saw me use "Endpoint Policy Manager File Associations Manager" to +make a couple of mappings. For instance, mapping "PDF to Acrobat" Reader, mapping "MP4 to VLC +Player," mapping the mailto protocol to Outlook ("Mail in Outlook)" and mapping "XML to Notepad++." + +Now what I didn't show in the other video is what happens if a user has never logged on before that +is logging on for the very first time. I'm going to log on as a guy called "eastsalesuser7." Now +when somebody logs on for the very first time, it does take a little longer than usual. + +This is not because of PolicyPak, of course. This is because the profile doesn't exist at all and +the Windows 10 profile is bigger than older profiles and, therefore, takes longer to log on. So I'll +pause the camera for a second, wait until this is done logging on, and then we'll continue our +little chat. + +Okay, now that this user is fully logged on, they would have no documents because they have nothing. +Let's go ahead. I actually have a couple of documents on the server we can use to verify our example +here. I'm going to map a drive: "net use \* \dc2016share." In the "share" I have a couple of files, +for instance here, my "File Associations Examples." + +Now remember, we did all the mapping already. We're logging on for the first time, so Group Policy +has kicked in. In fact, I could drag these to the desktop, which will show the same thing. Here's +what's strange about the very first time you log on. The very first time you log on and then you try +to double click on any of your items here, you still get this annoying popup. There's no way around +it. This is just the way that the darn thing works inside Microsoft's guts. + +So you can see that a user will be prompted for this one time. They can even select the wrong thing, +and that's fine. Endpoint Policy Manager will kick in the second time around. For instance, if you +click on this one, it will open up Acrobat "Adobe Reader," and the file is presented.If we were to +click on the XML for Notepad++, we also get the same thing, which is pretty annoying. + +Let's just close this for now, and then we'll go ahead and log off and log back on. If we click on +the movie file, however, we can see that works just fine. That one subscribed just perfectly. Then +let's take a look at the mailto one. The real point is what happens when you click on a mailto link. +That one worked just as expected. + +So it's sort of a mixed bag at the first time you ever log on. Again, this is not a Endpoint Policy +Manager File Associations Manager problem. It's just we rely upon the guts of what's in the +operating system. But let's see what happens the second time they logon. If they go ahead and log +off here("Sign out") and now that this person has logged on before, let's log them on again. This is +the same guy who was just logged on ten seconds ago. + +Now that we're all logged on for the second time, let's see the two problem areas. The first problem +area was the PDF, and no problems the second time. Okay, let's close that out. Now we'll go ahead +and try to run XML to open up Notepad++. What happens there? No problems the second time. And the +other ones worked the first time, so there's really no point in rechecking those. + +The point of the story is, though it sometimes depends on the application, it may take two times for +that person to log off and log back on not to see those prompts anymore, so do keep that in mind as +you're using Endpoint Policy Manager File Associations Manager. + +I hope this helps you out. Looking forward to getting you started real soon. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helperapplication.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helperapplication.md new file mode 100644 index 0000000000..aa4221eb23 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helperapplication.md @@ -0,0 +1,75 @@ +--- +title: "Endpoint Policy Manager File Associations Manager: Helper Application" +description: "Endpoint Policy Manager File Associations Manager: Helper Application" +sidebar_position: 60 +--- +# Endpoint Policy Manager File Associations Manager: Helper Application + +If you have an application you simply cannot install on your own Management Station, then use the +included PPFAM Helper utility to capture the association, then bring the XML file over to your +machine. + + + +### Endpoint Policy Manager File Associations Manager: Helper Application + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can use the Endpoint +Policy Manager File Associations Manager Helper program if you're in a situation where you only have +a single or handful of machines that have an application installed and you can't get it installed on +your own machine. + +In previous examples you saw, and in fact I said quite a bit, Endpoint Policy Manager File +Associations Manager is best when your machine has the same applications installed as your endpoint +machine. Now, there are going to be sometimes when you can't do that. Maybe there's a sales +application or some marketing thing or some wacky application that you cannot get installed on your +machine but yet you need to make the file associations happen for it. + +We have a way to do that. It's called the File Associations Manager Helper program. In this example, +I'm going to use "WinRAR." I'm going to pretend for a second that the end user has WinRAR installed +but you can't get WinRAR installed on your machine for whatever reason. Again, we're going to +pretend that this is some kind of wacky application you can't get installed. + +On the download, we have this thing in the "Endpoint Policy Manager Extras" folder called "Endpoint +Policy Manager File Associations Manager Helper" "Application." Now don't click on the ".exe" which +is really an XML file. We'll go ahead and double click on that there, and this is the application to +run. We'll go ahead and click "Next." + +What you're after here is you're going to find the application by extension, like "RAR" is a +particular thing for WinRAR. You can "Apply Filter" and find "WinRAR" right here because it's on the +endpoint machine. We'll go ahead and click "Next." + +You have a couple choices. One is "Include icons in file (Can dramatically increase file size)." I +say go for it because I think there's very little downside in doing that even though the file size +here for the XML is a little bit bigger. + +You can "Show file in folder after finished" and you can also "Open XML in Notepad when save is +complete." I'm going to "Browse" and put this in "c:temp" and then I'll call this "RAR-OUT.xml." +"Yes," I'll create it. I'll go ahead and click "Finish" and here's the file. + +What we're saying is we want to take the "RAR" "Type" and associate it with "WinRAR" that's on this +machine, and here's the icon. Now the hard part is getting it over to your machine. I'm going to do +a little magic, and I'm going to have this over on my machine in two shakes of a lamb's tail. + +Okay, so here is my machine, and here's the "RAR-OUT" file. Again, this is going to help me make +that association. What I'll do is go ahead and create a new GPO or use an existing GPO. It doesn't +really matter. I'll say "PPFAM Use Mapping from XML file." + +Now this is a little bit special, this XML file, because you might be familiar with Endpoint Policy +Manager export and import routines. You can just click on computer side, "PolicyPak" here and click +on "File Associations Manager." You would think you could just right click here or "Import +Collection." But it's not a collection. Actually, you have to add your own item first. + +So we're going to click "Add/New Policy" here and we'll call this "WinRAR to RAR." You'll type in +"RAR" here. Then you're going to "Select Program." But remember, on your machine you don't have +WinRAR. This is where you "Import." We'll go ahead and click "Import/From XML file." You'll pick the +"RAR-OUT" file you had earlier. There's the icon and so on. You'll double click it, and at this +point you have it locked and loaded and you're ready to go. + +That's it. This is how you would take an existing machine that had something you couldn't get on +your machine with the GPMC and you can export an entry and then you can add it in manually using the +Endpoint Policy Manager MMC console. + +I hope this helps you out. If you're looking to get started, we're here to help you get started too. +Just join us for the webinar and see you onboard. + +Thanks. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helpertool.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helpertool.md new file mode 100644 index 0000000000..83b653d147 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helpertool.md @@ -0,0 +1,109 @@ +--- +title: "File Associations Manager Helper Tool" +description: "File Associations Manager Helper Tool" +sidebar_position: 40 +--- +# File Associations Manager Helper Tool + +What happens if you're using the Netwrix Endpoint Policy Manager (formerly PolicyPak) File +Associations Manager, and you want to associate a file to a program that's not on your management +station? Use the File Associations Manager Helper Tool, then use the resulting XML file to manage +File Associations on your MDM enrolled machine like a boss! + + + +### Endpoint Policy Manager MDM: File Associations Manager Helper Tool + +Hi, this is Whitney with Endpoint Policy Manager Software. In the last video, we learned how to +associate file extensions with applications that were located on both the endpoint and the +management station. But what are you going to do if you have an application on your endpoint that +you want to associate a file extension with, but you can't get that application on your management +station? Well, we have a little helper utility that will help you take care of that. + +However, just as a refresher, in order for anything File Associations Manager to work, your endpoint +has to be domain joined. Right here, you can see I am both enrolled in an AirWatch MDM service +("Connected to AirWatchMDM MDM") and I am domain joined as well ("Connected to FABRIKAM AD domain"). +Those are very important things for you to know. It has to be domain joined, and it's a self-imposed +Windows limitation that we just can't get around. So that's something you just need to know about. + +The next thing we're going to notice is, once again as you saw in the last video, we do have the +"Endpoint Policy Manager Client-Side Extension" and the "Endpoint Policy Manager MDM Licenses for +PolicyPak" installed on this machine. We deployed those using AirWatch, and that just needs to be +there before any MDM directive is going to work. Now I mentioned AirWatch. It's the one that I'm +using, but you can use any MDM solution that you have as this will work with any of them. + +Let's close this down. Let's notice I have a zip file right here. Right now it's associated with +WinZip. When I open it up, of course here we go, it pops open in "WinZip." However, what if I want +to associate it with "WinRAR"? + +Well, I don't have WinRAR on my management station. In order to fix that, we're going to go into the +"Endpoint Policy Manager Bits" folder. We're going to choose "Endpoint Policy Manager Extras," and +we're going to go look at the "Endpoint Policy Manager File Associations Manager Helper." Now make +sure you get the actual "Application" instead of the "exe.config." + +We're going to open this up. Basically, what we're going to do is export the information about the +particular application as an XML file. So we're going to "Export registered applications," and we're +going to click "Next." + +It asks us what extension are we looking to associate with an application, so we're going to go with +"zip." We're going to "Apply Filter." When we do that, it's going to show us everything that can +handle zip files. In this case, I want to use "WinRAR," so I'll click "Next." + +It asks if we want to "Include icons in file (Can dramatically increase file size)." It's not really +that big a deal, so I recommend going ahead and checking that box. We're going to save it somewhere. +Since my machine is actually domain joined, I'm going to save it to my "SHARE" folder so that I can +access it on my management station. I'm going to save it there. I'm just going to call it "WinRAR" +and "Save" it. Let's create it, "Yes." "Finish" up, and that's that. + +Now we're going to go back to our management station. Actually, in that same GPO that we created in +the last video, I'm going to add the WinRAR settings or associations. Let's go ahead and "Edit." +Let's go ahead and go back to where we were before. We'll go back to that same collection. We'll +choose "File Associations Manager for Windows 10" and get inside here. + +We're going to "ADD NEW POLICY" just like we did before. I want "Zip to WinRAR." That is a "File +Type" and the "File Extension" is "zip." I'm going to go to "Select Program." Now what it's going to +do is the same thing it did before where it's looking on my management station to see what I have +that can handle zip files. + +Well, I don't actually want to use either one of these. I want to use my WinRAR. So I'm going to +"Import" from an XML file. I'm going to go to my "SHARE" folder here and use that XML that we +exported just a couple of minutes ago. Now it's going to pop up and show me, there we go, we have +that "WinRAR." I'll tell it "OK," and that's that. + +What we're going to need to do is the same thing we did in that last video. We're going to "Export +Collection as XML." I'm going to put this on the "Desktop." I'm going to call it "FAM Settings2." +We'll "Save" that. We'll close all this out. + +Let's go to our exporter tool which installs alongside your admin console MSI. We'll go to the +"Endpoint Policy Manager Exporter Tool." In this case, I don't actually want to "Create a new MSI +installer." I want to modify the previous one. So I'm going to "Open an existing MSI installer +previously generated by this tool for editing." + +I'll choose "FAM Settings." We're going to get rid of this old XML, and we're going to add some new. +We'll add the "FAM Settings2" there. Once again, we'll "Install For" the "Computer" with a "Target" +of "All Users" and we'll choose "Next." It versions it for us, so you don't have to do that +yourself. We'll leave it with the same "Product Name." We'll go ahead and click "Next" and "Save" +it. There we go. + +The reason we're doing it this way rather than deploying a completely new MSI is because the way +that it's set up, it will actually uninstall the old one to then install the new one. So it just +upgrades it. So we will go ahead and "Finish" up here. + +Now this is our new MSI that we just updated. We'll do like we did before where I'm going to pause +the video while I get it uploaded to my MDM console and then get it deployed. Then we'll come right +back once you can see the results. We'll be right back. + +And we're back. You'll note that we still have the "FAM Settings" installed here as you saw before, +but note this time it's "Version" "1.0.1" so we know that's the upgraded version. However, we notice +this icon hasn't changed yet. The reason is because we need to log out and log back on before these +settings will take effect. We're going to go ahead and do that, and we'll come right back in just a +moment when it's done. + +All right, and we're all logged back in. You can see that did indeed take effect once we logged off +and logged back on. So you can see it, let me just go ahead and open this up just to put a fine +point on it. There we go. We have this opening up in "WinRAR" just like we told it to. + +That's how you're going to fix the problem of having an application on your endpoint that you just +can't get on your management station but you still want to associate files to it. + +Thanks for watching, and we'll see you in the next video. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/mailto.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/mailto.md new file mode 100644 index 0000000000..2f8ca85f35 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/mailto.md @@ -0,0 +1,87 @@ +--- +title: "Endpoint Policy Manager: How to get mailto: to open in Office 365" +description: "Endpoint Policy Manager: How to get mailto: to open in Office 365" +sidebar_position: 20 +--- +# Endpoint Policy Manager: How to get mailto: to open in Office 365 + +Use Endpoint Policy Manager File Associations Manager to use OWA URL links to compose message +directly in Office 365. When done OWA will be the default handler for the mailto protocol in +Windows, so that clicking an email address will open the OWA "Compose message" window. Hope this +helps you out. + + + +Code: + +``` +`@echo off +set address=%1 +set address=%address:~7% +rundll32 URL.DLL,FileProtocolHandler "https://outlook.office.com/?path=/mail/action/compose&to=%address%"` +``` + +### How to get mailto: to open in Office 365 + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can make your mailto +handler actually open up a web browser such that it will launch Outlook web access. + +Let me show used to the result of what I put together. When you go ahead and click on a mailto like, +it says "Do you want to open this link?" What's it going to do? It's going to open up your default +browser and, provided you've already logged on to Office 365, it's then going to automatically send +that mail to that person. It's just that simple. + +How did I perform this magic here? The first thing is that I have a little batch file. I put it in +"temp," and I just called it "`a1.bat`." Let me show you what it does here. The first thing it does +is that it silences it as much as it can ("@echo off"). + +Then it says "set address=%1" which means it's going to take in the item that you're passing. So +that would be the address: "mailto:jeremym@endpointpolicymanager.com." Then what it does is removes the first +seven characters which would be "mailto:" and then what we do is that we run the default browser +against the special link in "https://outlook.office.com" and then we put in "`%address%`" which is +the address without the "mailto:". + +The net result, as you can see, is that when you click it and click "Yes" you do get that very brief +flash of the DOS prompt, but the net result is that you get exactly what you're after here. + +Now let me show you how I set this up in File Associations Manager in Endpoint Policy Manager land. +You have to do this on the computer side in "File Associations Manager." Then here is how to do it. +You give it any "Policy Name" you want. You use the "Network Protocol." You have to use "MAILTO." + +Then we use a "Custom application." I'm going to say that my custom application is where that batch +file is: "`c:\temp\a1.bat`." Then you're going to pass it "%1." The "Application Name" itself +doesn't really matter, and you can select any "Application Icon." That part is not of real concern. +So this is the "Associated Program" and that is the "Command Line." That's all there is to it. + +Once you've done that, you're off to the races. It will automatically associate correctly. All you +have to do is run GP Update ("`gpupdate`"), log off and log back on once, and you're good to go. + +Now the next thing about this is that you may want to change the default browser, and that is +totally supported as well. That's going to be in Browser Router. I already have a Browser Router +policy, so I'm just going to modify that guy. + +I think my default browser right now is Internet Explorer, but let's go ahead and check it out. If I +were to go to Browser Router, "Endpoint Policy Manager" and go to my "Browser Router" settings here +and if I were to check my "Default browser," it's "Internet Explorer." Let's go ahead and change +that to "Google Chrome" or "Edge" or whatever you want. I'll go ahead and click on "Google Chrome" +here. I'll set that. + +Then I'm going to run GP Update ("`gpupdate`") to get my latest directives here. After I do this, my +goal is that I want to launch the mailto again and this time it will automatically go to Chrome. Now +if I haven't logged on to Office 365 in Chrome yet, then it may not automatically open up the Office +page, but you get the gist. It will have opened Office through Chrome, just not having not logged on +yet. + +All right, let's go check it out. Let me go ahead and click on the email link and click "Yes." What +do we get? We got Chrome automatically. We can see the log on page here. I just haven't quite logged +on yet, but when I do it will then pass that all the way through, pass the correct items directly to +Office 365. + +Therefore, any time you click on a mailto link, you're automatically going to the default browser +and passing in the special characteristics to open up that page in Office 365 and Outlook instead of +a mail program that's local. + +If you like what you see here and want to get started with PolicyPak , then go ahead and we'll see +you in the webinar. Then after that, we'll hand over the bits, and you can try it out yourself. + +Thanks so very much, and we'll talk to you soon. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10modify.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10modify.md new file mode 100644 index 0000000000..3003f462b9 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10modify.md @@ -0,0 +1,231 @@ +--- +title: "Windows 10 File Associations: Set, Change and Remove Easily" +description: "Windows 10 File Associations: Set, Change and Remove Easily" +sidebar_position: 30 +--- +# Windows 10 File Associations: Set, Change and Remove Easily + +Getting Windows 10 file associations to work can really be a pain. Just mapping a PDF to work with +Acrobat can be a challenge with Windows 10. Or getting MAILTO to work with outlook. This used to +work great in Windows 7 with Group Policy, but not anymore. To change Windows 10 File Associations +you need Netwrix Endpoint Policy Manager (formerly PolicyPak) File Associations Manager, which can +be seen in this demo. + + + +### Set, Change and Remove Windows 10 File Associations + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Endpoint Policy Manager +Software. In this article, I'm going to show you how you can manage Windows 10 file associations +using Endpoint Policy Manager File Associations Manager. + +#### Before Getting Started with Windows 10 File Associations Management + +Before getting started with Windows 10 file associations management, I want to show you that I have +two very similar machines. This first machine is going to represent your machine, Mr. or Ms. Admin's +machine. The second machine represents Mr. or Ms. endpoint machine, the person who actually uses +stuff. + +![21_1_windows-10-file-association-demo-admin-machine](assets/21_1_windows-10-file-association-demo-admin-machine.webp) + +Figure 1: Admin Machine + +![21_2_windows-10-file-association-endpoint-machine](assets/21_2_windows-10-file-association-endpoint-machine.webp) + +#### Common Windows 10 File Association Issues + +Both machines are very similar, but I actually want to demonstrate sever Windows 10 file association +issues that you've probably seen and have driven you crazy. + +#### Problem #1: Change Windows 10 File Associations for PDF + +![21_3_windows-10-file-association-pdf-edge](assets/21_3_windows-10-file-association-pdf-edge.webp) + +Figure 3: Trying to set Windows 10 file associations for PDF to Adobe Reader always reverts back to +Microsoft Edge + +Have you noticed that when you have a PDF in Windows 10, the default viewer for a PDF keeps +prompting you for "Microsoft Edge"? You might even install a third-party PDF reader like Acrobat +Reader. + +Even if you install a third-party PDF reader like Acrobat Reader, the Windows 10 file association +manager asks you if you want to make Adobe Reader the default PDF viewer"? Although, you can go +ahead and say yes, it does absolutely nothing. You can do a Google search for "hijak," "PDF," and +"Edge," and find that many people have experienced a similar issue. It's a very extensive problem, +one that you have likely seen. + +#### Problem #2: Change Windows 10 File Associations for MP4 + +![21_4_windows-10-file-association-for-mp4-files](assets/21_4_windows-10-file-association-for-mp4-files.webp) + +Figure 4: Windows 10 file association for MP4 defaults to Microsoft's movie player + +Another Windows 10 file association challenge you have likely seen is MP4 files. By default, your +Windows file association for MP4s is Microsoft's movie player. It's probably not what you +wanted. You may want to have an application like "VLC media player" or some other player that you've +installed. How do you automatically get users to connect to that? That's another big problem. + +#### Problem #3: Change Windows 10 File Associations for MAILTO + +![21_5_windows-10-file-association-mailto-default](assets/21_5_windows-10-file-association-mailto-default.webp) + +Figure 5: Prompt for MAILTO asking if you want to email this person + +![21_6_windows-10-file-association-mailto-mailer](assets/21_6_windows-10-file-association-mailto-mailer.webp) + +Figure 6: The Windows 10 file association for MAILTO is Microsoft's built-in mailer + +How about MAILTO? If you receive a text file that has an email address in it, and you click it, +Microsoft's built-in mailer shows up. That's likely not what you want, as Outlook is far more +likely. + +#### Problem #4: Set Windows 10 File Associations for Unknown Applications + +![21_7_windows-10-file-association-unknown-application](assets/21_7_windows-10-file-association-unknown-application.webp) + +Figure 7: Set Windows 10 file associations for unknown applications + +Lastly, another problem is when you have a certain Windows 10 file type for an application that has +no good reader installed. For example, your developers may use something like Notepad++ and might +not even have it installed. How can you associate windows 10 files with a program that's not even +installed? + +As you can see in the screenshot below, I have Notepad++ on the endpoint machine. It's located in +the C drive in a folder called "Notepad++Portable." In order to use that XML, I'd have to open up +"Notepad++Portable." I'd then have to drag that file in. It's just too much work. It would be great +if I could just simply double click it and see the file, but as you can see, there's no extension +there. + +### How to Change Windows 10 File Associations with Endpoint Policy Manager File Associations Manager + +![21_8_policy-pak-file-association-manager-for-windows-10](assets/21_8_policy-pak-file-association-manager-for-windows-10.webp) + +Figure 8: Endpoint Policy Manager File Associations Manager for Windows 10 + +#### Step #1: Start with the Group Policy Management Console (GPMC) + +![21_9_start-with-gpmc-policypak-file-association-manager](assets/21_9_start-with-gpmc-endpointpolicymanager-file-association-manager.webp) + +Figure 9: Using the Group Policy Management Console to create a new GPO + +I'm going to solve all four of those problems with one swing, and here's how we're going to do it. +This is now your machine, the person that has the GPMC and also has the same applications. The best +way to do File Associations Manager with Endpoint Policy Manager is for you to have the same +applications on your machine or to utilize a machine that has the same applications. + +To get started here, I'm going to use the GPMC. For all of my "East Sales Desktops," I'm going to +create a GPO in this domain, and link it. The GPO is called "PPFAM Demos." The acronym PPFAM is for +Endpoint Policy Manager File Associations Manager. Once I right click and click "Edit," we'll knock +out all four problems. + +#### Step 2: Create Windows 10 File Association Policy for PDF to Acrobat + +![21_10_create-windows-10-file-association-policy-with-policypak](assets/21_10_create-windows-10-file-association-policy-with-endpointpolicymanager.webp) + +Figure 10: Creating a Policy with Endpoint Policy Manager File Associations Manager + +Endpoint Policy Manager File Associations Manager is on the computer side, and we'll dive into that +below. The first thing we want to do is associate Acrobat with PDF. We'll right-click, "Add/New +Policy" here. We'll call this "PDF to Acrobat." + +![21_11_windows-10-file-association-pdf-to-acrobat](assets/21_11_windows-10-file-association-pdf-to-acrobat.webp) + +Figure 11: Creating a Windows 10 File Association Policy for PDF to Acrobat + +We're going to be using a "File Type." The Windows 10 file association is going to be for "PDF." +We're going to use a "Registered application." I'll explain what "Custom application" is in a +second. We'll "Select Program." Again, it's best if you're on a machine that has this. Look at that: +"PDF." We find it pretty fast. We'll use the Acrobat "Adobe Reader" that's on this machine. It's as +simple as that. You can click "OK," and there we go. You've solved that problem. + +#### Step 3: Change Windows 10 File Association Policy for MP4 to VLC Media Player + +![21_12_create-windows-10-file-association-policy-for-mp4-with-policypak-file-associations-manager](assets/21_12_create-windows-10-file-association-policy-for-mp4-with-endpointpolicymanager-file-associations-manager.webp) + +Figure 12: Change Windows 10 File Association for MP4 to VLC Player + +The second thing we said we wanted to do was movies. If we wanted to create a Windows 10 file +association from MP4 to VLC player, we can then do a "Windows 10 Category" if we want to. We can +just say the "Video Player" itself will be a "Registered application." We have "VLC media player" on +this machine, so we'll go ahead and "Select Program." There we go. We'll just go ahead and pick "VLC +media player," and you've solved that problem. + +![21_13_windows-10-file-association-for-mp4-changed-to-vlc-player](assets/21_13_windows-10-file-association-for-mp4-changed-to-vlc-player.webp) + +Figure 13: MP4 is now associated with VLC Media Player + +#### Step 4: Set Windows 10 File Association Policy for Mailto to Outlook + +![21_14_windows-10-file-association-changed-mailto-outlook](assets/21_14_windows-10-file-association-changed-mailto-outlook.webp) + +Figure 14: Use Network protocol MAILTO and set Windows 10 file association to Outlook + +Then we'll go ahead and "Add/New Policy" here, this time to open up the "Mail in Outlook." How are +we going to do that? This time it's a "Network Protocol." Actually, there are two ways to do this. +You could do the "Windows 10 file association of "Email." That's fine. I'm just going to switch and +try something a little different here. I'm going to show you "Network Protocol." + +This protocol is called "MAILTO." If somebody clicks on a link that says "mailto:" you want it to +run another "Registered application." Which one? I happen to have Outlook already preinstalled on +this machine. + +![21_15_windows-10-file-association-for-mailto-set-with-policypak](assets/21_15_windows-10-file-association-for-mailto-set-with-endpointpolicymanager.webp) + +Figure 15: Setting Windows 10 File Association from MAILTO to Outlook with Endpoint Policy Manager + +There we go. I'll go ahead and change the Windows 10 file association to "Microsoft Outlook" and +click "OK," and you've solved that problem right there. + +#### Step 5: Set Windows 10 File Associations for Notepad++ + +Then the last Windows 10 file association we want to do is to "Add Policy" that says "XML to +Notepad++." + +![21_16_windows-10-file-association-custome-application](assets/21_16_windows-10-file-association-custome-application.webp) + +Figure 17: Use a custom application to set Windows 10 File Associations for Notepad++ + +This time, we're going to use "Custom application." Why Custom? Because Custom is better for when +you have a program that isn't actually installed or registered. In other words, there's no way for +Windows to see that XML should be associated with Notepad++. + +We're just going to "Select Program" "From EXE file." Again, this path has to exist correctly on the +endpoint or this isn't going to work. I'm going to "Browse" for it on my machine. It's the same as +the target machine: "c:Notepad++PortableNotepad++Portable.exe." We automatically put in +"%SYSTEMDRIVE%" and all that stuff. You can see, we have the "Path" all settled in. + +![21_17_windows-10-file-association-notepad-confirmation](assets/21_17_windows-10-file-association-notepad-confirmation.webp) + +Figure 18: Change Windows 10 File Associations for Notepad++ to XML + +Now we're saying "XML to Notepad++." We're going to pass in the file name automatically. You don't +have to do anything. But if you want to run "Command Line" like if it's going to be an application +that requires command line arguments, you can put in your own things here. Just be sure to put in +"%1" to pass in where the file should go in that command line argument. We'll go ahead and click +"OK," and that's it. There are all of our rules, all four things said and done. + +#### Step 6: Run GP Update to Set Windows 10 File Associations Changes + +![21_18_windows-10-file-association-group-policy-update-successful](assets/21_18_windows-10-file-association-group-policy-update-successful.webp) + +Run GP Update to set Windows 10 file associations changes + +You might wonder when these things are going to apply. What I'm going to do is go over to this +endpoint here and run GP Update ("gpupdate"). You have to do a Group Policy Update first and after +GP Update is successful, it doesn't really kick in until you log off and log back on. That's when +the magic kicks in, when you log off and log back on, or for any new user who has never logged on. +In that way, it works perfectly for first-time users right out of the gate. So that part is good as +well. + +Okay, that's all finished. You can see that there are no changes here. Keep your eye on these three +icons. What we're going to do right now is we're going to log out ("Sign out") and log back on. Just +like that, you can see the icon for the PDF has changed, the icon for the MP4 has changed. The icon +for the XML has also changed even though Notepad++ is not actually installed. + +##### Sign Up for our webinar or contact us to fix Windows 10 file associations problems + +Get started by attending our daily webinar. Not only will this webinar review of how Endpoint Policy +Manager simplifies Windows 10 File Associations, but it also demonstrates the software's other +features. Once you've seen the webinar, we'll hand over the bits so you can start a free 14-day +trial. During your evaluation, a Windows 10 File Associations specialist will be available to help +you with your project. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10questions.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10questions.md new file mode 100644 index 0000000000..feb9b7b0e3 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10questions.md @@ -0,0 +1,40 @@ +--- +title: "Endpoint Policy Manager File Associations: Don't ask questions (even when you did it right)" +description: "Endpoint Policy Manager File Associations: Don't ask questions (even when you did it right)" +sidebar_position: 80 +--- +# Endpoint Policy Manager File Associations: Don't ask questions (even when you did it right) + +How do I get Windows 10 to stop asking me to open PDFs in Microsoft Edge? When you use Endpoint +Policy Manager File Associations Manager, you might have done "everything right" but even then, it +still doesn't work as expected. See this video for a universal fix. + + + +Hi, this is Jeremy Moskowitz and if you're watching this video, you're probably wondering why when +you use file associations manager you still get this question. Do you want to open this file? You've +already associated it correctly. You can see that it's correctly going to use Acrobat Reader, but +why does Windows still ask? Well, there's an easy way to make this problem go away. This isn't a +file association manager problem; this is just Windows trying to advertise its own stuff, so let's +go ahead and show you how you can work around this. + +I've got a GPO where I like to put things that want to affect all users here, so I'm going to put it +into my General Needs GPO here. What you're going for here is the – under the Policies Admin +Templates, you're looking for Windows Components File Explorer Then you're looking for Do Not Show +the New Application Installed Notifications. Let's set that to enabled. Okay, so now that we've done +this guy here, we'll do a quick AB test. You saw me do that before, so now I'm going to run GP +Update, and you may need to log off and log back on. This'll affect the next time the guy logs on +and every user going forward in the future, so let's go ahead and do that here. + +Alright, so I'll go ahead and run GP Update here. There we go. GP Update, give this a second to +finish up, and then we'll go ahead and log off and log back on. Alright, so we're done with that. Go +ahead and sign out. Sign back in, and now let's go ahead and run it and see what happens. Look at +that, no more questions. If we were to log off here and log on as, say, West Sales User 3 – let's go +ahead and do that. Sign out here. We'll sign on as a user that's never even logged on before. If we +do West Sales User 8, give this a second for this guy to log on. + +Now that we're logged on, here's that PDF. Go ahead and double-click it, and what do we get? We get +no questions. Hopefully that policy setting helps you out and therefore you can use file +associations manager quickly and easily and no more questions. + +Thanks so very much for watching and talk to you soon. diff --git a/docs/endpointpolicymanager/file-associations-manager/video-learning-center/videolearningcenter.md b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/videolearningcenter.md new file mode 100644 index 0000000000..e791ba4c73 --- /dev/null +++ b/docs/endpointpolicymanager/file-associations-manager/video-learning-center/videolearningcenter.md @@ -0,0 +1,35 @@ +--- +title: "Video Learning Center" +description: "Video Learning Center" +sidebar_position: 20 +--- + +# Video Learning Center + +For more information on File Associations Manager see the following videos. + +## Getting Started + +- [Endpoint Policy Manager File Associations Manager: Manage Windows 10 & 11 File Associations](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/windows10.md) +- [Endpoint Policy Manager File Associations Manager: Apply once (and drift)](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/applyonce.md) +- [Associate Programs to Universal Windows Apps (Metro Apps)](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/universalwindowsapps.md) +- [Manage all File Associations with the PPFAM Wizard](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/wizard.md) +- [Endpoint Policy Manager File Associations Manager: Use our preconfigured advice](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/preconfiguredadvice.md) + +## Methods: Cloud, MDM, SCCM, PDQ, etc. + +- [Managing File Associations with an MDM service](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/mdm.md) +- [Endpoint Policy Manager Cloud: Managing File Assocations](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloud.md) +- [Setting Default File Associations with Endpoint Policy Manager and PDQ Deploy](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/pdqdeploy.md) +- [Using File Association Manager in the Endpoint Policy Manager Cloud environment](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/methods/cloudusage.md) + +## Tips and Tricks + +- [Force IE to use Adobe Reader for PDFs](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/adobereader.md) +- [Endpoint Policy Manager: How to get mailto: to open in Office 365](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/mailto.md) +- [Windows 10 File Associations: Set, Change and Remove Easily](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10modify.md) +- [File Associations Manager Helper Tool](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helpertool.md) +- [Endpoint Policy Manager File Associations Manager: Understanding the First Login](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/firstlogin.md) +- [Endpoint Policy Manager File Associations Manager: Helper Application](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/helperapplication.md) +- [Endpoint Policy Manager File Associations Trick: Acro Reader AND Writer](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/acroreader.md) +- [Endpoint Policy Manager File Associations: Don't ask questions (even when you did it right)](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/tipsandtricks/windows10questions.md) diff --git a/docs/endpointpolicymanager/gettingstarted/fastest.md b/docs/endpointpolicymanager/gettingstarted/fastest.md new file mode 100644 index 0000000000..25bb1b8817 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/fastest.md @@ -0,0 +1,136 @@ +--- +title: "Endpoint Policy Manager Support and Resources" +description: "Endpoint Policy Manager Support and Resources" +sidebar_position: 5 +--- + +# Endpoint Policy Manager Support and Resources + +This topic provides information about the various support resources at Netwrix Endpoint Policy +Manager (formerly PolicyPak).The goal is to enable you to be as self sufficient as possible. The +faster you can solve your own problem, the happier you are. The recommended strategy is described in +the following sections. + +## Watch the Webinar + +The most important thing you can do to become quickly oriented with Endpoint Policy Manager is to +watch our daily webinar. The webinar is oriented to your delivery scenario: On-Prem, Intune/MDM or +Cloud. + +![gs3](gs3.webp) + +If you were added as a Primary or Secondary, you were automatically provided a link which will get +you directly to the Overview/On-Prem webinar. If you are using Endpoint Policy Manager with +Intune/MDM or Endpoint Policy Manager Cloud, you might want to also watch the specific one for your +scenario. + +If none of the times work for you, contact your Endpoint Policy Manager sales person for a replay. +It will help you to quickly understand all the moving parts to Endpoint Policy Manager and it +answers more than 90% of use cases and installation questions. + +:::info +Learn about what you already own/what it can do. Sign up for the IT Admin webinar +at: [https://www.endpointpolicymanager.com/demo/](https://www.endpointpolicymanager.com/demo/) +::: + + +## Verify Logins for Portal and Cloud + +Endpoint Policy Manager has two login areas, both of which are accessible from the main Customer +Login page at Endpoint Policy Manager.com: + +- [Portal](http://portal.endpointpolicymanager.com/) — On-Prem bits downloads, extras, Endpoint Policy Manager + Bootcamp (Free Training), Payment location for monthly usage +- [Cloud](http://cloud.endpointpolicymanager.com/) — The Endpoint Policy Manager Cloud service + +![gs1](gs1.webp) + +- If you are unable to logon as expected during a trial, contact your Endpoint Policy Manager Sales + person for credentials. + +- If you are unable to logon as expected as a customer, open a ticket to contact + [Netwrix Support](https://www.netwrix.com/tickets.html#netwrix-support). + +:::note +The credentials are not shared or single sign on between Portal and Cloud service. +::: + + +## Quick Start and Implementation Topics + +Endpoint Policy Manager has a few Quick start topics to provide specific guidance for your scenario. + +Quick tart topics for delivery method of policies you plan to use: + +- [Group Policy Delivery Quick Start](/docs/endpointpolicymanager/gettingstarted/quickstart/grouppolicy.md) +- [MDM / Intune Delivery Quick Start](/docs/endpointpolicymanager/gettingstarted/quickstart/mdm.md) +- [Endpoint Policy Manager Cloud Delivery Quick Start](/docs/endpointpolicymanager/gettingstarted/quickstart/cloud.md) + +A detailed Installation Guide for On-Prem scenarios that takes you from download to verified. + +- [Step 1: Get the download and inspect its contents](/docs/endpointpolicymanager/manuals/introductionandquick/overviewinstall/downloadcontents.md) + +A detailed topic is available if you're in a hurry to get started with Endpoint Policy Manager +Cloud. + +- [Endpoint Policy Manager Cloud Quick Start](/docs/endpointpolicymanager/manuals/introductionandquick/cloud/overview.md) + +A detailed MDM & UEM tools (like Intune) topic can be found here: + +- [MDM & UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/overview.md) + +A detailed PolicyPak Least Privilege Manager Implementation Quickstart Guide that is project +oriented to get you to the success line quickly. + +[Endpoint Privilege Manager Implementation QuickStart Guide](/docs/endpointpolicymanager/manuals/leastprivilegesecuri/pplpmimplementationguide.md) + +## Refer to Documentation in the Netwrix Technical Knowledge Center + +Endpoint Policy Manager has an extensive library of detailed manuals and Knowledge Base and Videos. +Consider bookmarking these important pages: + +- [Netwrix Endpoint Policy Manager (formerly PolicyPak) Knowledge Base Articles](/docs/endpointpolicymanager/knowledgebase/knowledgebase.md) +- [Netwrix Endpoint Policy Manager (formerly PolicyPak) User Manuals](/docs/endpointpolicymanager/knowledgebase/knowledgebase.md) + +Finding what youare looking for comes down to Knowledge Base & Videos and User Manuals. Here is a +way to get oriented on the navigation. + +![gs2](gs2.webp) + +## Get Help from Support + +:::warning +Email is no longer monitored at the old support @endpointpolicymanager.com email address. +::: + + +To get help during a Trial or as a customer, it is the same motion. Open a ticket to contact +[Netwrix Support](https://www.netwrix.com/tickets.html#netwrix-support). + +:::note +The Netwrix ticket portal is another set of credentials and is not related to Endpoint +Policy Manager Portal or Endpoint Policy Manager Cloud. +::: + + +Reasons to Contact Endpoint Policy Manager Support + +- You have lost access to the portal, but you think you should have access or other portal problem + +- You have lost access to Endpoint Policy Manager Cloud, but you think you should have access + +- You need to re-scope your Endpoint Policy Manager on-Prem licenses due to an OU restructure during + the middle of the year + +- You would like to schedule some Deep Dive time with support for one-on-one demos or strategist +- If you think you have a special circumstance that applies to you. For instance, something was + working yesterday in the product, but not today. Or, if you've tried something and you're getting + a specific error message, etc. +- If you are renewing, and about to expire and don't have a license key yet +- Anything else that we can help you with + +If you are about to start on a trial or become a customer, or if you area newly-minted primary or +secondary user of Endpoint Policy Manager, Welcome! + +We strive to give you world-class support and resources. If you need anything at all, please reach +out! diff --git a/docs/endpointpolicymanager/gettingstarted/gs1.webp b/docs/endpointpolicymanager/gettingstarted/gs1.webp new file mode 100644 index 0000000000..f9dbda88d8 Binary files /dev/null and b/docs/endpointpolicymanager/gettingstarted/gs1.webp differ diff --git a/docs/endpointpolicymanager/gettingstarted/gs2.webp b/docs/endpointpolicymanager/gettingstarted/gs2.webp new file mode 100644 index 0000000000..d7c806a76e Binary files /dev/null and b/docs/endpointpolicymanager/gettingstarted/gs2.webp differ diff --git a/docs/endpointpolicymanager/gettingstarted/gs3.webp b/docs/endpointpolicymanager/gettingstarted/gs3.webp new file mode 100644 index 0000000000..12cae252e2 Binary files /dev/null and b/docs/endpointpolicymanager/gettingstarted/gs3.webp differ diff --git a/docs/endpointpolicymanager/gettingstarted/index.md b/docs/endpointpolicymanager/gettingstarted/index.md new file mode 100644 index 0000000000..8adfaa5dd7 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/index.md @@ -0,0 +1,129 @@ +--- +title: "Getting Started" +description: "Getting Started" +sidebar_position: 2 +--- + +# Getting Started + +To help get you started, this topic points you towards videos that will get you on the road and +working with Netwrix Endpoint Policy Manager (formerly PolicyPak) quickly. + +## The Portal and Downloads + +In order to get the latest Endpoint Policy Manager downloads, you need access to the Endpoint Policy +Manager Customer Portal (shown in Figure 1). You can only get access to the portal from a Endpoint +Policy Manager sales associate. + +![getting_started_right_away](/images/endpointpolicymanager/getting_started_right_away.webp) + +Figure 1. Inside the Endpoint Policy Manager Customer Portal. + +:::note +Video: For an overview on how to use the Endpoint Policy Manager Customer Portal and +understand subscriptions, please watch the following video: +[https://www.endpointpolicymanager.com/video/endpointpolicymanager-portal-how-to-download-endpointpolicymanager-and-get-free-training.html](https://www.endpointpolicymanager.com/video/endpointpolicymanager-portal-how-to-download-endpointpolicymanager-and-get-free-training.html) +::: + + +Go to the Download section and select "Download Everything (Bits, Paks, Manuals but not Advice)," +and you will get a ZIP file with manuals. You will also receive the following: + +- A ZIP file containing all pre-configured AppSets for Endpoint Policy Manager Application Settings + Manager +- An ISO or ZIP file with the Endpoint Policy Manager installation files and licensing utility + +The Endpoint Policy Manager installation files are delivered as both ZIP and ISO so you can use +Endpoint Policy Manager in virtual environments (which can easily mount ISO files) or burn a CD of +the contents. + +You may also want to utilize the free 7-Zip program to open ZIP or ISO downloads and extract the +files. Download 7-Zip from [http://www.7-zip.org/](http://www.7-zip.org/). In Figure 2, you can see +the list of files and directories that are inside the Endpoint Policy Manager ZIP or ISO download. + +![getting_started_right_away_1](/images/endpointpolicymanager/getting_started_right_away_1.webp) + +Figure 2. The folders that are inside the download. + +Following is a description of what each folder contains and where it should be installed. + +### Licensing for All On-Premise Products + +The licensing for All On-Premise Products contains the licensing utility needed to request and +implement Endpoint Policy Manager license keys. We will be discussing the utility (LT.exe) later. + +### Admin Console MSI for all On-Premise Products + +The Admin Console MSI for all On-Premise Products is installed on your management stations (wherever +you have the GPMC) or in the location where you wish to create Endpoint Policy Manager directives. +This installation also has the Endpoint Policy Manager Exporter and Group Policy Object (GPO) touch +utility (both are explained later). Once this is installed, you'll see a Endpoint Policy Manager +node whenever you edit a GPO. You can choose between a 32-bit and a 64-bit file. + +### Client-Side Extension (CSE) for All On-Premise Products + +The Client-Side Extension (CSE) for All On-Premise Products is installed on every client machine +(Windows 7 and later, Terminal Services (RDS), and Citrix). You can choose between a 32-bit and a +64-bit file. + +### PolicyPak ADMX (Troubleshooting) + +Endpoint Policy Manager ADMX (Troubleshooting) is meant to be used in conjunction with minor +configuration changes or working with tech support. These are ADMX files that can be placed in your +local or central Group Policy store to provide configurable options. + +### PolicyPak Application Manager Extras + +Endpoint Policy Manager Application Manager Extras contains the Endpoint Policy Manager DesignStudio +installer, which is used to create your own AppSets for Endpoint Policy Manager Application Settings +Manager. + +### PolicyPak Extras + +Endpoint Policy Manager Extras contains some miscellaneous utilities and helper tools. + +### PolicyPak Group Policy Compliance Reporter + +Endpoint Policy Manager Group Policy Compliance Reporter contains the Endpoint Policy Manager Group +Policy Compliance Reporter console and Endpoint Policy Manager Group Policy Compliance Reporter +server (optional) for Group Policy reporting. Note that the Compliance Reporter must be specifically +licensed. + +## Get Licensed + +With the exception of Endpoint Policy Manager Cloud (which is self licensed), Endpoint Policy +Manager requires the endpoint to be licensed to work with the components you wish to use. Therefore, +for Endpoint Policy Manager to work after you download everything from the portal, you need to do +the following: + +**Step 1 –** Request a license and send that key to Sales for processing. You can watch a video on +how to request a license at the following link: +[How to Request Licenses from Endpoint Policy Manager by Creating a "License Request Key"](/docs/endpointpolicymanager/knowledgebase/licensing/videolearningcenter/requestall/licenserequestkey.md). + +**Step 2 –** Receive a license and install it. You can watch a video on how to install the license +you receive at the following +link:[How to install UNIVERSAL licenses for NEW Customers (via GPO, SCCM or MDM)](/docs/endpointpolicymanager/knowledgebase/licensing/videolearningcenter/installall/installuniversal.md). + +## Get Started with the GPO Method + +Most customers want to use Endpoint Policy Manager with Group Policy. You can watch the getting +started video on how to install and run some initial tests at the following link: +[Endpoint Policy Manager with Group Policy Method: Getting Started](/docs/endpointpolicymanager/knowledgebase/gettingstartedgrouppolicy/videolearningcenter/gettingstarted/gettingstartedv.md). + +## GetStarted with the Endpoint Policy Manager Cloud Method + +If you want to get started right away with Endpoint Policy Manager Cloud, watch this video for a +quick overview: [Endpoint Policy Manager Cloud: QuickStart](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/quickstart.md). + +## Get Started with Your MDM Provider or UEM Tool + +Getting started with your mobile device management (MDM) provider or UEM tool takes a few more steps +than is covered in one video. In this case, instead of a single video, we recommend you watch each +of the videos at the links below in order to get prepared to use Endpoint Policy Manager with your +MDM provider. + +- For video overviews of using Endpoint Policy Manager with an MDM service see: Getting Started with + MDM > [Video Learning Center](/docs/endpointpolicymanager/knowledgebase/gettingstartedmdm/videolearningcenter/videolearningcenter.md). +- For video overviews of using Endpoint Policy Manager with a UEM tool like SCCM see: Getting + Started with Endpoint Policy Manager (Misc) > + [Knowledge Base](/docs/endpointpolicymanager/knowledgebase/knowledgebase.md). diff --git a/docs/endpointpolicymanager/gettingstarted/quickstart/_category_.json b/docs/endpointpolicymanager/gettingstarted/quickstart/_category_.json new file mode 100644 index 0000000000..6b1ea0aa16 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/quickstart/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Netwrix Endpoint Policy Manager Quick Start", + "position": 30, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/gettingstarted/quickstart/cloud.md b/docs/endpointpolicymanager/gettingstarted/quickstart/cloud.md new file mode 100644 index 0000000000..64ea26e711 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/quickstart/cloud.md @@ -0,0 +1,56 @@ +--- +title: "Endpoint Policy Manager Cloud Delivery Quick Start" +description: "Endpoint Policy Manager Cloud Delivery Quick Start" +sidebar_position: 30 +--- + +# Endpoint Policy Manager Cloud Delivery Quick Start + +For an overview of delivery via PolicyPak Cloud, see the +[Endpoint Policy Manager Cloud: QuickStart](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/quickstart.md) video . + +Follow the steps below to carry out the Endpoint Policy Manager cloud delivery: + +**Step 1 –** Install the Endpoint Policy Manager Cloud Client on an example endpoint + +Log on to [cloud.endpointpolicymanager.com](http://cloud.endpointpolicymanager.com/) with the credentials provided to you +via email from Netwrix sales. In the Company tab download the PolicyPak Cloud Client MSI for your +PolicyPak Cloud tenant. + +Install it by hand on a few Windows 10 or Windows 11 endpoints. Alternatively, use your software +deployment tool (like Intune) to deliver the CSE to a few endpoints. See the +[Endpoint Policy Manager Cloud + MDM Services: Install Cloud Client + automatically join PPC Groups and get policy.](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/usingwithothermethods/mdm.md) +video of using Intune to bootstrap the PolicyPak cloud client install. + +The Endpoint Policy Manager Cloud Client automatically installs the PolicyPak CSE at the same time. + +:::note +Each time you install the Endpoint Policy Manager Cloud Client you will consume one of +your 10 example licenses +::: + + +**Step 2 –** (optional, recommended): Install the Endpoint Policy Manager Admin Console on a +management machine with the GPMC pre-installed + +In the download, find the **Admin Console MSI**. Install it by hand on your machine. Your machine +needs to also have the GPMC pre-installed from Microsoft. We recommend you have both the Endpoint +Policy Manager Admin Console and the GPMC installed on a “fake DC” exclusively for editing purposes. +See the [How to create a DC for editing purposes](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/testlabbestpractices/createdc.md) video for +details and how to do this. + +:::note +If you bypass this step, you can still use the Endpoint Policy Manager in-cloud editors, +but some options may not be available to you for editing without an on-prem editor station. +::: + + +**Step 3 –** Start creating policies using Endpoint Policy Manager Cloud + +If you want to make Microsoft Group Policy settings via Endpoint Policy Manager Cloud, see the +[Endpoint Policy ManagerCloud: How to deploy Microsoft Group Policy Settings using Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/grouppolicysettings.md)video. + +If you want to make Endpoint Policy Manager specific settings (like Endpoint Policy Manager Least +Privilege Manager, etc.) via Endpoint Policy Manager Cloud, see the +[Endpoint Policy ManagerCloud: How to deploy Endpoint Policy Manager specific settings (using in-cloud editors and exporting from on-prem)](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/gettingstarted/endpointpolicymanagersettings.md) +video. diff --git a/docs/endpointpolicymanager/gettingstarted/quickstart/grouppolicy.md b/docs/endpointpolicymanager/gettingstarted/quickstart/grouppolicy.md new file mode 100644 index 0000000000..dff155a5a7 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/quickstart/grouppolicy.md @@ -0,0 +1,42 @@ +--- +title: "Group Policy Delivery Quick Start" +description: "Group Policy Delivery Quick Start" +sidebar_position: 10 +--- + +# Group Policy Delivery Quick Start + +For an overview of Group Policy Quick Start, the +[Admin Console And CSE Installation](/docs/endpointpolicymanager/knowledgebase/gettingstartedgrouppolicy/videolearningcenter/gettingstarted/install.md) video. + +**Step 1 –** Install the Endpoint Policy Manager Client on an example endpoint + +In the download, find the **Client Side Extensions (CSE)** folder. Install it by hand on a few +Windows 10 or Windows 11 endpoints. Alternatively, use your software deployment tool (like SCCM, +Intune or PDQ deploy) to deliver the CSE to a few endpoints. + +**Step 2 –** Install the Endpoint Policy Manager Admin Console on a management machine with the GPMC +pre-installed + +In the download, find the **Admin Console MSI**and install it by hand on your machine. Your machine +needs to also have the GPMC pre-installed from Microsoft. We recommend you have both the Endpoint +Policy Manager Admin Console and the GPMC installed on a “fake DC” exclusively for editing purposes. +See the [How to create a DC for editing purposes](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/testlabbestpractices/createdc.md) video for +details and how to do this. + +**Step 3 –** Install your license key or rename your example endpoint to have computer in the name + +:::note +If you got a license file back from the Netwrix sales team, you can import it to enable +computers in the locations (scope) you requested. Alternatively, you can merely rename an endpoint +have the word Computer in the name, and the computer will act fully licensed. +::: + + +Follow the +[How to install UNIVERSAL licenses for NEW Customers (via GPO, SCCM or MDM)](/docs/endpointpolicymanager/knowledgebase/licensing/videolearningcenter/installall/installuniversal.md) +video to install a license file. + +Check the +[What is the fastest way to get started in an Endpoint Policy Manager trial, without running the License Request Tool?](/docs/endpointpolicymanager/knowledgebase/licensing/knowledgebase/requestingall/trial.md) +topic to see how to rename a computer or perform alternative licensing. diff --git a/docs/endpointpolicymanager/gettingstarted/quickstart/mdm.md b/docs/endpointpolicymanager/gettingstarted/quickstart/mdm.md new file mode 100644 index 0000000000..aeb44a7f84 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/quickstart/mdm.md @@ -0,0 +1,43 @@ +--- +title: "MDM / Intune Delivery Quick Start" +description: "MDM / Intune Delivery Quick Start" +sidebar_position: 20 +--- + +# MDM / Intune Delivery Quick Start + +For a video overview of MDM delivery via Intune, see the +[Endpoint Policy Manager and Microsoft Intune](/docs/endpointpolicymanager/knowledgebase/gettingstartedmdm/videolearningcenter/gettingstarted/microsoftintune.md). The installation +steps are below. + +**Step 1 –** Install the Endpoint Policy Manager Client on an example endpoint. + +In the download, find the **Client Side Extensions (CSE)** folder. Install it by hand on a few +Windows 10 or Windows 11 endpoints. Alternatively, use your software deployment tool (like Intune) +to deliver the CSE to a few endpoints. + +**Step 2 –** Install the Endpoint Policy Manager Admin Console on a management machine with the GPMC +pre-installed + +In the download, find the **Admin Console MSI** and install it manually on your machine. Your +machine needs to also have the GPMC pre-installed from Microsoft. It is recommended that you have +both the Endpoint Policy Manager Admin Console and the GPMC installed on a “fake DC” exclusively for +editing purposes. See the +[How to create a DC for editing purposes](/docs/endpointpolicymanager/knowledgebase/gettingstartedcloud/videolearningcenter/testlabbestpractices/createdc.md) video for details +and how to do this. + +**Step 3 –** Install your license key or rename your example endpoint to have computer in the name. + +:::note +If you got a license file back from the Netwrix sales team, you can import it to enable +computers in the locations (scope) you requested. Alternatively, you can merely rename an endpoint +have the word Computer in the name, and the computer will act fully licensed. +::: + + +Follow the [Endpoint Policy Manager and MDM walk before you run](/docs/endpointpolicymanager/knowledgebase/gettingstartedmdm/videolearningcenter/gettingstarted/testsample.md) +video to install an MDM license file. + +Check the +[What is the fastest way to get started in an Endpoint Policy Manager trial, without running the License Request Tool?](/docs/endpointpolicymanager/knowledgebase/licensing/knowledgebase/requestingall/trial.md) +topic to see how to rename a computer or perform alternative licensing. diff --git a/docs/endpointpolicymanager/gettingstarted/quickstart/overview.md b/docs/endpointpolicymanager/gettingstarted/quickstart/overview.md new file mode 100644 index 0000000000..6e5e37cc84 --- /dev/null +++ b/docs/endpointpolicymanager/gettingstarted/quickstart/overview.md @@ -0,0 +1,23 @@ +--- +title: "Netwrix Endpoint Policy Manager Quick Start" +description: "Netwrix Endpoint Policy Manager Quick Start" +sidebar_position: 20 +--- + +# Netwrix Endpoint Policy Manager Quick Start + +Getting Started + +First, download the Netwrix Endpoint Policy Manager (formerly PolicyPak) software from the portal at +endpointpolicymanager.com. See the +[Endpoint Policy ManagerPortal: How to download Endpoint Policy Manager and get free training](/docs/endpointpolicymanager/knowledgebase/gettingstarted/videolearningcenter/gettingstartedmisc/freetraining.md) +topic for video details on downloading. + +Next, Netwrix Endpoint Policy Manager (formerly PolicyPak) enables you to deliver settings via Group +Policy, MDM or PolicyPak Cloud. + +:::info +Use Group Policy for your Quick Start. However, any delivery method may be used +as appropriate. + +::: diff --git a/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/gettingstarted/guide.md b/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/gettingstarted/guide.md index c3e1635198..ae68de4e19 100644 --- a/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/gettingstarted/guide.md +++ b/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/gettingstarted/guide.md @@ -6,5 +6,5 @@ sidebar_position: 10 # Does Endpoint Policy Manager have a Quick Start Guide? -Yes, see the [Netwrix Endpoint Policy Manager Quick Start](/docs/endpointpolicymanager/manuals/introductionandquick/quickstart/overview.md) topic to help you get +Yes, see the [Netwrix Endpoint Policy Manager Quick Start](/docs/endpointpolicymanager/gettingstarted/quickstart/overview.md) topic to help you get started with Netwrix Endpoint Policy Manager (formerly PolicyPak) immediately. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/_category_.json new file mode 100644 index 0000000000..d4e4ea53d1 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Scripts and Triggers Manager", + "position": 45, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/_category_.json new file mode 100644 index 0000000000..a54b9f0a99 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Manual", + "position": 10, + "collapsed": false, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/advantages.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/advantages.md new file mode 100644 index 0000000000..eea55ab17c --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/advantages.md @@ -0,0 +1,33 @@ +--- +title: "Advantages of Using Scripts & Triggers Manager" +description: "Advantages of Using Scripts & Triggers Manager" +sidebar_position: 20 +--- + +# Advantages of Using Scripts & Triggers Manager + +With Endpoint Policy Manager Scripts & Triggers Manager, the advantages you get are based on the +policy method you already employ. + +- For those using Group Policy: + + - You can deploy scripts to users or computers. + - Use can use Item-Level Targeting to determine whether the script should run. + - You can apply the script always, once, or when forced manually. + +- For those using Endpoint Policy Manager Cloud: + + - You can deploy scripts to your non-domain-joined machines. + - You can deploy scripts to your Windows 7 and 10 Home machines, which allows you to do + interesting things that were once only possible using Group Policy Preferences, for example, + delivering a shortcut to the Desktop of your non-domain-joined Windows 10 Home device. + +- For those using an MDM solution: + + - If your MDM solution has no scripting ability (or you have to pay extra for it) then Endpoint + Policy Manager provides the solution. + - You can use Item-Level Targeting to determine whether the script should run. + + - You can apply the script always, once, or when forced manually. + + - You can write your script in most common languages; not just PowerShell. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_11_image-20200819181623-6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_11_image-20200819181623-6.webp new file mode 100644 index 0000000000..262efffa69 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_11_image-20200819181623-6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_13_image-20200819181623-7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_13_image-20200819181623-7.webp new file mode 100644 index 0000000000..975805ef71 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_13_image-20200819181623-7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_15_image-20200819181623-8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_15_image-20200819181623-8.webp new file mode 100644 index 0000000000..2ad0e06604 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_15_image-20200819181623-8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_17_image-20200819181623-9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_17_image-20200819181623-9.webp new file mode 100644 index 0000000000..5b719820a2 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_17_image-20200819181623-9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_19_image-20200819181623-10.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_19_image-20200819181623-10.webp new file mode 100644 index 0000000000..52da7c1b7f Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_19_image-20200819181623-10.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_1_image-20200819181623-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_1_image-20200819181623-1.webp new file mode 100644 index 0000000000..223c056edf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_1_image-20200819181623-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_21_image-20200819181623-11.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_21_image-20200819181623-11.webp new file mode 100644 index 0000000000..d8e1db9cc8 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_21_image-20200819181623-11.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_23_image-20200819181623-12.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_23_image-20200819181623-12.webp new file mode 100644 index 0000000000..6e8e820f3d Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_23_image-20200819181623-12.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_25_image-20200819181623-13.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_25_image-20200819181623-13.webp new file mode 100644 index 0000000000..daee6a45b1 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_25_image-20200819181623-13.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_27_image-20200819181623-14.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_27_image-20200819181623-14.webp new file mode 100644 index 0000000000..1cf6721110 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_27_image-20200819181623-14.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_29_image-20200819181623-15.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_29_image-20200819181623-15.webp new file mode 100644 index 0000000000..0f959fb530 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_29_image-20200819181623-15.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_31_image-20200819181623-16.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_31_image-20200819181623-16.webp new file mode 100644 index 0000000000..9d14cfcccd Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_31_image-20200819181623-16.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_33_image-20200819181623-17.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_33_image-20200819181623-17.webp new file mode 100644 index 0000000000..453278aed1 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_33_image-20200819181623-17.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_35_image-20200819181623-18.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_35_image-20200819181623-18.webp new file mode 100644 index 0000000000..0173c0b723 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_35_image-20200819181623-18.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_37_image-20200819181623-19.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_37_image-20200819181623-19.webp new file mode 100644 index 0000000000..d19e38e185 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_37_image-20200819181623-19.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_3_image-20200819181623-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_3_image-20200819181623-2.webp new file mode 100644 index 0000000000..b04429427d Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_3_image-20200819181623-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_5_image-20200819181623-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_5_image-20200819181623-3.webp new file mode 100644 index 0000000000..5e05940abf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_5_image-20200819181623-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_7_image-20200819181623-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_7_image-20200819181623-4.webp new file mode 100644 index 0000000000..4f6ac24513 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_7_image-20200819181623-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_9_image-20200819181623-5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_9_image-20200819181623-5.webp new file mode 100644 index 0000000000..360c62294a Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/207_9_image-20200819181623-5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_1_image-20200623000029-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_1_image-20200623000029-1.webp new file mode 100644 index 0000000000..0fb6c731f0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_1_image-20200623000029-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_2_image-20200623000029-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_2_image-20200623000029-2.webp new file mode 100644 index 0000000000..1b4f862e13 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_2_image-20200623000029-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_3_image-20200623000029-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_3_image-20200623000029-3.webp new file mode 100644 index 0000000000..4f3cfa150d Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_3_image-20200623000029-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_4_image-20200623000029-4_950x67.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_4_image-20200623000029-4_950x67.webp new file mode 100644 index 0000000000..e15d90e1ba Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_4_image-20200623000029-4_950x67.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_5_image-20200623000029-5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_5_image-20200623000029-5.webp new file mode 100644 index 0000000000..3e578dc351 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_5_image-20200623000029-5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_6_image-20200623000029-6_950x698.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_6_image-20200623000029-6_950x698.webp new file mode 100644 index 0000000000..6784bb935f Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_6_image-20200623000029-6_950x698.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_7_image-20200623000029-7_950x162.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_7_image-20200623000029-7_950x162.webp new file mode 100644 index 0000000000..6825989942 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_7_image-20200623000029-7_950x162.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_8_image-20200623000029-8_950x274.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_8_image-20200623000029-8_950x274.webp new file mode 100644 index 0000000000..8b19ba080c Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_8_image-20200623000029-8_950x274.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_9_image-20200623000029-9_950x181.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_9_image-20200623000029-9_950x181.webp new file mode 100644 index 0000000000..c5e983977f Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/300_9_image-20200623000029-9_950x181.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_1_image-20210414013029-6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_1_image-20210414013029-6.webp new file mode 100644 index 0000000000..e52454912d Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_1_image-20210414013029-6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_2_image-20210414013029-7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_2_image-20210414013029-7.webp new file mode 100644 index 0000000000..0fd499c57e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_2_image-20210414013029-7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_4_image-20210414013029-9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_4_image-20210414013029-9.webp new file mode 100644 index 0000000000..8d27ac1cf9 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_4_image-20210414013029-9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_5_image-20210414013029-10_724x538.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_5_image-20210414013029-10_724x538.webp new file mode 100644 index 0000000000..fbbc7bc024 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/364_5_image-20210414013029-10_724x538.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_1_sc-kb-o16.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_1_sc-kb-o16.webp new file mode 100644 index 0000000000..52748d6e76 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_1_sc-kb-o16.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_2_image-20200626100413-1_950x129.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_2_image-20200626100413-1_950x129.webp new file mode 100644 index 0000000000..fff8ff3122 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_2_image-20200626100413-1_950x129.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_3_image-20200626100413-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_3_image-20200626100413-2.webp new file mode 100644 index 0000000000..29e6ac8ddf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_3_image-20200626100413-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_4_image-20200626100413-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_4_image-20200626100413-3.webp new file mode 100644 index 0000000000..60959f12ca Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_4_image-20200626100413-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_5_image-20200626100413-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_5_image-20200626100413-4.webp new file mode 100644 index 0000000000..bed8eedf7b Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/438_5_image-20200626100413-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_1_img-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_1_img-1.webp new file mode 100644 index 0000000000..1faa72b070 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_1_img-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_2_img-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_2_img-2.webp new file mode 100644 index 0000000000..c6e73d0454 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_2_img-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_3_img-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_3_img-3.webp new file mode 100644 index 0000000000..f365b9f255 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/497_3_img-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/579_1_image-20190918135807-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/579_1_image-20190918135807-1.webp new file mode 100644 index 0000000000..4a7322bc61 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/579_1_image-20190918135807-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/579_2_image-20190918135807-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/579_2_image-20190918135807-2.webp new file mode 100644 index 0000000000..d58d60d1e0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/579_2_image-20190918135807-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_1_image-20200510105609-16_620x371.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_1_image-20200510105609-16_620x371.webp new file mode 100644 index 0000000000..0520caeaf3 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_1_image-20200510105609-16_620x371.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_3_image-20200510105609-17.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_3_image-20200510105609-17.webp new file mode 100644 index 0000000000..6a69f44a7a Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_3_image-20200510105609-17.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_5_image-20200510105609-18.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_5_image-20200510105609-18.webp new file mode 100644 index 0000000000..00664f1779 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_5_image-20200510105609-18.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_7_image-20200510105609-19.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_7_image-20200510105609-19.webp new file mode 100644 index 0000000000..a2f8780a25 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_7_image-20200510105609-19.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_9_image-20200510105609-20.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_9_image-20200510105609-20.webp new file mode 100644 index 0000000000..a05f859386 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/654_9_image-20200510105609-20.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/658_3_img-3_950x601.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/658_3_img-3_950x601.webp new file mode 100644 index 0000000000..703d06bde6 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/658_3_img-3_950x601.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/658_4_img-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/658_4_img-4.webp new file mode 100644 index 0000000000..b0790fda60 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/658_4_img-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_11_image-20200725154035-6_489x65.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_11_image-20200725154035-6_489x65.webp new file mode 100644 index 0000000000..a455ebb935 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_11_image-20200725154035-6_489x65.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_13_image-20200814161653-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_13_image-20200814161653-2.webp new file mode 100644 index 0000000000..1fc7e9a248 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_13_image-20200814161653-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_14_image-20200725154035-8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_14_image-20200725154035-8.webp new file mode 100644 index 0000000000..d8e7ee394d Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_14_image-20200725154035-8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_16_image-20200725154035-9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_16_image-20200725154035-9.webp new file mode 100644 index 0000000000..6f322f706f Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_16_image-20200725154035-9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_1_image-20200725154035-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_1_image-20200725154035-1.webp new file mode 100644 index 0000000000..4551abf847 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_1_image-20200725154035-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_3_image-20200725154035-2_626x151.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_3_image-20200725154035-2_626x151.webp new file mode 100644 index 0000000000..fd5004c098 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_3_image-20200725154035-2_626x151.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_5_image-20200725154035-3_493x143.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_5_image-20200725154035-3_493x143.webp new file mode 100644 index 0000000000..97422af553 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_5_image-20200725154035-3_493x143.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_7_image-20200725154035-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_7_image-20200725154035-4.webp new file mode 100644 index 0000000000..c271a621e0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_7_image-20200725154035-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_9_image-20200725154035-5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_9_image-20200725154035-5.webp new file mode 100644 index 0000000000..8502cd2be8 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/66_9_image-20200725154035-5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/827_1_image002_950x293.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/827_1_image002_950x293.webp new file mode 100644 index 0000000000..ff35cae218 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/827_1_image002_950x293.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/827_3_image004.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/827_3_image004.webp new file mode 100644 index 0000000000..b1822329cf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/827_3_image004.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_1_image-20210721211958-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_1_image-20210721211958-1.webp new file mode 100644 index 0000000000..3296aa0607 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_1_image-20210721211958-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_2_image-20210721211958-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_2_image-20210721211958-2.webp new file mode 100644 index 0000000000..cdbd91e097 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_2_image-20210721211958-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_3_image-20210721211958-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_3_image-20210721211958-3.webp new file mode 100644 index 0000000000..3ae1036bfa Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_3_image-20210721211958-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_4_image-20210721211958-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_4_image-20210721211958-4.webp new file mode 100644 index 0000000000..695bdd3e40 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_4_image-20210721211958-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_5_image-20210721211958-5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_5_image-20210721211958-5.webp new file mode 100644 index 0000000000..b2bfabdc8e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_5_image-20210721211958-5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_6_image-20210721211958-6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_6_image-20210721211958-6.webp new file mode 100644 index 0000000000..0bdf553979 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_6_image-20210721211958-6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_7_image-20210721211958-7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_7_image-20210721211958-7.webp new file mode 100644 index 0000000000..466eee9dda Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_7_image-20210721211958-7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_8_image-20210721211958-8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_8_image-20210721211958-8.webp new file mode 100644 index 0000000000..05b6da9088 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/867_8_image-20210721211958-8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_1_image-20220225024809-1_950x457.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_1_image-20220225024809-1_950x457.webp new file mode 100644 index 0000000000..75b07008e0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_1_image-20220225024809-1_950x457.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_2_image-20220225024809-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_2_image-20220225024809-2.webp new file mode 100644 index 0000000000..4bdbebd4f0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_2_image-20220225024809-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_3_image-20220225024809-3_900x490.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_3_image-20220225024809-3_900x490.webp new file mode 100644 index 0000000000..52ad292261 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/868_3_image-20220225024809-3_900x490.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_1_image-20220916231626-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_1_image-20220916231626-1.webp new file mode 100644 index 0000000000..53fd403e78 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_1_image-20220916231626-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_2_image-20220916231626-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_2_image-20220916231626-2.webp new file mode 100644 index 0000000000..671e5b88b5 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_2_image-20220916231626-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_3_image-20220916231626-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_3_image-20220916231626-3.webp new file mode 100644 index 0000000000..6ec23529f0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_3_image-20220916231626-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_4_image-20220916231626-4_950x517.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_4_image-20220916231626-4_950x517.webp new file mode 100644 index 0000000000..df8e2cdb3b Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_4_image-20220916231626-4_950x517.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_5_image-20220916231626-5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_5_image-20220916231626-5.webp new file mode 100644 index 0000000000..62631dc792 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_5_image-20220916231626-5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_6_image-20220916231626-6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_6_image-20220916231626-6.webp new file mode 100644 index 0000000000..5d146e2ff3 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/879_6_image-20220916231626-6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_1_image-20221221103111-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_1_image-20221221103111-1.webp new file mode 100644 index 0000000000..3f35a47940 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_1_image-20221221103111-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_2_image-20221221103111-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_2_image-20221221103111-2.webp new file mode 100644 index 0000000000..b9d6102cc9 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_2_image-20221221103111-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_3_image-20221221103111-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_3_image-20221221103111-3.webp new file mode 100644 index 0000000000..dfb25f1b25 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_3_image-20221221103111-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_4_image-20221221103111-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_4_image-20221221103111-4.webp new file mode 100644 index 0000000000..8da9f5da44 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_4_image-20221221103111-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_5_image-20221221103111-5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_5_image-20221221103111-5.webp new file mode 100644 index 0000000000..9eee3e3d19 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/923_5_image-20221221103111-5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers.webp new file mode 100644 index 0000000000..88764c4164 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers_1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers_1.webp new file mode 100644 index 0000000000..c4cf4e92d7 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers_1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers_2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers_2.webp new file mode 100644 index 0000000000..750d516af5 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/about_endpointpolicymanager_scripts_triggers_2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers.webp new file mode 100644 index 0000000000..d4cfb96e7f Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_1.webp new file mode 100644 index 0000000000..9d862c7be6 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_10.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_10.webp new file mode 100644 index 0000000000..35fb2894c9 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_10.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_11.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_11.webp new file mode 100644 index 0000000000..6ad002863e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_11.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_12.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_12.webp new file mode 100644 index 0000000000..c24a258c39 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_12.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_13.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_13.webp new file mode 100644 index 0000000000..f1aa68e45c Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_13.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_14.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_14.webp new file mode 100644 index 0000000000..ad4e2987ea Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_14.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_15.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_15.webp new file mode 100644 index 0000000000..7351b12a62 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_15.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_16.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_16.webp new file mode 100644 index 0000000000..4d115679c4 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_16.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_17.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_17.webp new file mode 100644 index 0000000000..4d6ff170d0 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_17.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_18.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_18.webp new file mode 100644 index 0000000000..b93c99d8e4 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_18.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_19.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_19.webp new file mode 100644 index 0000000000..c66e544832 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_19.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_2.webp new file mode 100644 index 0000000000..dec589a4e6 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_3.webp new file mode 100644 index 0000000000..f2cfbec9c9 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_4.webp new file mode 100644 index 0000000000..028a0e09cf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_5.webp new file mode 100644 index 0000000000..28b803f94e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_6.webp new file mode 100644 index 0000000000..ed147e5329 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_7.webp new file mode 100644 index 0000000000..38480e2a81 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_8.webp new file mode 100644 index 0000000000..d472122986 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_9.webp new file mode 100644 index 0000000000..c0c153fccf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/gettoknow/getting_to_know_scripts_triggers_9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting.webp new file mode 100644 index 0000000000..2c790b7dff Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_1.webp new file mode 100644 index 0000000000..8785f29581 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_2.webp new file mode 100644 index 0000000000..5ff7158bde Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_3.webp new file mode 100644 index 0000000000..1ea1187e92 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_4.webp new file mode 100644 index 0000000000..7b18f2c310 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_5.webp new file mode 100644 index 0000000000..3223da0e62 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_6.webp new file mode 100644 index 0000000000..cb98fc4752 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_7.webp new file mode 100644 index 0000000000..6544489506 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_8.webp new file mode 100644 index 0000000000..ad2f6d0acf Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/itemleveltargeting/using_item_level_targeting_8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_1_image-20200220185019-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_1_image-20200220185019-1.webp new file mode 100644 index 0000000000..b44924d770 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_1_image-20200220185019-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_3_image-20200220185019-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_3_image-20200220185019-2.webp new file mode 100644 index 0000000000..f1871a1e56 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_3_image-20200220185019-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_5_image-20200220185019-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_5_image-20200220185019-3.webp new file mode 100644 index 0000000000..b2f271ac38 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_5_image-20200220185019-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_7_image-20200220185019-9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_7_image-20200220185019-9.webp new file mode 100644 index 0000000000..b5d7c717b1 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_7_image-20200220185019-9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_9_image-20210204105234-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_9_image-20210204105234-1.webp new file mode 100644 index 0000000000..5967107e44 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/216_9_image-20210204105234-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_10_image-20210424015614-10.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_10_image-20210424015614-10.webp new file mode 100644 index 0000000000..ecc6c722b2 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_10_image-20210424015614-10.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_11_image-20210424015614-11.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_11_image-20210424015614-11.webp new file mode 100644 index 0000000000..11a253a308 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_11_image-20210424015614-11.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_12_image-20210424015614-12.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_12_image-20210424015614-12.webp new file mode 100644 index 0000000000..f8ab378d60 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_12_image-20210424015614-12.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_13_image-20210424015614-13.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_13_image-20210424015614-13.webp new file mode 100644 index 0000000000..7ae043f945 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_13_image-20210424015614-13.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_2_image-20210424015614-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_2_image-20210424015614-2.webp new file mode 100644 index 0000000000..0f8b50b888 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_2_image-20210424015614-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_3_image-20210424015614-3.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_3_image-20210424015614-3.webp new file mode 100644 index 0000000000..516d4d3081 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_3_image-20210424015614-3.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_4_image-20210424015614-4.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_4_image-20210424015614-4.webp new file mode 100644 index 0000000000..df9547b544 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_4_image-20210424015614-4.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_6_image-20210424015614-6.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_6_image-20210424015614-6.webp new file mode 100644 index 0000000000..88b5ce1029 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_6_image-20210424015614-6.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_7_image-20210424015614-7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_7_image-20210424015614-7.webp new file mode 100644 index 0000000000..42463ac8d7 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_7_image-20210424015614-7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_8_image-20210424015614-8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_8_image-20210424015614-8.webp new file mode 100644 index 0000000000..da070cd633 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_8_image-20210424015614-8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_9_image-20210424015614-9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_9_image-20210424015614-9.webp new file mode 100644 index 0000000000..475649a745 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/639_9_image-20210424015614-9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_10_image-20210801230156-10.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_10_image-20210801230156-10.webp new file mode 100644 index 0000000000..6282da05c5 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_10_image-20210801230156-10.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_11_image-20210801230156-11.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_11_image-20210801230156-11.webp new file mode 100644 index 0000000000..d0d234e830 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_11_image-20210801230156-11.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_12_image-20210801230156-12.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_12_image-20210801230156-12.webp new file mode 100644 index 0000000000..f2694245c4 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_12_image-20210801230156-12.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_16_image-20210801230156-16.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_16_image-20210801230156-16.webp new file mode 100644 index 0000000000..11286a75a1 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_16_image-20210801230156-16.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_17_image-20210801230156-17.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_17_image-20210801230156-17.webp new file mode 100644 index 0000000000..040600049e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_17_image-20210801230156-17.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_1_image-20210801230156-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_1_image-20210801230156-1.webp new file mode 100644 index 0000000000..dc7381d2d4 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_1_image-20210801230156-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_7_image-20210801230156-7.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_7_image-20210801230156-7.webp new file mode 100644 index 0000000000..b6aadaf425 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_7_image-20210801230156-7.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_8_image-20210801230156-8.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_8_image-20210801230156-8.webp new file mode 100644 index 0000000000..c80a6b4094 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_8_image-20210801230156-8.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_9_image-20210801230156-9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_9_image-20210801230156-9.webp new file mode 100644 index 0000000000..df02bcc4cc Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/mappeddrives/848_9_image-20210801230156-9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm01.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm01.webp new file mode 100644 index 0000000000..b79ecb9c91 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm01.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm02.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm02.webp new file mode 100644 index 0000000000..172911881e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm02.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm03.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm03.webp new file mode 100644 index 0000000000..6ee3f4c6a5 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm03.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm04.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm04.webp new file mode 100644 index 0000000000..95c8ee9cd8 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm04.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm05.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm05.webp new file mode 100644 index 0000000000..6047759f9e Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm05.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm06.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm06.webp new file mode 100644 index 0000000000..634abe3130 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm06.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm07.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm07.webp new file mode 100644 index 0000000000..e561a06019 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm07.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm08.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm08.webp new file mode 100644 index 0000000000..fcb3062ad9 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm08.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm09.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm09.webp new file mode 100644 index 0000000000..fdec7a4f22 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm09.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm10.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm10.webp new file mode 100644 index 0000000000..b7407ff645 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm10.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm11.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm11.webp new file mode 100644 index 0000000000..e52a881e79 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm11.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm12.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm12.webp new file mode 100644 index 0000000000..09f57c5f19 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/assets/nsm12.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/_category_.json new file mode 100644 index 0000000000..c836ac9eef --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Get to Know", + "position": 20, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/computerside.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/computerside.md new file mode 100644 index 0000000000..8d7d00c9ba --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/computerside.md @@ -0,0 +1,47 @@ +--- +title: "Using Endpoint Policy Manager Scripts on the Computer Side" +description: "Using Endpoint Policy Manager Scripts on the Computer Side" +sidebar_position: 20 +--- + +# Using Endpoint Policy Manager Scripts on the Computer Side + +In the Quickstart example, we delivered scripts to users, but Endpoint Policy Manager can also +deliver scripts on the Computer side. There are two options when you create a scripts policy from +the Computer side, which can be seen in Figure 17. + +![getting_to_know_scripts_triggers_13](../assets/gettoknow/getting_to_know_scripts_triggers_13.webp) + +Figure 17. Using Endpoint Policy Manager Scripts & Triggers Manager Wizard on the Computer side. + +The two options to select from are: + +- Apply this policy to computer (default):  This will apply the settings to the computer in the + System context. This is best when you're trying to do things that only the system should do, like + manipulate the Registry with HKLM keys or system files, and so on. The policy only applies when + the Computer context is used. +- Apply this policy to all users who log into the computer (switched mode): This setting will run + the script either as System (default behavior) or in the User context. This gives you the ability + to run a script anytime a user logs into the computer, and then also specify the context (System + or User.) + +:::note +Scripts placed on the Computer side, but run in the User context can be run interactively. +But scripts run in the System context cannot be run interactively. +::: + + +The main advantage to applying scripts on the Computer side, but running in User context, is that +you do not need Loopback in order to deliver user-side scripts to computers. In this way, you can +target specific scripts for collections of computers like training rooms, free seating areas, VDI, +and similar situations, and ensure that the same script runs for everyone who sits down at these +computers. + +Note some subtle differences about when policies are set to "Always apply": + +- Switched policies apply to users (even though they're targeted to computers.) As such, all + switched policies apply on login and anytime the Group Policy service updates (in the background, + and manually when you run GPupdate and PPupdate). +- All policies with "Always apply" selected will reapply when policy changes are made. +- All policies with "Always apply" selected will reapply when the Endpoint Policy Manager service + starts up. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/overview.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/overview.md new file mode 100644 index 0000000000..414ebe32ad --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/overview.md @@ -0,0 +1,44 @@ +--- +title: "Getting to Know Scripts & Triggers Manager" +description: "Getting to Know Scripts & Triggers Manager" +sidebar_position: 30 +--- + +# Getting to Know Scripts & Triggers Manager + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts & Triggers Manager is contained within +the PolicyPak node, as demonstrated in Figure 4. Endpoint Policy Manager Scripts & Triggers Manager +MMC snap-in enables you to create a new Endpoint Policy Manager Scripts & Triggers Manager policy or +collection. + +:::note +You will only see the Endpoint Policy Manager Scripts & Triggers Manager node when the +latest Admin Console MSI is installed on the management station. +::: + + +![getting_to_know_scripts_triggers](../assets/gettoknow/getting_to_know_scripts_triggers.webp) + +Figure 4. The location of the Endpoint Policy Manager Scripts & Triggers Manager. + +The functions of collections and policies are as follows: + +- Policies are the rules that perform the work. +- Collections are groupings of policies. + +The next section provides a Quickstart to using Endpoint Policy Manager Scripts & Triggers Manager. +We suggest you download the sample scripts that we've provided on our website to your management +station and follow along. Select the Guidance XMLs and Scripts category, then download them, as seen +in Figure 5. + +![getting_to_know_scripts_triggers_1](../assets/gettoknow/getting_to_know_scripts_triggers_1.webp) + +Figure 5. Download the Endpoint Policy Manager scripts from the Guidance XMLs location in the +Endpoint Policy Manager Portal. + +Before continuing, make sure you have the downloaded script examples unpacked and ready to go. You +should have a folder that looks similar to what's seen in Figure 6. + +![getting_to_know_scripts_triggers_2](../assets/gettoknow/getting_to_know_scripts_triggers_2.webp) + +Figure 6. Endpoint Policy Manager script examples unpacked. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/shortcuts.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/shortcuts.md new file mode 100644 index 0000000000..3f0e55e5ba --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/shortcuts.md @@ -0,0 +1,126 @@ +--- +title: "Quick Start - Making and Removing Shortcuts" +description: "Quick Start - Making and Removing Shortcuts" +sidebar_position: 10 +--- + +# Quick Start - Making and Removing Shortcuts + +:::note +For some video overviews of Endpoint Policy Manager Scripts & Triggers Manager, see +[https://www.endpointpolicymanager.com/products/endpointpolicymanager-scripts-manager.html](https://www.endpointpolicymanager.com/products/endpointpolicymanager-scripts-manager.html) +::: + + +In this Quickstart example, we're going to deliver a shortcut to the desktop with a script. The +shortcut will appear when the policy applies, and disappear when the policy no longer applies (i.e., +when it "falls out of scope"). + +**Step 1 –** Start out on your GPMC management station to create a group policy object (GPO) and +link it to your users. In this example (Figure 7) we have a GPO created and linked it to the East +Sales Users OU. + +![getting_to_know_scripts_triggers_3](../assets/gettoknow/getting_to_know_scripts_triggers_3.webp) + +Figure 7. Using Group Policy to create and link a GPO to East Sales Users. + +**Step 2 –** Edit the GPO, then go to User Configuration | Endpoint Policy Manager | Scripts & +Triggers Manager as shown in Figure 8 and select Add | New Policy. + +![getting_to_know_scripts_triggers_4](../assets/gettoknow/getting_to_know_scripts_triggers_4.webp) + +Figure 8. Using the Group Policy Editor to make a new Endpoint Policy Manager Scripts & Triggers +Manager policy. + +**Step 3 –** When you do this, the Endpoint Policy Manager Scripts & Triggers Manager Wizard +appears. Click "Next" to continue. + +**Step 4 –** At the "On apply action" page, select "PowerShell script," then paste in the contents +from the PS\Create_endpointpolicymanager_Shortcut.ps1 file from the PS folder included in the downloaded +examples. The result can be seen in Figure 9. + +![getting_to_know_scripts_triggers_5](../assets/gettoknow/getting_to_know_scripts_triggers_5.webp) + +Figure 9. Using Endpoint Policy Manager Scripts & Trigger Manager to deliver a PowerShell script. + +It should be noted that "Run interactively" is not checked in this example. This option should be +used when you want to see an individual script perform its work, or if the user needs to interact +with the script. + +:::note +The "Run interactively" option is not available when the policy specifies that a script is +meant for computers. +::: + + +**Step 5 –** On the "On revert action" page, select "PowerShell script," then copy in the +Remove_endpointpolicymanager_Shortcut.ps1 script contents, as seen in Figure 10. + +![getting_to_know_scripts_triggers_6](../assets/gettoknow/getting_to_know_scripts_triggers_6.webp) + +Figure 10. Setting up a Revert Action script when the policy no longer applies. + +**Step 6 –** Click "Next" to continue. You will encounter the "Specify process mode" screen seen in +Figure 11. + +![getting_to_know_scripts_triggers_7](../assets/gettoknow/getting_to_know_scripts_triggers_7.webp) + +Figure 11. Specifying when the script should run. + +The "Specify process mode" page enables you to dictate when a script will apply. + +- Always: Will apply every time a policy processes. + + - For Group Policy, this coincides with login, and runs in the background about every 90 minutes + or so, when a DC is available. + - For Endpoint Policy Manager Cloud, this is every 60 minutes. (If you can see the Endpoint + Policy Manager Cloud service.) + - For Endpoint Policy Manager + MDM, this will apply user policies on login and on the computer + side. "Switched" policies, explained later, should apply when the Endpoint Policy Manager + service starts or restarts (for example, on a reboot). + +- Once: Will only apply one time when the policy is initially placed on the machine (when using + Group Policy, Microsoft Endpoint Manager, or an MDM method). +- Once or when forced: Will initially apply only one time, but you can re-run the policy and its + script by running` gpupdate /force` when using Group Policy or `ppupdate /force` when using any + other policy deployment method. + +**Step 7 –** For this Quickstart example, select the default and click "Next." At the "Policy +settings" page, give the policy a name like "Desktop icon on and off." Leave the State and +Item-Level Targeting fields set with the defaults, as shown in Figure 12, and click "Finish." + +![getting_to_know_scripts_triggers_8](../assets/gettoknow/getting_to_know_scripts_triggers_8.webp) + +Figure 12. Endpoint Policy Manager Scripts & Triggers Manager Wizard final settings page. + +The result of the policy you created can be seen in an entry like the one shown in Figure 13. + +![getting_to_know_scripts_triggers_9](../assets/gettoknow/getting_to_know_scripts_triggers_9.webp) + +Figure 13. The new Endpoint Policy Manager scripts policy in the Group Policy Editor. + +You can also validate that your settings are contained within the GPO by looking at the Group Policy +HTML settings report in the GPMC, as shown in Figure 14. + +![getting_to_know_scripts_triggers_10](../assets/gettoknow/getting_to_know_scripts_triggers_10.webp) + +Figure 14. Endpoint Policy Manager Scripts & Triggers Manager items appear in the GPMC reports. + +**Step 8 –** Now for testing, log into the endpoint as a new or existing user for whom the policy +applies. In this example, we'll log in as EastSalesUser8. When logging in, you'll see the policy +apply the script and an icon like the one shown in Figure 15 will be visible. + +![getting_to_know_scripts_triggers_11](../assets/gettoknow/getting_to_know_scripts_triggers_11.webp) + +Figure 15. An example of a Endpoint Policy Manager Scripts & Triggers Manager PowerShell script on +the endpoint. + +**Step 9 –** To complete testing, go back to the GPMC, and un-link the GPO to make it stop applying, +as seen in Figure 16. + +![getting_to_know_scripts_triggers_12](../assets/gettoknow/getting_to_know_scripts_triggers_12.webp) + +Figure 16. Make a policy stop applying by removing the "Link Enabled" settings in the GPMC. + +The policy has now fallen out of scope and will stop applying. Back on the endpoint, run GPupdate. +When you do, the "Off" script will run and the "Visit Endpoint Policy Manager" icon will disappear. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/usage.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/usage.md new file mode 100644 index 0000000000..1e30048817 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/gettoknow/usage.md @@ -0,0 +1,70 @@ +--- +title: "Using Endpoint Policy Manager Scripts and Triggers" +description: "Using Endpoint Policy Manager Scripts and Triggers" +sidebar_position: 30 +--- + +# Using Endpoint Policy Manager Scripts and Triggers + +You may want to map a drive on a remote machine whenever it connects to the network through VPN or +map a printer whenever a user opens a designated application and then unmap the drive or printer +once the VPN connection or application is closed. You can do this through the use of Endpoint Policy +Manager scripts and triggers. + +:::note +For an overview of Endpoint Policy Manager scripts and triggers see +[Endpoint Policy Manager Scripts + Triggers: Map a printer or drive when a process runs and un-map it when closed.](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/mapdrivetriggers.md). +::: + + +**Step 1 –** Let's use an example in which you want to map a printer for your users whenever they +use Acrobat Reader. There are a couple of script options we can use to map a printer. It is highly +recommended that you manually test your scripts first in order to make sure they work properly. This +will prevent you from having to troubleshoot issues down the road when you deploy your policies. In +Figure 18 we are using a simple PowerShell script to map the printer. (If the PowerShell script +doesn't work for your environment then you can use a traditional batch script to map it.) + +![getting_to_know_scripts_triggers_14](../assets/gettoknow/getting_to_know_scripts_triggers_14.webp) + +Figure 18. Using a PowerShell script to map a printer. + +**Step 2 –** There are no revert scripts when using triggers so this section is not applicable as +shown in Figure 19. + +![getting_to_know_scripts_triggers_15](../assets/gettoknow/getting_to_know_scripts_triggers_15.webp) + +Figure 19. There are no revert scripts when using triggers. + +**Step 3 –** You then need to select your desired trigger type. In Figure 20 we are selecting +"Process start."  Notice the other trigger options available. + +![getting_to_know_scripts_triggers_16](../assets/gettoknow/getting_to_know_scripts_triggers_16.webp) + +Figure 20. Choosing the desired trigger type. + +**Step 4 –** You must then select the process. You can either point to the application file or point +to the application process itself if it is currently running. In Figure 21 we have selected the +Acrobat Reader file. + +![getting_to_know_scripts_triggers_17](../assets/gettoknow/getting_to_know_scripts_triggers_17.webp) + +Figure 21. Selecting the application file. + +**Step 5 –** You can then configure Item-level Targeting if desired. + +**Step 6 –** Now you need to create another policy that will remove the printer mapping once the +user closes Acrobat Reader. To do this, we will use a PowerShell script, shown in Figure 22. + +![getting_to_know_scripts_triggers_18](../assets/gettoknow/getting_to_know_scripts_triggers_18.webp) + +Figure 22. Using a PowerShell script to remove a printer connection. + +**Step 7 –** Now you need to select "Process close" for the trigger type, as shown in Figure 23. + +![getting_to_know_scripts_triggers_19](../assets/gettoknow/getting_to_know_scripts_triggers_19.webp) + +Figure 23. Choosing "Process close" as the trigger type to remove the printer when the user closes +Acrobat Reader. + +**Step 8 –** Finally, point to the application file or open process and configure Item-level +Targeting if desired. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/insouts.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/insouts.md new file mode 100644 index 0000000000..e78ed18144 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/insouts.md @@ -0,0 +1,47 @@ +--- +title: "Scripts and Triggers Manager Ins and Outs" +description: "Understanding the ins and outs of Scripts and Triggers Manager" +sidebar_position: 40 +--- + +# Scripts and Triggers Manager Ins and Outs + +Netwrix Endpoint Policy Manager Scripts and Triggers Manager provides comprehensive script management capabilities for enterprise environments. This guide covers the essential aspects of configuration and deployment. + +## Key Configuration Options + +Scripts and Triggers Manager offers flexible configuration options to meet various enterprise requirements: + +### Script Types Supported +- **PowerShell Scripts**: Modern Windows automation +- **Batch Files**: Traditional Windows batch processing +- **VBScript**: Legacy Visual Basic scripting +- **JavaScript**: Cross-platform scripting support + +### Execution Contexts +- **User Context**: Scripts run with user permissions +- **Computer Context**: Scripts run with system permissions +- **Elevated Privileges**: Administrative execution when required + +## Deployment Scenarios + +### Group Policy Integration +Scripts can be deployed through traditional Group Policy mechanisms, providing familiar management workflows for IT administrators. + +### Cloud-Based Management +Integration with Endpoint Policy Manager Cloud enables modern management approaches for hybrid and remote environments. + +### Hybrid Deployments +Combine on-premises and cloud management for maximum flexibility across diverse infrastructure configurations. + +## Best Practices + +1. **Test Thoroughly**: Always test scripts in development environments before production deployment +2. **Use Proper Logging**: Implement comprehensive logging for troubleshooting and compliance +3. **Security Considerations**: Follow principle of least privilege when configuring execution contexts +4. **Version Control**: Maintain proper version control for script deployments +5. **Documentation**: Document script purpose, requirements, and expected outcomes + +## Troubleshooting + +For troubleshooting guidance, refer to the Technical Notes section which provides detailed information on common issues and their resolutions. \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/_category_.json new file mode 100644 index 0000000000..8792290277 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Item-Level Targeting", + "position": 30, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/exportcollections.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/exportcollections.md new file mode 100644 index 0000000000..1e2600ca39 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/exportcollections.md @@ -0,0 +1,64 @@ +--- +title: "Exporting Collections" +description: "Exporting Collections" +sidebar_position: 20 +--- + +# Exporting Collections + +Appendix A: [Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md) explains +how to use the Endpoint Policy Manager Exporter to wrap up any Endpoint Policy Manager directive and +deliver it using an MDM service such as Microsoft Endpoint Manager (SCCM and Intune), KACE, and so +on, as well as via Endpoint Policy Manager Cloud. + +:::note +For a video demonstrating the use of Endpoint Policy Manager scripts with Endpoint Policy +Manager Cloud and an MDM service see +[Endpoint Policy ManagerScripts .. Deploy Software via VPN or with Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/withcloud/cloud.md) +and +[Endpoint Policy Manager Scripts and YOUR MDM service: Un-real power](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/methods/mdm.md) +::: + + +Remember that Endpoint Policy Manager Scripts & Triggers Manager policies can be created and +exported on the User or Computer side. For instance, in Figure 30, you can see an export from the +User side. + +![using_item_level_targeting_6](../assets/itemleveltargeting/using_item_level_targeting_6.webp) + +Figure 30. Exporting a policy from the User side. + +In Figure 31, you can see an export of a Endpoint Policy Manager Scripts & Triggers Manager XML file +from the Computer side. + +![using_item_level_targeting_7](../assets/itemleveltargeting/using_item_level_targeting_7.webp) + +Figure 31. Exporting a collection from the Computer side. + +Here are some helpful tips to decide which side to use: + +- When you export a user-side policy, and deploy it using Endpoint Policy Manager Cloud or MDM, it + will apply to every user on the machine (like switched mode). +- When you export a computer-side policy that affects the system, and deploy it using Endpoint + Policy Manager Cloud or MDM, it will apply to the computer as system. +- When you export a computer-side policy that affect all users on the machine, and deploy it using + Endpoint Policy Manager Cloud or MDM, it will apply to every user on the machine (like switched + mode). + +To export a policy for later use with Endpoint Policy Manager Exporter or Endpoint Policy Manager +Cloud, right-click the collection or the policy and select "Export as XML," as demonstrated in +Figure 32. + +:::note +For a video showing how to export policies and use Endpoint Policy Manager Exporter, watch +[Deploying Endpoint Policy Managerdirectives without Group Policy (Endpoint Policy Manager Exporter Utility)](/docs/endpointpolicymanager/knowledgebase/gettingstartedmdm/videolearningcenter/exportingtips/exporterutility.md). +::: + + +![using_item_level_targeting_8](../assets/itemleveltargeting/using_item_level_targeting_8.webp) + +Figure 32. Choosing this option will allow the user to export the policy for later use. + +Note that exported collections or policies maintain any Item-Level Targeting set within them. If +you've used items that represent Group Membership in Active Directory, then those items will only +function when the machine is domain-joined. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/overview.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/overview.md new file mode 100644 index 0000000000..3c78a443b8 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/overview.md @@ -0,0 +1,73 @@ +--- +title: "Using Item-Level Targeting with Collections and Policies" +description: "Using Item-Level Targeting with Collections and Policies" +sidebar_position: 40 +--- + +# Using Item-Level Targeting with Collections and Policies + +Item-Level Targeting is used in Microsoft Group Policy Preferences and other areas of Netwrix +Endpoint Policy Manager (formerly PolicyPak) to target or filter where specific items will apply. +With Endpoint Policy Manager Scripts & Triggers Manager, Item-Level Targeting can be placed on +collections, as well as Endpoint Policy Manager Scripts & Triggers Manager policies within +collections. + +A collection enables you to group together Endpoint Policy Manager Scripts & Triggers Manager +policies so they can act together. For instance, you might create a collection for only East Sales +computers and another for West Sales computers. Or you might create a collection for Windows 10 +machines and one for Windows Server 2016 RDS, as seen in Figure 24. + +![using_item_level_targeting](../assets/itemleveltargeting/using_item_level_targeting.webp) + +Figure 24. Scripts & Triggers Manger allows the user to create collections and then set Item-Level +Targeting upon the collections. + +Right-click any Endpoint Policy Manager Scripts & Triggers Manager policy, and select "Edit Item +Level Targeting," as demonstrated in Figure 25. + +![using_item_level_targeting_1](../assets/itemleveltargeting/using_item_level_targeting_1.webp) + +Figure 25. Setting Item-Level Targeting for policy entries themselves. + +The "Edit Item Level Targeting" menu item brings up the Targeting Editor, which is shown in +Figure 26. You can select any combination of characteristics you want to test for. Administrators +familiar with Group Policy Preferences' Item-Level Targeting will be at home in this interface as it +is functionally equivalent. + +You can apply one or more targeting items to a policy, which enables targeting items to be joined +logically, also shown in Figure 26. You can also add targeting collections, which group together +targeting items in much the same way parentheses are used in an equation. In this way, you can +create a complex determination about where a policy will be applied. Collections may be set to +"And", "Or", "Is", or "Is Not." + +![using_item_level_targeting_2](../assets/itemleveltargeting/using_item_level_targeting_2.webp) + +Figure 26. In this example, the Pak would only apply to Windows 10 machines when the machine is +portable and the user is in the FABRIKAM\Traveling Sales Users group. + +Below are some real-world examples of of how you can use Item-Level Targeting. + +- Software prerequisites. If you want to configure an application's settings, first make sure the + application is installed on the user's computer before configuring it. You can use File Match or + Registry Match targeting items (or both) to verify a specific version of a file or a registry + entry is present. (For an example of this, look in the Uninstall registry key.) +- Mobile computers. If you want to deploy settings exclusively for users on mobile PCs, then filter + the rule to apply only to mobile PCs by using the "Portable Computer" targeting item. +- Operating system version. You can specify different settings for applications based on the + operating system version. To do this, create one rule for each operating system. Then filter each + rule using the "Operating System" targeting item. +- Group membership. You can link the Group Policy Object (GPO) to the whole domain or organizational + unit (OU), but only members within a specific group will pick up and process the rule settings. +- IP range. You can specify different settings for various IP ranges, like different settings for + the home office and each field office. + +After editing is completed, close the editor. Note that the icon for the policy or collection has +changed to orange, which shows that it now has Item-Level Targeting, as seen in Figure 27. + +![using_item_level_targeting_3](../assets/itemleveltargeting/using_item_level_targeting_3.webp) + +Figure 27. When the policy or collection's icon is orange, the entry has Item-Level Targeting. + +When Item-Level Targeting is on, the policy won't apply unless the conditions are true. If +Item-Level Targeting is on a collection, then none of the items in the collection will apply unless +the Item-Level Targeting on the collection evaluates to True. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/processorderprecedence.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/processorderprecedence.md new file mode 100644 index 0000000000..dfb318c0bb --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/itemleveltargeting/processorderprecedence.md @@ -0,0 +1,38 @@ +--- +title: "Understanding Processing Order and Precedence" +description: "Understanding Processing Order and Precedence" +sidebar_position: 10 +--- + +# Understanding Processing Order and Precedence + +Within a particular GPO (Computer or User side), the processing order is counted in numerical order. +So lower-numbered collections attempt to process first, and higher-numbered collections attempt to +process last as shown in Figure 28. Then, within any collection, each policy is processed in +numerical order from lowest to highest, as seen in Figure 29. + +![using_item_level_targeting_4](../assets/itemleveltargeting/using_item_level_targeting_4.webp) + +Figure 28. The order collections are processed in. + +![using_item_level_targeting_5](../assets/itemleveltargeting/using_item_level_targeting_5.webp) + +Figure 29. The order policies are processed in. + +## Merging and Conflicts + +Endpoint Policy Manager Scripts & Triggers Manager will merge all policies that come from the Group +Policy method (and/or policies and collections deployed from methods other than Group Policy), +unless there is a conflict. + +## Precedence + +Policies can be delivered by Group Policy and non-Group Policy methods such as Microsoft Endpoint +Manager (SCCM and Intune) via Endpoint Policy Manager Exporter or Endpoint Policy Manager Cloud. As +such, the Endpoint Policy Manager engine needs to make a final determination whether there is any +overlap of policies. Here is how the precedence works: + +- Policies delivered through Endpoint Policy Manager Cloud have the lowest precedence. +- Policies delivered through Endpoint Policy Manager files have the next highest precedence. +- Policies delivered through Endpoint Policy Manager Group Policy directives have the highest + precedence. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/overview.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/overview.md new file mode 100644 index 0000000000..f00ef5ff25 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/overview.md @@ -0,0 +1,72 @@ +--- +title: "Scripts & Triggers Manager" +description: "Scripts & Triggers Manager" +sidebar_position: 20 +--- + +# Scripts & Triggers Manager + +:::note +Before reading this section, please ensure you have read Book 2: +[Installation Quick Start](/docs/endpointpolicymanager/manuals/introductionandquick/overviewinstall/overviewinstall.md), which will help you +learn to do the following: +::: + + +- Install the Admin MSI on your GPMC machine +- Install the CSE on a test Windows machine +- Set up a computer in Trial mode or Licensed mode +- Set up a common OU structure + +Optionally, if you don't want to use Group Policy, read the section in Appendix A: +[Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md) to deploy your +directives. + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts & Triggers Manager enables you to +perform the following operations on Windows 10: + +- Deliver scripts of most usual types (Batch, Powershell, VB and JavaScript) +- Deliver scripts to both User and Computer sides +- Deliver an "On" script when conditions are true, and an "Off" script when conditions are false. + +:::note +Watch this video for an overview of Endpoint Policy Manager Scripts & Triggers Manager: +[Use with on-prem Group Policy](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/gettingstarted/onpremise.md) +::: + + +The basic way to use Scripts & Triggers Manager is as follows: + +- Create a rule to express which file extensions should launch which applications. +- Export the Scripts & Triggers Manager rules and deliver them using: + + - Microsoft Endpoint Manager (SCCM and Intune) + - Your own systems management software + - A mobile device management (MDM) service + - Endpoint Policy Manager Cloud service + +- Allow the client machine with the Endpoint Policy Manager client-side extension (CSE) to embrace + the directives and perform the work. + +:::note +If you use the Endpoint Policy Manager Cloud service, you can deliver Group Policy +settings even to non-domain-joined machines over the Internet. +::: + + +## Moving Parts + +- A management station. The Endpoint Policy Manager Admin Console MSI must be installed on the + management station where you create group policy objects (GPOs). Once it's installed, you'll see + the Endpoint Policy Manager | Endpoint Policy Manager Scripts & Triggers Manager node. +- The Endpoint Policy Manager CSE. This runs on the client (target) machine and is the same CSE for + all Endpoint Policy Manager products. There isn't anything separate to install, and the Endpoint + Policy Manager CSE must be present in order to accept Endpoint Policy Manager Scripts & Triggers + Manager directives via Group Policy, or when using Microsoft Endpoint Manager (SCCM and Intune), + KACE, MDM, or similar utilities. +- Endpoints. In order to use these, they must be licensed for Endpoint Policy Manager Scripts & + Triggers Manager using one of the licensing methods. +- Endpoint Policy Manager Exporter (optional). A free utility that lets you take Endpoint Policy + Manager Scripts & Triggers Manager and our other products' XML files and wrap them into a + "portable" MSI file for deployment using Microsoft Endpoint Manager (SCCM and Intune), an MDM + service, or your own systems management software. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/overview_1.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/overview_1.md new file mode 100644 index 0000000000..0d96310089 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/manual/overview_1.md @@ -0,0 +1,37 @@ +--- +title: "Scripts and Triggers Manager Overview" +description: "Overview of Scripts and Triggers Manager functionality and capabilities" +sidebar_position: 1 +--- + +# Scripts and Triggers Manager Overview + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts & Triggers Manager provides powerful automation capabilities for managing scripts and triggering actions across your enterprise. This component allows administrators to deploy, execute, and manage scripts on endpoint devices through Group Policy or cloud-based management platforms. + +## Key Features + +- **Script Deployment**: Deploy PowerShell, batch, and VBScript files to endpoints +- **Event-Based Triggers**: Execute scripts based on system events, logons, or schedules +- **User and Computer Context**: Run scripts in both user and computer contexts +- **Cloud and On-Premises**: Works with both traditional Group Policy and Endpoint Policy Manager Cloud +- **Comprehensive Logging**: Detailed execution logs for troubleshooting and compliance + +## Common Use Cases + +- **System Configuration**: Automate registry changes, service configurations, and system settings +- **Software Management**: Deploy applications, manage licenses, and configure software +- **Network Management**: Map network drives, configure VPN connections, and manage network settings +- **Security Hardening**: Implement security policies, password management, and compliance requirements +- **User Environment**: Customize desktop settings, deploy shortcuts, and configure user preferences + +## Getting Started + +Scripts and Triggers Manager integrates seamlessly with your existing Group Policy infrastructure or can be deployed through Endpoint Policy Manager Cloud. Scripts are executed with appropriate permissions and can be triggered by various events including: + +- User logon/logoff +- System startup/shutdown +- Group Policy refresh +- Custom event log triggers +- Scheduled intervals + +For detailed implementation guidance, see the technical notes and tips & tricks sections of this documentation. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/_category_.json new file mode 100644 index 0000000000..7a44f646c0 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Technical Notes", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_10_4188230b3e50a95465a6cf8a84abb867.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_10_4188230b3e50a95465a6cf8a84abb867.webp new file mode 100644 index 0000000000..e03d2c60cc Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_10_4188230b3e50a95465a6cf8a84abb867.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_2_02a0661341d87f03cca56ccbf243d833.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_2_02a0661341d87f03cca56ccbf243d833.webp new file mode 100644 index 0000000000..fe7f7c3e93 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_2_02a0661341d87f03cca56ccbf243d833.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_3_c1ba4f8f05b21e5d6adf327d817593e9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_3_c1ba4f8f05b21e5d6adf327d817593e9.webp new file mode 100644 index 0000000000..124f61f340 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_3_c1ba4f8f05b21e5d6adf327d817593e9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_4_0db039eed39f20ab325fac0ca5b30a6c.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_4_0db039eed39f20ab325fac0ca5b30a6c.webp new file mode 100644 index 0000000000..aaa6b29d93 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_4_0db039eed39f20ab325fac0ca5b30a6c.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_5_23eaaa42422c8cfce3e46d27a9dddbb2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_5_23eaaa42422c8cfce3e46d27a9dddbb2.webp new file mode 100644 index 0000000000..45ca3ffa4d Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_5_23eaaa42422c8cfce3e46d27a9dddbb2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_6_ad797e8b1ecf0b43d8f8a388ffedcde5.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_6_ad797e8b1ecf0b43d8f8a388ffedcde5.webp new file mode 100644 index 0000000000..5428878f93 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_6_ad797e8b1ecf0b43d8f8a388ffedcde5.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_7_f8c69edce2b216b5a2e1e3238a79c2e9.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_7_f8c69edce2b216b5a2e1e3238a79c2e9.webp new file mode 100644 index 0000000000..a03bc51f02 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_7_f8c69edce2b216b5a2e1e3238a79c2e9.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_8_4af3ffdd4277ec275d61a4aeb4adb125.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_8_4af3ffdd4277ec275d61a4aeb4adb125.webp new file mode 100644 index 0000000000..a8585e3662 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_8_4af3ffdd4277ec275d61a4aeb4adb125.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_9_85037c3c83c955ec3a44d5631189d585.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_9_85037c3c83c955ec3a44d5631189d585.webp new file mode 100644 index 0000000000..73d17f6b3f Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/1306_9_85037c3c83c955ec3a44d5631189d585.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_1_image-20231116160521-2.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_1_image-20231116160521-2.webp new file mode 100644 index 0000000000..184aee5e6c Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_1_image-20231116160521-2.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_2_2_950x130.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_2_2_950x130.webp new file mode 100644 index 0000000000..5c0267e700 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_2_2_950x130.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_3_3_950x296.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_3_3_950x296.webp new file mode 100644 index 0000000000..73e415c4b7 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_3_3_950x296.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_4_image-20231213102010-1.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_4_image-20231213102010-1.webp new file mode 100644 index 0000000000..22047ce1c3 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/927_4_image-20231213102010-1.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/troubleshooting.webp b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/troubleshooting.webp new file mode 100644 index 0000000000..35900abff5 Binary files /dev/null and b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/assets/troubleshooting.webp differ diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/knowledgebase.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/knowledgebase.md new file mode 100644 index 0000000000..07d26c0deb --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/knowledgebase.md @@ -0,0 +1,42 @@ +--- +title: "Knowledge Base" +description: "Knowledge Base" +sidebar_position: 10 +--- + +# Knowledge Base + +See the following Knowledge Base articles for Scripts and Triggers Manager. + +## Troubleshooting + +- [What must I do in Cylance such that it will run Powershell scripts via Endpoint Policy Scripts Manager?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/cylance.md) +- [What is the expected behavior after an Endpoint Policy Manager Script "ON/APPLY" script is modified?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/onapplyscript.md) +- [Where do scripts run? How are they protected from unauthorized access? How can I change the location of where scripts are stored?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/scriptlocation.md) +- [Which VPN Solutions are currently supported for use with Scripts Manager VPN Triggers?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/vpnsolutions.md) +- [How do Endpoint Policy Scripts Manager PowerShell Scripts behave when PowerShell is blocked or disabled using the following methods?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/powershellscripts.md) +- [Why don't Batch and PowerShell scripts get blocked when SYSTEM processes are blocked](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/systemprocesses.md) +- [How do I update Windows 7 machines to TLS 1.2 such that they work with Endpoint Policy Manager Cloud?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/windows7tls.md) +- [Upgrading MS Teams to latest version displays prompts for Admin Approval](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/adminapproval.md) + +## Tip and Tricks + +- [How to import a WLAN / 802.11 / Wireless profile from a Network Share using Endpoint Policy Scripts Manager?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/wlannetwork.md) +- [How to import a WLAN / 802.11 / Wireless profile from Dropbox using Endpoint Policy Scripts Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/wlandropbox.md) +- [How to silently install Firefox ESR, Chrome and WinZip 14.5 using Endpoint Policy Scripts Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/silentbrowserinstall.md) +- [How to create a shortcut under the Public Desktop using Endpoint Policy Scripts Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/shortcutpublicdesktop.md) +- [How to deliver network drive mappings with PowerShell using Scripts Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/powershell.md) +- [How do I use Scripts Manager to update the Registry on end-user workstations](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/updateregistry.md) +- [How to Reset Secure Channel for computers that have fallen out of sync with domain while working remotely by using Scripts Manager in Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/resetsecurechannel.md) +- [How-to change Temperature Unit from Fahrenheit to Celsius in Microsoft Outlook Calendar via Group Policy?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/temperatureunit.md) +- [How do I automate BitLocker deployment for my enterprise with Group Policy and Endpoint Policy Manager?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/bitlockerdeployment.md) +- [What is the expected behavior on Windows 10 when you MODIFY an existing Endpoint Policy Manager Scripts script?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/windows10modifyscript.md) +- [How to run Microsoft Teams minimized to systray using PPScripts and PPAM](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/teamsminimized.md) +- [How does Endpoint Policy Manager Scripts & Triggers know when the VPN connection is made or lost?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/vpnconnection.md) +- [How to use Scripts Manager Event Log Triggers to Map Network Drives when a VPN is Connected](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/eventlogtriggers.md) +- [How to Set the Password for a Local Account using Scripts Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/localaccountpassword.md) +- [How to use Scripts Manager Triggers to Map Network Drives when a VPN is Connected](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/vpn.md) +- [How do I user Endpoint Policy Manager to set the screensaver to a custom slideshow?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/screensavers.md) +- [Can I get more details on how Endpoint Policy Scripts Manager processes run?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/processesdetails.md) +- [How to Run Microsoft Edge Once at a User's 1st Logon using Scripts and Triggers Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/edgefirstlogon.md) +- [How to Create a Local Scheduled Task to Reboot a PC every day at 9 AM](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/tipandtricks/localscheduledtask.md) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/_category_.json new file mode 100644 index 0000000000..0d83337778 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips and Tricks", + "position": 10, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/bitlockerdeployment.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/bitlockerdeployment.md new file mode 100644 index 0000000000..09a49e15cd --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/bitlockerdeployment.md @@ -0,0 +1,122 @@ +--- +title: "How do I automate BitLocker deployment for my enterprise with Group Policy and Endpoint Policy Manager?" +description: "How do I automate BitLocker deployment for my enterprise with Group Policy and Endpoint Policy Manager?" +sidebar_position: 90 +--- + +# How do I automate BitLocker deployment for my enterprise with Group Policy and Endpoint Policy Manager? + +Many organizations want to protect the data on the end-user's computers from prying eyes. Especially +laptops that may be virtually anywhere. BitLocker is an encryption feature built into computers +running Window 10 Professional, Enterprise and Education that creates a secure environment for your +data. + +Deploying BitLocker to an enterprise can be a daunting task. Group Policy in combination with +Netwrix Endpoint Policy Manager (formerly PolicyPak) can automate the entire process with one GPO. + +This document assumes the following + +- Compatible version of Windows 10 +- TPM present and enabled on the computer (TPM uses hardware level encryption to store BitLocker + keys allowing zero-touch deployment and computer start-up) + +## Implement BitLocker + +The instructions below will configure BitLocker to encrypt the used space on the SystemDrive with +256-bit encryption and save the Recovery Password and key to Active Directory. There are many more +options that can be configured either through additional policies or customized script if so +required. + +**Step 1 –** Create a Group Policy on the desired Domain / OU and Edit + +**Step 2 –** Expand Computer Configuration -> Endpoint Policy Manager and click on Administrative +Templates Manager + +**Step 3 –** Add a new collection + +![66_1_image-20200725154035-1](../assets/66_1_image-20200725154035-1.webp) + +**Step 4 –** Give the Collection a descriptive name and, if required, set Item Level Targeting (ILT +can filter the policy based on many different criteria including computer type (e.g. laptops), +Operating System (e.g. Windows 10) or Security Group (e.g. Sales)) + +**Step 5 –** Double-click to open the collection + +**Step 6 –** Add a new Policy + +![66_3_image-20200725154035-2_626x151](../assets/66_3_image-20200725154035-2_626x151.webp) + +**Step 7 –** Browse to Windows Components and click on BitLocker Drive Encryption + +**Step 8 –** Open "Store BitLocker recovery information in Active Directory Domain Services (Windows +Server 2008 and Windows Vista)" and set the following configuration + +1. Select "Enable" +2. Check "Require BitLocker Backup to AD DS" +3. Set Select BitLocker recovery information to store: "Recovery passwords and key packages" +4. Click OK + + ![66_5_image-20200725154035-3_493x143](../assets/66_5_image-20200725154035-3_493x143.webp) + +**Step 9 –** In the same location, open "Choose drive encryption method and cipher strength (Windows +10 [version 1511] and later) and set the following configuration + +1. Select "Enable" +2. Set the encryption method for drive type (CBC-AES is recommended for drives that may connect to + non-Windows 10 computers) +3. Click OK + + ![66_7_image-20200725154035-4](../assets/66_7_image-20200725154035-4.webp) + +**Step 10 –** Click CLOSE + +![66_9_image-20200725154035-5](../assets/66_9_image-20200725154035-5.webp) + +:::note +If deploying different BitLocker configurations for different groups of users or +computers, repeat steps 4 through 10 for each different configuration, setting the ILT on the +collection to target your desired groupings. +::: + + +**Step 11 –** Still under Endpoint Policy Manager, click on Scripts Manager + +**Step 12 –** Add a new policy to start the Scripts Manager wizard + +1. Click NEXT +2. Select "Apply this policy to computer (default) and click NEXT + + ![66_11_image-20200725154035-6_489x65](../assets/66_11_image-20200725154035-6_489x65.webp) + +3. Configure "On apply action" + + 1. On the dropdown that says "(None)", select "Batch Script" and type in the following text + + `Manage-bde -on %systemdrive% -Used` + + ![66_13_image-20200814161653-2](../assets/66_13_image-20200814161653-2.webp) + + 2. Click NEXT + +4. Configure "On revert action" + + 1. On the dropdown that says "(None)", select "Batch Script" and type in the following text + + `Manage-bde -off %systemdrive%` + + ![66_14_image-20200725154035-8](../assets/66_14_image-20200725154035-8.webp) + + 2. Click NEXT + +5. Select either "Once" or "Once or when forced" and click NEXT + + ![66_16_image-20200725154035-9](../assets/66_16_image-20200725154035-9.webp) + +6. Give the policy a descriptive name and set Item Level Targeting if required +7. Click FINISH + +**Step 13 –** Close Group Policy Management Editor + +When the policy has been deployed to the user, they will receive a notification that a reboot will +be required. It is not necessary that it be one immediately. Upon reboot BitLocker will +automatically start to encrypt the drive with no input required from the user. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/edgefirstlogon.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/edgefirstlogon.md new file mode 100644 index 0000000000..0fd51e7e63 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/edgefirstlogon.md @@ -0,0 +1,49 @@ +--- +title: "How to Run Microsoft Edge Once at a User's 1st Logon using Scripts and Triggers Manager" +description: "How to Run Microsoft Edge Once at a User's 1st Logon using Scripts and Triggers Manager" +sidebar_position: 180 +--- + +# How to Run Microsoft Edge Once at a User's 1st Logon using Scripts and Triggers Manager + +**Step 1 –** Create a new Scripts and Triggers Policy on the Computer side that runs in Switched +Mode or on the User side. + +**Step 2 –** Use the script below and be sure to check the option to run the script interactively +and as the user. + +![868_1_image-20220225024809-1_950x457](../assets/868_1_image-20220225024809-1_950x457.webp) + +``` +$path = "$env:LOCALAPPDATA\temp\1stlogon.flg" +$logfile = "$env:LOCALAPPDATA\temp\1stlogon.log" +# TIMESTAMP FUNCTION: Usage: Write-Output "$(Get-TimeStamp) Text goes here" | Out-file C:\log.txt -append +function Get-TimeStamp { +  return "[{0:MM/dd/yyyy} {0:HH:mm:ss}]" -f (Get-Date) +} +if(!(Test-Path -Path $path)) +{ +    New-Item -Path "$env:LOCALAPPDATA\temp\1stlogon.flg" +    Write-Output "$(Get-TimeStamp) Going to run Edge since this is the 1st logon."| Out-file $logfile -append +    start msedge +} +else +{ + Write-Output "$(Get-TimeStamp) Script has been already applied. Skipping." | Out-file $logfile -append +} +``` + +**Step 3 –** At the "Specify process mode" screen select "On trigger" and choose "Logon" from the +drop-down, then click "Next". + +![868_2_image-20220225024809-2](../assets/868_2_image-20220225024809-2.webp) + +**Step 4 –** At the Trigger settings" screen set a delay if desired otherwise click "Next" the skip +this option. + +**Step 5 –** At the "Policy settings" screen give the policy a descriptive name then click "Finish". + +**Step 6 –** Lastly, apply the policy, and test with a new user logon, if all goes well you will see +the screen below after a successful 1st logon. + +![868_3_image-20220225024809-3_900x490](../assets/868_3_image-20220225024809-3_900x490.webp) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/eventlogtriggers.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/eventlogtriggers.md new file mode 100644 index 0000000000..571399ad75 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/eventlogtriggers.md @@ -0,0 +1,128 @@ +--- +title: "How to use Scripts Manager Event Log Triggers to Map Network Drives when a VPN is Connected" +description: "How to use Scripts Manager Event Log Triggers to Map Network Drives when a VPN is Connected" +sidebar_position: 150 +--- + +# How to use Scripts Manager Event Log Triggers to Map Network Drives when a VPN is Connected + +:::info +Netwrix Endpoint Policy Manager (formerly PolicyPak) version 2791 or higher must +be used. +::: + + +**Step 1 –** Create a new Scripts & Triggers policy on the computer side, choose switched mode like +in the screenshot below. + +![848_1_image-20210801230156-1](../assets/mappeddrives/848_1_image-20210801230156-1.webp) + +**Step 2 –** At the "On apply action" screen select "PowerShell script" from the dropdown, then in +the main text window, paste in the script below, check the option "Run script as user, then click +"Next". + +``` +# Set Launch Folder Windows in a Separate Process to Enabled +if((Test-Path -LiteralPath "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced") -ne $true) { +    New-Item "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -force -ea SilentlyContinue +}; +New-ItemProperty -LiteralPath 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name 'SeparateProcess' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue; +``` + +![848_2_image-20210801230156-2](../assets/mappeddrives/639_2_image-20210424015614-2.webp) + +**Step 3 –** Then click "Next" at the "On revert action" screen to skip that screen, then at the +"Specify process mode" screen choose the "Once" option. + +![848_3_image-20210801230156-3](../assets/mappeddrives/639_3_image-20210424015614-3.webp) + +**Step 4 –** At the "Policy settings" screen give the policy a descriptive name then click "Finish". + +![848_4_image-20210801230156-4](../assets/mappeddrives/639_4_image-20210424015614-4.webp) + +**Step 5 –** Now create another policy (Map drives when VPN Connect Event ID is Detected) using +Scripts & Triggers on the computer side, choose switched-mode like in the screenshot below. + +![848_5_image-20210801230156-5](../assets/mappeddrives/848_1_image-20210801230156-1.webp) + +**Step 6 –** At the "On apply action" screen select "PowerShell script" from the dropdown, then in +the main text window, paste in the script below then change the drive mappings to match the settings +needed for your environment, check the option "Run script as user, then click "Next". + +``` +# Wait for DNS to settle after VPN connects +Start-Sleep -s 10 +# Map G Drive +if (-not(get-psdrive -name "G" -ErrorAction SilentlyContinue)) { +    New-PSDrive -name "G" -PSProvider FileSystem -Root \\Server\share1 -Persist +} +# Map H Drive +if (-not(get-psdrive -name "H" -ErrorAction SilentlyContinue)) { +    New-PSDrive -name "H" -PSProvider FileSystem -Root \\Server\Share2 -Persist +} +``` + +![848_6_image-20210801230156-6](../assets/mappeddrives/639_6_image-20210424015614-6.webp) + +**Step 7 –** Click "Next" at the "On revert action" screen to skip that screen, then at the "Specify +process mode" screen choose the "On trigger" option, then choose "Event log" from the drop down +before clicking "Next" to continue. + +![848_7_image-20210801230156-7](../assets/mappeddrives/848_7_image-20210801230156-7.webp) + +**Step 8 –** Before continuing Connect to the VPN then open the Windows application log and locate +the successful VPN Connection event, take note of the Level, the source, and the Event ID number for +that event as you will need them in the next step. + +For this example I used an Azure Point-to-Site VPN connection, and the successful connection Event +ID number is 20225 + +![848_8_image-20210801230156-8](../assets/mappeddrives/848_8_image-20210801230156-8.webp) + +**Step 9 –** Now continue onward from Step 7 above using the information you gathered in Step 8, +ensure your Trigger settings look similar to mine below, before clicking "Next". + +![848_9_image-20210801230156-9](../assets/mappeddrives/848_9_image-20210801230156-9.webp) + +**Step 10 –** At the next Trigger settings screen click "Next" without editing the query. + +![848_10_image-20210801230156-10](../assets/mappeddrives/848_10_image-20210801230156-10.webp) + +**Step 11 –** At the Policy Settings screen provide a descriptive name for the policy and then click +"Finish". + +![848_11_image-20210801230156-11](../assets/mappeddrives/848_11_image-20210801230156-11.webp) + +:::note +You should have two policies now: +::: + + +![848_12_image-20210801230156-12](../assets/mappeddrives/848_12_image-20210801230156-12.webp) + +**Step 12 –** Lastly, test the policy by logging into a computer, (or run gpupdate if already logged +in) and then connect to a VPN as a user who should receive the policy. If everything works you +should see the network drives show up in File Explorer + +![848_13_image-20210801230156-13](../assets/mappeddrives/639_11_image-20210424015614-11.webp) + +**Step 13 –** Optionally, create a new Scripts and Triggers policy that disconnects the drives when +the VPN disconnects by using the script below and also changing the trigger to "Event log", and +configuring the correct settings for the successful VPN disconnect event. Please see below for a VPN +disconnect example using Azure Point-to-Site VPN. + +![848_14_image-20210801230156-14](../assets/mappeddrives/639_12_image-20210424015614-12.webp) + +![848_15_image-20210801230156-15](../assets/mappeddrives/848_7_image-20210801230156-7.webp) + +VPN disconnect example using Azure Point-to-Site VPN + +![848_16_image-20210801230156-16](../assets/mappeddrives/848_16_image-20210801230156-16.webp) + +![848_17_image-20210801230156-17](../assets/mappeddrives/848_17_image-20210801230156-17.webp) + +:::note +"On trigger" does not work with Revert action script which is why you need to create a new +policy to disconnect the drives. + +::: diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/localaccountpassword.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/localaccountpassword.md new file mode 100644 index 0000000000..33f40876db --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/localaccountpassword.md @@ -0,0 +1,88 @@ +--- +title: "How to Set the Password for a Local Account using Scripts Manager" +description: "How to Set the Password for a Local Account using Scripts Manager" +sidebar_position: 140 +--- + +# How to Set the Password for a Local Account using Scripts Manager + +As of +[https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30](https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30) +Microsoft has blocked the ability to configure local passwords using Group Policy Preferences.  +However, you can still workaround this by using a PowerShell script within Netwrix Endpoint Policy +Manager (formerly PolicyPak) Scripts and Triggers Manager (PPScripts). + +How this works is that you first define your own Security Key to use for encrypting the clear text +password, (see $key below for example). + +Create the password file: + +``` +$key = (1,2,3,4,5,1,2,3,4,5,11,12,13,14,15,20,30,40,50,5,4,3,2,1) +read-host -assecurestring | convertfrom-securestring -key $key | out-file \\server\share\file.txt +``` + +:::note +The PowerShell Script above was borrowed from: +[https://community.spiceworks.com/topic/584947-local-users-and-groups-group-policy-update](https://community.spiceworks.com/topic/584947-local-users-and-groups-group-policy-update)) +::: + + +:::warning +The targeted endpoint must have rights to read the share and file used above (i.e., +`\\server\share\file.txt` ). +::: + + +Then use that Security Key to encrypt the clear text password that you enter on the screen, i.e., +"Password!" + +If using PowerShell ISE: + +Enter the password in the window that appears when the script above is run. + +![923_1_image-20221221103111-1](../assets/923_1_image-20221221103111-1.webp) + +If running PowerShell from CMD: + +![923_2_image-20221221103111-2](../assets/923_2_image-20221221103111-2.webp) + +The resulting encrypted password is then stored at a secure location that is accessible from the +endpoints (in this case a file on a secure network share `(\\server\share\file.txt)`. + +![923_3_image-20221221103111-3](../assets/923_3_image-20221221103111-3.webp) + +The next step is to create a computer side PowerShell policy in Endpoint Policy Manager Scripts & +Triggers. + +![923_4_image-20221221103111-4](../assets/923_4_image-20221221103111-4.webp) + +Then at the "On Apply action" screen choose PowerShell script for the type of script from the +dropdown, and then paste in the script below after editing it to reflect your Security Key, and the +corresponding local username on the endpoints in your environment that you wish to update. + +``` +$key = (1,2,3,4,5,1,2,3,4,5,11,12,13,14,15,20,30,40,50,5,4,3,2,1) +$pwd = get-content \\server\share\file.txt | convertto-securestring -key $key +$user = "EastSalesUser1" +$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pwd +$pw = $cred.GetNetworkCredential().Password +$cmd = "net user $user $pw" +Invoke-Expression $cmd +``` + +This script will read the` file.txt` from the secure network share and then use that information to +update any local user account you have defined in your script. + +In the example below we are setting the password for a local user called "EastSalesUser1", see $user +below). + +![923_5_image-20221221103111-5](../assets/923_5_image-20221221103111-5.webp) + +:::warning +The targeted endpoint must have rights to read the share and file used above (i.e., +`\\server\share\file.txt`). +::: + + +Lastly, apply the policy to any endpoints as needed and you are good to go. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/localscheduledtask.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/localscheduledtask.md new file mode 100644 index 0000000000..5095284068 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/localscheduledtask.md @@ -0,0 +1,59 @@ +--- +title: "How to Create a Local Scheduled Task to Reboot a PC every day at 9 AM" +description: "How to Create a Local Scheduled Task to Reboot a PC every day at 9 AM" +sidebar_position: 190 +--- + +# How to Create a Local Scheduled Task to Reboot a PC every day at 9 AM + +**Step 1 –** Create a Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts policy on the +computer side. + +![879_1_image-20220916231626-1](../assets/879_1_image-20220916231626-1.webp) + +**Step 2 –** When creating the Policy choose the option to Apply this policy to computer (default). + +![879_2_image-20220916231626-2](../assets/879_2_image-20220916231626-2.webp) + +**Step 3 –** Choose PowerShell from the dropdown. + +![879_3_image-20220916231626-3](../assets/879_3_image-20220916231626-3.webp) + +**Step 4 –** Then paste in the following script to the text field. + +``` +# Create task action +$taskAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument 'Restart-Computer -Force' +# Create a trigger (Daily at 9 AM) +$taskTrigger = New-ScheduledTaskTrigger -Daily -At 9am +# The user to run the task +$taskUser = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest +$settings = New-ScheduledTaskSettingsSet -MultipleInstances Parallel +# The name of the scheduled task. +$taskName = "Daily 9AM Reboot" +# Describe the scheduled task. +$description = "Forcibly reboot the computer at 9 AM Daily" +# Register the scheduled task +Register-ScheduledTask -TaskName $taskName -Action $taskAction -Trigger $taskTrigger -Settings $settings -Principal $taskUser -Description $description +``` + +Your policy should look similar to the one below: + +![879_4_image-20220916231626-4_950x517](../assets/879_4_image-20220916231626-4_950x517.webp) + +**Step 5 –** Skip the on revert action screen by clicking next. + +![879_5_image-20220916231626-5](../assets/879_5_image-20220916231626-5.webp) + +**Step 6 –** At the Specify process mode screen choose "Once or when forced" and then click next to +continue. + +![879_6_image-20220916231626-6](../assets/879_6_image-20220916231626-6.webp) + +**Step 7 –** You're done, lastly, test your policy to ensure it runs as expected. + +:::note +This policy will create a local scheduled task that will reboot the PC daily at 9 AM even +if no one is logged into the PC. + +::: diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/powershell.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/powershell.md new file mode 100644 index 0000000000..35b91ce66a --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/powershell.md @@ -0,0 +1,101 @@ +--- +title: "PowerShell Script Examples" +description: "PowerShell script examples for Scripts and Triggers Manager" +sidebar_position: 10 +--- + +# PowerShell Script Examples + +This guide provides practical PowerShell script examples for use with Scripts and Triggers Manager. + +## Mapped Drive Configuration + +This PowerShell script demonstrates how to configure mapped network drives through Scripts and Triggers Manager: + +```powershell +# Map network drives with error handling +try { + # Remove existing drive mapping if present + if (Test-Path "Z:") { + Remove-PSDrive -Name "Z" -Force -ErrorAction SilentlyContinue + } + + # Create new drive mapping + New-PSDrive -Name "Z" -PSProvider FileSystem -Root "\\server\share" -Persist + + # Verify mapping was successful + if (Test-Path "Z:") { + Write-Output "Drive Z: successfully mapped to \\server\share" + } else { + Write-Error "Failed to map drive Z:" + } +} +catch { + Write-Error "Error mapping drive: $($_.Exception.Message)" +} +``` + +## User Profile Management + +Script for managing user profile settings: + +```powershell +# Configure user environment variables +[Environment]::SetEnvironmentVariable("CUSTOM_APP_PATH", "C:\Program Files\CustomApp", "User") + +# Create user directory structure +$userDirs = @( + "$env:USERPROFILE\Documents\Projects", + "$env:USERPROFILE\Documents\Templates" +) + +foreach ($dir in $userDirs) { + if (-not (Test-Path $dir)) { + New-Item -Path $dir -ItemType Directory -Force + Write-Output "Created directory: $dir" + } +} +``` + +## Registry Configuration + +PowerShell script for registry modifications: + +```powershell +# Configure registry settings with error handling +$regPath = "HKCU:\Software\Company\Application" + +try { + # Create registry key if it doesn't exist + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + } + + # Set registry values + Set-ItemProperty -Path $regPath -Name "EnableFeature" -Value 1 + Set-ItemProperty -Path $regPath -Name "ConfigPath" -Value "C:\Config" + + Write-Output "Registry configuration completed successfully" +} +catch { + Write-Error "Registry configuration failed: $($_.Exception.Message)" +} +``` + +## Best Practices + +1. **Error Handling**: Always include proper error handling in PowerShell scripts +2. **Logging**: Use Write-Output and Write-Error for proper logging +3. **Path Testing**: Test paths before operations to avoid errors +4. **Force Parameters**: Use -Force carefully to avoid unintended overwrites +5. **Execution Policy**: Ensure proper execution policy is set for script deployment + +## Troubleshooting + +Common PowerShell script issues and solutions: + +- **Execution Policy Errors**: Verify PowerShell execution policy allows script execution +- **Permission Issues**: Ensure scripts run with appropriate privileges +- **Path Not Found**: Use Test-Path to verify paths before operations +- **Network Connectivity**: Test network connectivity before mapping drives +- **Registry Access**: Verify user has appropriate registry access rights \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/processesdetails.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/processesdetails.md new file mode 100644 index 0000000000..937371d5e8 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/processesdetails.md @@ -0,0 +1,50 @@ +--- +title: "Can I get more details on how Endpoint Policy Scripts Manager processes run?" +description: "Can I get more details on how Endpoint Policy Scripts Manager processes run?" +sidebar_position: 170 +--- + +# Can I get more details on how Endpoint Policy Scripts Manager processes run? + +Q: Is there a way of knowing on the local machine if a script policy returns an error during the +script execution and will tell me why the CSE didn't complete the execution properly? + +A: The short answer is yes - on the local machine you can review the logs to get detailed +information about script executions? The logs are in the following locations: + +User side logs: +`%userprofile%\AppData\Local\PolicyPak\PolicyPak Scripts Manager\ppUser_operational.log` + +Computer side logs: `%programdata%\PolicyPak\PolicyPak Scripts Manager\ppComputer_operational.log` + +Q: What happens if a PowerShell script takes longer to execute then the run interval (let's say we +push an infinite loop), will the CSE terminate the process after a while? Is there a timeout? + +A: If the script execution takes longer than 2mins, the CSE reports in the operational log: "Script +timed out. Command line: ..." and the script process will continue running until it finishes. It +will not time out. Logging of that script will stop after the 2 minutes and the next script will +start up. We will not stop a running script. + +Q: Does the CSE spawn a new process at each refresh interval, or does it wait until the previous +process closes? Let's say the refresh interval is 5min and a script takes 10 min to execute, will it +spawn a new process at the refresh interval or wait for the old one to finish? + +A: The CSE will span a new process for each script. It will not wait for the previous one to +complete. + +Q: Does the CSE process script policies like a stack (First In - First Out) or does it execute all +policies in parallel? + +A: There are two types of policies with Scripts Manager: + +1. Standard/Legacy Policies: Non-trigger based policies that are executed at each refresh interval. + The next script in order will wait until the previous script completes or two minutes has passed + – whichever is less. +2. Trigger-Based Policies: The script will execute asynchronously by the corresponding trigger. + +Q: There are occasionally some Chinese characters that appear in the logs. Is this expected +behavior? Can this cause the CSE to malfunction? + +A: This is because the output from the script engine is in ANSI code but our logs are in Unicode. It +does not cause any issues with the CSE or the ability to execute the script. This is strictly in the +logging. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/resetsecurechannel.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/resetsecurechannel.md new file mode 100644 index 0000000000..4655af16fe --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/resetsecurechannel.md @@ -0,0 +1,102 @@ +--- +title: "Reset Secure Channel" +description: "How to reset secure channel using Scripts and Triggers Manager" +sidebar_position: 20 +--- + +# Reset Secure Channel + +This guide demonstrates how to use Scripts and Triggers Manager to reset the secure channel between a domain-joined computer and the domain controller. + +## Overview + +The secure channel is a communication pathway between a domain member computer and the domain controller. Occasionally, this channel may become corrupted or out of sync, causing authentication issues. + +## PowerShell Script for Secure Channel Reset + +Use the following PowerShell script to reset the secure channel: + +```powershell +# Reset computer secure channel +try { + Write-Output "Attempting to reset secure channel..." + + # Test current secure channel status + $testResult = Test-ComputerSecureChannel -Verbose + + if ($testResult) { + Write-Output "Secure channel is currently functional" + } else { + Write-Output "Secure channel appears to be broken - proceeding with reset" + + # Reset the secure channel + $resetResult = Reset-ComputerMachinePassword -Credential (Get-Credential) -Verbose + + if ($resetResult) { + Write-Output "Secure channel reset completed successfully" + + # Test again to verify + $verifyResult = Test-ComputerSecureChannel -Verbose + + if ($verifyResult) { + Write-Output "Verification successful - secure channel is now functional" + } else { + Write-Warning "Verification failed - manual intervention may be required" + } + } + } +} +catch { + Write-Error "Error during secure channel reset: $($_.Exception.Message)" +} +``` + +## Alternative Method Using NLTEST + +For environments where PowerShell cmdlets are not available, use NLTEST: + +```batch +@echo off +echo Testing secure channel status... +nltest /sc_query:%COMPUTERNAME% + +echo Resetting secure channel... +nltest /sc_reset:%USERDOMAIN%\%COMPUTERNAME% + +echo Verifying reset... +nltest /sc_query:%COMPUTERNAME% + +echo Secure channel reset process completed +``` + +## Deployment Considerations + +### Prerequisites +- Administrative privileges required +- Network connectivity to domain controller +- Proper credentials for domain operations + +### Best Practices +1. **Test First**: Always test the current secure channel status before resetting +2. **Logging**: Implement comprehensive logging for troubleshooting +3. **Error Handling**: Include proper error handling for network issues +4. **Verification**: Always verify the reset was successful +5. **Scheduling**: Consider running during maintenance windows + +### Common Issues +- **Network connectivity problems**: Ensure domain controller is reachable +- **Credential issues**: Verify account has necessary privileges +- **Time synchronization**: Check that system time is synchronized with domain +- **DNS resolution**: Ensure proper DNS configuration for domain services + +## Troubleshooting + +If the secure channel reset fails: + +1. Verify network connectivity to domain controller +2. Check system time synchronization +3. Ensure DNS resolution is working properly +4. Verify account privileges +5. Consider manual domain rejoin if automated reset fails + +This script can be deployed through Scripts and Triggers Manager to automate secure channel maintenance across your environment. \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/screensavers.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/screensavers.md new file mode 100644 index 0000000000..75f444ca4b --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/screensavers.md @@ -0,0 +1,211 @@ +--- +title: "How do I user Endpoint Policy Manager to set the screensaver to a custom slideshow?" +description: "How do I user Endpoint Policy Manager to set the screensaver to a custom slideshow?" +sidebar_position: 160 +--- + +# How do I user Endpoint Policy Manager to set the screensaver to a custom slideshow? + +Group policy can be used to assign screensaver configurations where desired. However, if you want to +implement a custom slideshow, i.e. dictate the images to be used for the screensaver, a bit of extra +work and a reference computer is needed to accomplish the task. + +The tasks involved are: + +**Step 1 –** Implement a script to download the images to each user's computer + +**Step 2 –** Use a reference computer to configure and save image storage location + +**Step 3 –** Configure Group Policy Screensaver options + +## Prerequisites + +The following is assumed: + +- The images are located on a share accessible to necessary users +- A workstation is available to use to extract encrypted registry information + +## Create script to copy images + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Script Manager can be used to copy the images +from a network share to the user's computer. Although they can be accessed by the screen saver on a +network share, thereby eliminating the need for this script, they would not be accessible if the +computer were away from the network. + +In this example the source directory is `\\dccore\share\SSImages\*` and the destination is +`%userprofile%\Pictures\SSImages\.` + +**Step 1 –** Create new Group Policy Object were required + +**Step 2 –** Expand Computer Configuration -> Endpoint Policy Manager and click on Scripts Manager + +**Step 3 –** Add a new Collection, giving it a descriptive name (e.g. Screensaver scripts or Houston +Screensaver…) and click OK + +![207_1_image-20200819181623-1](../assets/207_1_image-20200819181623-1.webp) + +![207_3_image-20200819181623-2](../assets/207_3_image-20200819181623-2.webp) + +:::note +If rolling out different images for different sets of users, ILT may be set on collection +to specified different groups of users or computers. +::: + + +**Step 4 –** Double-click to enter Collection + +**Step 5 –** Click on "Add New Policy" and NEXT on first page + +![207_5_image-20200819181623-3](../assets/207_5_image-20200819181623-3.webp) + +**Step 6 –** On the "On apply action" screen, either click File -> Open and browse for a +preconfigured script or click down-arrow by "(None)", select the appropriate type of script and +either paste or type in the script to copy the image files. + +![207_7_image-20200819181623-4](../assets/207_7_image-20200819181623-4.webp)  +OR +![207_9_image-20200819181623-5](../assets/207_9_image-20200819181623-5.webp) + +Sample script using powershell that will 1; check for the existence of the destination, 2; Create +the destination if it does not exist and 3; copy the files over. + +![207_11_image-20200819181623-6](../assets/207_11_image-20200819181623-6.webp) + +``` +if (!(Test-Path -Path $env:userprofile\pictures\SSImages\))    {    New-item -path $env:userprofile\pictures\ -Name SSImages -Itemtype directory    }     +Copy-Item \\dccore\share\SSImages\* -Destination $env:userprofile\pictures\SSImages +``` + +**Step 7 –** On "On revert action" screen, leave as-is and click NEXT + +**Step 8 –** Ensure "Always" is selected and click NEXT + +![207_13_image-20200819181623-7](../assets/207_13_image-20200819181623-7.webp) + +**Step 9 –** Give a descriptive name to the policy, set item-level targeting if required and click +FINISH + +## Get Custom Location Information + +The path to the image location is saved in the Registry as an encrypted value. Use the steps below +to create the path, export the value, and make it usable. + +**Step 1 –** On your reference computer, set the screensaver to use "Photos", click on Settings and +Browse to the location of the Screensaver images + +![207_15_image-20200819181623-8](../assets/207_15_image-20200819181623-8.webp) + +**Step 2 –** Click SAVE to close the Photo Screen Saver settings window and then OK to finish + +**Step 3 –** Open Regedit and search HKCU Values for "EncryptedPIDL" + +**Step 4 –** Export "Screensaver" registry key + +**Step 5 –** Open the `.REG` file in text editor (I recommend something like Notepad++ that has a +larger maximum line size) and edit the following: + +- Delete lines for "Speed" and "Shuffle" configuration +- Remove all line-breaks for `"EncryptedPIDL"` – data must be on one line + + ![207_17_image-20200819181623-9](../assets/207_17_image-20200819181623-9.webp) + +It will end up looking something like this… + +![207_19_image-20200819181623-10](../assets/207_19_image-20200819181623-10.webp) + +## Create Group Policy Object + +Once the prep-work is completed, we can create the Group Policy Object to 1; Import the .REG +settings and 2; set the Screensaver configuration options as per your requirements. + +### Enable and configure The Screen Saver + +Here we are configuring the Screensaver options to your requirements. + +**Step 1 –** Open your existing Group Policy Object + +**Step 2 –** Expand Computer Configuration -> Endpoint Policy Manager and click on Administrative +Templates Manager + +![207_21_image-20200819181623-11](../assets/207_21_image-20200819181623-11.webp) + +**Step 3 –** Add a new Collection, giving it a descriptive name (e.g. Screensaver scripts or Houston +Screensaver…) and click OK + +![207_23_image-20200819181623-12](../assets/207_23_image-20200819181623-12.webp) + +:::note +If rolling out different images for different sets of users, ILT may be set on collection +to specified different groups of users or computers. +::: + + +**Step 4 –** Double-click to enter the Collection + +**Step 5 –** Add new policy + +![207_25_image-20200819181623-13](../assets/207_25_image-20200819181623-13.webp) + +**Step 6 –** Set the Scope Filter to "User Policy" or "All Policy" + +![207_27_image-20200819181623-14](../assets/207_27_image-20200819181623-14.webp) + +**Step 7 –** Create required policies – Screensaver Policies are kept under Users -> Admin Templates +-> Control Panel -> Personalization. + +Setting Policies in Endpoint Policy Manager land is the same as Group Policy + +- Double-click open the setting +- Enable, set any configuration Options +- OK to close + +![207_29_image-20200819181623-15](../assets/207_29_image-20200819181623-15.webp) + +The following are the minimum policies required + +- Enable Screen Saver - Enable +- Force Specific screen saver – Enable and set executable name to + `"%systemroot%\system32\PhotoScreensaver.scr"` +- Password protect the screen saver – Enabled +- Screen Saver timeout – Enabled, set timeout value to desired length in Seconds (default is 900 + (15min), 300 is 5 min) + +**Step 8 –** Once all policies have been enabled and configured, click CLOSE in the bottom-right +corner + +### Configure the Custom Path + +**Step 1 –** Expand Computer`Configuration -> Policypak-> Scripts Manager`and click on the +collection created earlier + +**Step 2 –** Add a new policy and NEXT on first window + +**Step 3 –** Select "Apply this policy to all users who log on to the computer (switched Mode)" and +click NEXT + +![207_31_image-20200819181623-16](../assets/207_31_image-20200819181623-16.webp) + +**Step 4 –** Select "Batch script" from the drop-down menu and either type in or copy the script +below to import the .REG file, replacing the /D value (LongEncryptedText…) with the very long +encrypted path value from the exported .REG key. + +Command to import the registry data using` REG.EXE`: + +``` +reg add HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver /v EncryptedPIDL /t REG_SZ /D LongEncryptedText… +``` + +**Step 5 –** Select "Run Script as user" and "With elevated rights" and click NEXT + +![207_33_image-20200819181623-17](../assets/207_33_image-20200819181623-17.webp) + +**Step 6 –** NEXT again + +**Step 7 –** Select "Once" and click NEXT + +![207_35_image-20200819181623-18](../assets/207_35_image-20200819181623-18.webp) + +**Step 8 –** Give it a descriptive name (e.g. "Screensaver Path"), ensure it is enabled and click +FINISH + +![207_37_image-20200819181623-19](../assets/207_37_image-20200819181623-19.webp) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/shortcutpublicdesktop.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/shortcutpublicdesktop.md new file mode 100644 index 0000000000..7f999f1d41 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/shortcutpublicdesktop.md @@ -0,0 +1,64 @@ +--- +title: "How to create a shortcut under the Public Desktop using Endpoint Policy Scripts Manager" +description: "How to create a shortcut under the Public Desktop using Endpoint Policy Scripts Manager" +sidebar_position: 40 +--- + +# How to create a shortcut under the Public Desktop using Endpoint Policy Scripts Manager + +The steps below are performed using WinZip as an example. + +**Step 1 –** Create a new GPO and link it to the OU where the computers live that will need to have +the shortcut added. + +**Step 2 –** Edit the GPO. + +**Step 3 –**  Select "Computer Configuration > Netwrix Endpoint Policy Manager (formerly +PolicyPak) > Scripts Manager". + +**Step 4 –** Click the "ADD NEW POLICY" button, then click "Next". + +**Step 5 –** At the "Specify policy target" screen be sure to select the 2nd radio button that +states "Apply this policy to all users who log on to the computer (switched mode) then click "Next". + +![579_1_image-20190918135807-1](../assets/579_1_image-20190918135807-1.webp) + +**Step 6 –** At the "On apply action" screen select "PowerShell script" from the dropdown. + +**Step 7 –** In the main text window, paste in the script below and then click "Next". + +``` +#Script starts here +#create WinZip shortcut on Public Desktop +$TargetFile="C:\Program Files (x86)\WinZip\WINZIP32.EXE" +$ShortcutFile="$env:Public\Desktop\WinZip.lnk" +$WScriptShell=New-Object-ComObjectWScript.Shell +$Shortcut=$WScriptShell.CreateShortcut($ShortcutFile) +$Shortcut.TargetPath =$TargetFile +$Shortcut.Save() + #Script ends here +``` + +**Step 8 –** Before clicking "Next" make sure that the "Run script as user" option is unchecked. + +![579_2_image-20190918135807-2](../assets/579_2_image-20190918135807-2.webp) + +**Step 9 –** Then click "Next" again on the "On revert action" screen. + +**Step 10 –** Select the "Once or when forced" option at the "Specify process mode" screen, then +click "Next" again. + +**Step 11 –** Give the policy a descriptive name (i.e. Create WinZip Shortcut on Public Desktop), +then click "Finish. + +Lastly, log into a computer that lives in the OU where this GPO is applied and within seconds of +logging in you should see the WinZip shortcut get created on the desktop. If needed you can run +`GPUPDATE /FORCE` from a CMD prompt to speed up the process, or for testing. + +:::note +When installing WinZip from MSI, WinZip will remove any desktop icons by default, for this +shortcut policy to work properly you should have it apply after WinZip is already installed, or +upgraded. Alternatively, you can change the "Policy process mode configuration" to run "Always" +instead of "Once or when forced" to always create the shortcut at login or when `GPUPDATE` runs. + +::: diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/silentbrowserinstall.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/silentbrowserinstall.md new file mode 100644 index 0000000000..a1ecdd54ac --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/silentbrowserinstall.md @@ -0,0 +1,167 @@ +--- +title: "How to silently install Firefox ESR, Chrome and WinZip 14.5 using Endpoint Policy Scripts Manager" +description: "How to silently install Firefox ESR, Chrome and WinZip 14.5 using Endpoint Policy Scripts Manager" +sidebar_position: 30 +--- + +# How to silently install Firefox ESR, Chrome and WinZip 14.5 using Endpoint Policy Scripts Manager + +Below are examples on how to use PP Scripts Manager to silently install some commonly used +applications.  Please feel free to use and tweak the examples given below to suit your needs. + +## Section 1: Silently installing latest 64bit version of Firefox Extended Support Release + +**Step 1 –** Create a new GPO and link it to the OU where the computers live that will need to have +Firefox ESR installed. + +**Step 2 –** Edit the GPO. + +**Step 3 –** Select "Computer Configuration > Netwrix Endpoint Policy Manager (formerly PolicyPak) > +Scripts Manager". + +**Step 4 –** Click the "ADD NEW COLLECTION" button. + +**Step 5 –** Give the collection a descriptive name, (i.e. Install some commonly used applications +using PPScripts), then click "OK". + +**Step 6 –** Next, double-click on the collection to open it. + +**Step 7 –** Click the "ADD NEW POLICY" button, then click "Next", then "Next" again keeping the +default option. + +**Step 8 –** At the "On apply action" screen select "PowerShell script" from the dropdown. + +**Step 9 –** In the main text window, paste in the script below and then click "Next". + +``` +#Script starts here +Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force +# Set Download variables +$DownloadFolder = "c:\temp\apps" +$DownloadURL = "https://download.mozilla.org/?product=firefox-esr-latest&os=win64&lang=en-US" +$LocalDownloadFile = "c:\temp\apps\FFESR.EXE" +#Create temp folder if not present +$tempfolder = "C:\temp" +if (-not (Test-Path $tempfolder -PathType Container)) +{ +New-Item -ItemType directory U $tempfolder +} +# Create apps folder and turn on logging +New-Item -ItemType directory -Path $DownloadFolder +start-transcript -path "c:\temp\apps\Firefox_install.log" -append +# Download and install application +If ((Test-Path $LocalDownloadFile -PathType Leaf) -eq $False) +{ +Invoke-WebRequest -Uri $DownloadURL -OutFile $LocalDownloadFile +} +c:\temp\apps\FFESR.EXE /SILENT MaintenanceService=false +#Script ends here +``` + +**Step 10 –** Then click "Next" again on the "On revert action" screen. + +**Step 11 –** Select the "Once or when forced" option at the "Specify process mode" screen, then +click "Next" again. + +**Step 12 –** Give the policy a descriptive name (i.e. Install latest 64bit version of Firefox ESR), +then click "Finish. + +## Section 2: Silently installing the latest 64bit version of Chrome + +**Step 1 –** Use the same GPO and PPScripts collection from Section 1 above or create a new GPO if +so desired by following steps 1-6 in Section one above, then continue with steps below. + +**Step 2 –** Click the "ADD NEW POLICY" button, then click "Next", then "Next" again keeping the +default option. + +**Step 3 –** At the "On apply action" screen select "PowerShell script" from the dropdown. + +**Step 4 –** In the main text window, paste in the script below and then click "Next". + +``` +#Script starts hereSet-ExecutionPolicy-ScopeProcess-ExecutionPolicyBypass-Force +# Set Download variables +$DownloadFolder="c:\temp\apps" +$DownloadURL="https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BD32DD7BD-A4C7-9AF4-614A-F3E4D22C99F9%7D%26lang%3Den%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1%26installdataindex%3Dempty/chrome/install/ChromeStandaloneSetup64.exe" +$LocalDownloadFile="c:\temp\apps\ChromeStandaloneSetup64.exe" +#Create temp folder if not present +$tempfolder="C:\temp" +if (-not (Test-Path$tempfolder-PathTypeContainer) ) +{ +New-Item-ItemTypedirectory-Path$tempfolder +} +# Create apps folder and turn on logging +New-Item-ItemTypedirectory-Path$DownloadFolder +start-transcript-path"c:\temp\apps\Chrome64_install.log"-append +# Download and install application +If ((Test-Path$LocalDownloadFile-PathTypeLeaf) -eq$False) +{ +(New-Object  Net.WebClient).DownloadFile($DownloadURL, "$LocalDownloadFile") +} +c:\temp\apps\ChromeStandaloneSetup64.exe /SILENT /INSTALL +#Script ends here  + +``` + +**Step 5 –** Then click "Next" again on the "On revert action" screen. + +**Step 6 –** Select the "Once or when forced" option at the "Specify process mode" screen, then +click "Next" again. + +**Step 7 –** Give the policy a descriptive name (i.e. Install latest 64bit version of Chrome +Enterprise), then click "Finish. + +## Section 3: Silently installing WinZip 14.5 from MSI package + +**Step 1 –** Use the same GPO and PPScripts collection from Section 1 above or create a new GPO if +so desired by following steps 1-6 in Section one above, then continue with steps below. + +**Step 2 –** Click the "ADD NEW POLICY" button, then click "Next", then "Next" again keeping the +default option. + +**Step 3 –** At the "On apply action" screen select "PowerShell script" from the dropdown. + +**Step 4 –** In the main text window, paste in the script below and then click "Next". + +``` +#WinZip 14.5 will be coming from = http://download.winzip.com/winzip145.msi  +#Script starts here +Set-ExecutionPolicy-ScopeProcess-ExecutionPolicyBypass-Force  +# Set Download variables +$DownloadFolder="c:\temp\apps" +$DownloadURL="http://download.winzip.com/winzip145.msi" +$LocalDownloadFile="c:\temp\apps\winzip145.msi" +#Create temp folder if not present +$tempfolder="C:\temp" +if (-not (Test-Path$tempfolder-PathTypeContainer)) +{ +New-Item-ItemTypedirectory-Path$tempfolder +}  +# Create apps folder and enable logging +New-Item-ItemTypedirectory-Path$DownloadFolder +start-transcript-path"c:\temp\apps\Winzip_PS.log"-append  +# Download and install WinZip +If ((Test-Path$LocalDownloadFile-PathTypeLeaf) -eq$False) +{ +Invoke-WebRequest-Uri$DownloadURL-OutFile$LocalDownloadFile +#install WinZip silently and enable verbose logging +MSIEXEC/ic:\temp\apps\winzip145.msi/qn/L*VC:\temp\apps\winzip_install.log +}  +#Script ends here +``` + +**Step 5 –** Then click "Next" again on the "On revert action" screen. + +**Step 6 –** Select the "Once or when forced" option at the "Specify process mode" screen, then +click "Next" again. + +**Step 7 –** Give the policy a descriptive name (i.e. Install WinZip 14.5), then click "Finish. + +Lastly, log into a computer that lives in the OU where this GPO is applied and within a couple +minutes you should have ALL THREE APPLICATIONS installed. To watch the process as it is happening, +and for troubleshooting logs see the `"C:\Temp\Apps"` folder on any computer that receives this GPO +after `GPUPDATE `has run. If there is no Apps folder present as yet you can run `GPUPDATE /FORCE` +from a CMD prompt to speed up the process. Chrome and Firefox will create a shortcut on the desktop +by default but the WinZip 14.5 MSI does not, to verify that WinZip installed correctly you can try +to launch WinZip with the following command:` "C:\Program Files (x86)\WinZip\WINZIP32.EXE"` from +Start > Run or a CMD prompt. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/teamsminimized.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/teamsminimized.md new file mode 100644 index 0000000000..e6391ca30f --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/teamsminimized.md @@ -0,0 +1,110 @@ +--- +title: "How to run Microsoft Teams minimized to systray using PPScripts and PPAM" +description: "How to run Microsoft Teams minimized to systray using PPScripts and PPAM" +sidebar_position: 110 +--- + +# How to run Microsoft Teams minimized to systray using PPScripts and PPAM + +Prerequisites: + +- MS Teams needs to have been installed using the Teams Machine-Wide Installer option: + `msiexec /i Teams_windows_x64.msi OPTIONS="ALLUSERS=1"` +- User needs to have logged in completely at least once to MS Teams, (the status icon will be + visible). + + ![364_1_image-20210414013029-6](../assets/364_1_image-20210414013029-6.webp) + +**Step 1 –** Create a new Application Settings Manager policy for MS Teams on either the Computer or +User side, depending on whether the GPO applies to computer or user objects. If the GPO applies to +the OU containing only computer objects, then create the policy on the computer side, if the GPO +applies to the OU containing only User objects, then create the policy on the user side, etc. + +**Step 2 –** Enable the three settings (see image below) in the Microsoft Teams policy, then click +Ok to save the settings. + +:::note +Only the underlined settings are being reapplied when the policy processes, the other +options are not being changed. +::: + + +![364_2_image-20210414013029-7](../assets/364_2_image-20210414013029-7.webp) + +**Step 3 –** Next, create a new Scripts & Triggers policy within the same GPO, under the same +configuration side, user or computer that you used in Step 1. + +:::note +If applying the policy on the computer side choose switched mode like in the screenshot +below. +::: + + +![364_3_image-20210414013029-8](../assets/579_1_image-20190918135807-1.webp) + +**Step 4 –** At the "On apply action" screen select "PowerShell script" from the dropdown, then in +the main text window, paste in the script below, check the two options "Run script as user" and "Run +interactively", then click "Next". + +``` +# Hides the blue PowerShell window UI when running PS scripts interactively +Add-Type -Name Window -Namespace Console -MemberDefinition ' +[DllImport("Kernel32.dll")] +public static extern IntPtr GetConsoleWindow(); +[DllImport("user32.dll")] +public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); +' +[Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0) +# Segment of Script below is from https://www.alkanesolutions.co.uk/2021/01/16/launch-microsoft-teams-minimised-in-the-system-tray/ +Try + { + #Terminate Teams if it is running + $teamsProcess = Get-Process Teams -ErrorAction SilentlyContinue +If ($teamsProcess) +     { +     #Close Teams Window +       $teamsProcess.CloseMainWindow() | Out-Null +     Start-Sleep -s 5 +     #Close Teams  +     Stop-Process -Name "Teams" -Force -ErrorAction SilentlyContinue +     } +#Define Teams Update.exe paths       +$userTeams = [System.IO.Path]::Combine("$env:LOCALAPPDATA", "Microsoft", "Teams", "current", "Teams.exe") +$machineTeamsX86 = [System.IO.Path]::Combine("$env:PROGRAMFILES (X86)", "Microsoft", "Teams", "current", "Teams.exe") +$machineTeamsX64 = [System.IO.Path]::Combine("$env:PROGRAMFILES", "Microsoft", "Teams", "current", "Teams.exe")      +#Define arguments +$args = @("-process-start-args","""--system-initiated""") +#Launch Teams +if (Test-Path -Path $userTeams) + {Start-Process -FilePath $userTeams -ArgumentList $args} +Elseif (Test-Path -Path $machineTeamsX86) + {Start-Process -FilePath $machineTeamsX86 -ArgumentList $args} +Elseif (Test-Path -Path $machineTeamsX64) + {Start-Process -FilePath $machineTeamsX64 -ArgumentList $args} +} catch { +        #do something +        #$_.Exception +} + +``` + +![364_4_image-20210414013029-9](../assets/364_4_image-20210414013029-9.webp) + +**Step 5 –** Click "Next" at the "On revert action" screen to skip that screen, then at the "specify +process mode" screen choose the "On trigger" option, then choose "Logon" from the drop down before +clicking "Next" to continue. + +![364_5_image-20210414013029-10_724x538](../assets/364_5_image-20210414013029-10_724x538.webp) + +**Step 6 –** At the "Policy settings" screen give the policy a descriptive name then click "Finish." + +**Step 7 –** Lastly, test the policy by logging into a computer as a user that should receive the +policy.  If everything works Teams should open minimized and you should see the MS Teams icon in the +systray. + +:::note +Users may initially see two MS Teams icons for a few seconds in the Systray at the same +time, however, one of the icons will disappear shortly. Also, if this is the first time logging in +since the policy was applied it may take a 2nd login for the policy to kick in. + +::: diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/temperatureunit.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/temperatureunit.md new file mode 100644 index 0000000000..04089655e3 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/temperatureunit.md @@ -0,0 +1,56 @@ +--- +title: "How-to change Temperature Unit from Fahrenheit to Celsius in Microsoft Outlook Calendar via Group Policy?" +description: "How-to change Temperature Unit from Fahrenheit to Celsius in Microsoft Outlook Calendar via Group Policy?" +sidebar_position: 80 +--- + +# How-to change Temperature Unit from Fahrenheit to Celsius in Microsoft Outlook Calendar via Group Policy? + +Pre-requisites (USER ACTION REQUIRE): + +**Step 1 –**  `Stream_Weather_2_`.dat file must be available +at: `%userprofile%\AppData\Local\Microsoft\Outlook\RoamCache` + +**Step 2 –** Create it manually by, Clicking on a little drop-down button in the Weather Bar and Add +another city. Then change it back to the one you want. + +![438_1_sc-kb-o16](../assets/438_1_sc-kb-o16.webp) + +Set Temperature Unit via GPO using PolicyPak Scripts Manager: + +You will be able to set Celsius as default temperature (as shown in following screenshot), instead +of Fahrenheit. + +![438_2_image-20200626100413-1_950x129](../assets/438_2_image-20200626100413-1_950x129.webp) + +Temperature unit information appears to be controlled +via `Stream_Weather_2_.dat` file at this +location: `%userprofile%\AppData\Local\Microsoft\Outlook\RoamCache` + +We can change the DegreeType to 9-1 to convert it to Celsius. But as filename has a unique GUID for +each user so please follow these steps to apply the change via PowerShell Script using PolicyPak +Scripts Manager. + +**Step 1 –** Right-click and Add Policy for PolicyPak Scripts Manager under User Configuration + +![438_3_image-20200626100413-2](../assets/438_3_image-20200626100413-2.webp) + +**Step 2 –** Click Next on the Wizard and Select PowerShell script from the drop-down. Insert the +following script. Then select both checkboxes, Run script as user and With elevated rights. + +``` +$Path = "$env:USERPROFILE\AppData\Local\Microsoft\Outlook\RoamCache\*"$FileName   = (Get-Item   -Path   $Path   -Filter   "Stream_Weather*.dat").FullName$Content   =   Get-Content   -path   $FileNameStop-Process   -Name   outlook   -Force -ErrorAction   SilentlyContinueSet-Content   $FileName $content.Replace("DegreeType"" v=""9-1""",   "DegreeType"" v=""9-0""") +``` + +![438_4_image-20200626100413-3](../assets/438_4_image-20200626100413-3.webp) + +:::note +Outlook has to be closed to make this change, so be sure to add the "stop-process" line +before the "set-content". +::: + + +**Step 3 –** Finally, select an option to apply Once or when forced, and complete the remaining +steps on the wizard. + +![438_5_image-20200626100413-4](../assets/438_5_image-20200626100413-4.webp) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/updateregistry.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/updateregistry.md new file mode 100644 index 0000000000..bf45088e41 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/updateregistry.md @@ -0,0 +1,60 @@ +--- +title: "How do I use Scripts Manager to update the Registry on end-user workstations" +description: "How do I use Scripts Manager to update the Registry on end-user workstations" +sidebar_position: 60 +--- + +# How do I use Scripts Manager to update the Registry on end-user workstations + +If an end-user does not have administrative rights to their PC, they are unable to modify the +registry. Scripts Manager can be used to send out mass updates as required by the Admins. + +:::note +We recommend you put the .REG file on a server so the file itself is under permissions +which cannot be tampered with. It could be a risk to put the .REG file locally on the hard drive +where anyone could edit the raw contents. +::: + + +**Step 1 –** Create new GPO where required + +**Step 2 –** Expand Netwrix Endpoint Policy Manager (formerly PolicyPak) node on either Computer or +User Configuration side and click on "Scripts Manager" + +**Step 3 –** Add new Policy (a or b) + +![654_1_image-20200510105609-16_620x371](../assets/654_1_image-20200510105609-16_620x371.webp) + +**Step 4 –** Enter script by either a) Importing the file or b) entering or copying the comman + +- Click File -> Open and browse for the script to enter + + ![654_3_image-20200510105609-17](../assets/654_3_image-20200510105609-17.webp) + +- Click down-arrow by (None), select type of script and enter the script command(s) in the windows + below + + ![654_5_image-20200510105609-18](../assets/654_5_image-20200510105609-18.webp) + + Sample Script: `regedit.exe /s \\server\share\NewRegValue.reg` + +**Step 5 –** Select "Run Script as User" and "With elevated rights" -> NEXT + +![654_7_image-20200510105609-19](../assets/654_7_image-20200510105609-19.webp) + +**Step 6 –** If the entry is to be reverted, i.e. the registry should become something else if the +policy is no longer linked or enabled, repeat steps 4 and 5 within this window specifying the +appropriate commands to set the registry as required -> NEXT + +**Step 7 –** Specify when you want the command to be run -> NEXT + +:::note +"Always" will ensure that if the value is every updated, it will be returned to the value +specified each time Group Policy is processed +::: + + +![654_9_image-20200510105609-20](../assets/654_9_image-20200510105609-20.webp) + +**Step 8 –** Give a descriptive name to the policy and set Item Level Targeting if required -> +FINISH diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/vpnconnection.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/vpnconnection.md new file mode 100644 index 0000000000..74cd9e408a --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/vpnconnection.md @@ -0,0 +1,48 @@ +--- +title: "How does Endpoint Policy Manager Scripts & Triggers know when the VPN connection is made or lost?" +description: "How does Endpoint Policy Manager Scripts & Triggers know when the VPN connection is made or lost?" +sidebar_position: 120 +--- + +# How does Endpoint Policy Manager Scripts & Triggers know when the VPN connection is made or lost? + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts & Triggers VPN connection supports the +following VPN connections: + +- Microsoft VPN +- OpenVPN GUI +- OpenVPN Connect +- Cisco VPN +- Fortinet VPN + +## Microsoft VPN + +PPScripts uses Microsoft RAS API to listen when RAS connection is created or closed. Windows sends +notification for it with server's name. PPScripts checks if this is VPN connection and lookup for +policy with VPN trigger and same server's name. If policy found, PPScripts executes corresponding +script. + +## OpenVPN GUI + +OpenVPN doesn't use Microsoft RAS API, but it VPN profile allow execute script for +connect/disconnect. PPScripts lookup for OpenVPN profile and modifies them. Add script for +connect/disconnect with PP utility that notifies PPScripts about OpenVPN connect/Disconnect. + +## OpenVPN Connect + +This version of OpenVPN doesn't allow execute scripts for connect/disconnect. PPScripts uses Windows +API to listen if new network adapter was added/removed. Then PPScripts trying to check OpenVPN logs +for this adapter name and find corresponding server's name. + +## Cisco VPN + +Cisco VPN provides API for their VPN. PPScripts uses this API to get notification about +connect/disconnect and server's name. + +## Fortinet VPN + +Fortinet doesn't provide API that notifies about connection/disconnection. But Fortinet VPN creates +virtual network adapter that matched to following mask "FortinetVirtual Ethernet Adapter" + +PPScripts listens if new network adapter was added/removed, check adapter's name, and execute +corresponding script but without name of server. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/windows10modifyscript.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/windows10modifyscript.md new file mode 100644 index 0000000000..6852f6bb82 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/windows10modifyscript.md @@ -0,0 +1,33 @@ +--- +title: "What is the expected behavior on Windows 10 when you MODIFY an existing Endpoint Policy Manager Scripts script?" +description: "What is the expected behavior on Windows 10 when you MODIFY an existing Endpoint Policy Manager Scripts script?" +sidebar_position: 100 +--- + +# What is the expected behavior on Windows 10 when you MODIFY an existing Endpoint Policy Manager Scripts script? + +If you modify a script using the MMC or in-cloud editor, then the compute re-processes the new +script, the following will occur: + +**Step 1 –** The  REVERT script is run, if present. + +**Step 2 –** The newly changed script is then run. + +Here's an example: + +**Step 1 –** If you used Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts and used it to +deploy 7zip from `\\server\share` + +**Step 2 –** AND you have a REVERT script to Uninstall it... + +**Step 3 –** THEN you change deploy script to change the location of 7Zip to +`\\newserver123\newshare123` + +Then the expected behavior should be: + +**Step 1 –** The REVERT script is run (7zip uninstalls). + +**Step 2 –** The newly changed script is then run (7zip reinstalls). + +This will all occur in the same processing cycle, and should not take several GPupdates or Endpoint +Policy Manager Cloud syncs. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/wlandropbox.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/wlandropbox.md new file mode 100644 index 0000000000..5a8f738d88 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/wlandropbox.md @@ -0,0 +1,93 @@ +--- +title: "How to import a WLAN / 802.11 / Wireless profile from Dropbox using Endpoint Policy Scripts Manager" +description: "How to import a WLAN / 802.11 / Wireless profile from Dropbox using Endpoint Policy Scripts Manager" +sidebar_position: 20 +--- + +# How to import a WLAN / 802.11 / Wireless profile from Dropbox using Endpoint Policy Scripts Manager + +**Step 1 –** From an elevated PowerShell prompt on a machine where the WiFi profile is setup and +working run the following to show all WLAN profiles on the PC: + +`netsh wlan show profiles` + +**Step 2 –** Export the profile you need by running the command below - substituting values relevant +to your WiFi `settings/Environment` +netsh wlan export profile name="Company WiFi " key=clear folder=c:\temp + +:::note +This means the XML file will contain your WiFi password in clear text, this KB uses +Dropbox for demonstration purposes only. It is NOT recommended to store your WLAN profile on the +internet. +::: + + +**Step 3 –** Copy the `C:\temp\"Company WiFi.xml"` to Dropbox, then create a Share link. Copy the +link address, then replace the [www.dropbox.com](http://www.dropbox.com/) in your shared link with + +[dl.dropboxusercontent.com](http://dl.dropboxusercontent.com/) to get a direct download link. Link +should look similar to below: + +"[https://dl.dropboxusercontent.com/s/giyj5ei7b3ggyt2/CompanyWiFi.xml?dl=0](https://dl.dropboxusercontent.com/s/giyj5ei7b3ggyt2/CompanyWiFi.xml?dl=0)" + +**Step 4 –** Create the WLAN GPO and apply it to the OU where the Computers live, next use Netwrix +Endpoint Policy Manager (formerly PolicyPak) Scripts Manager > on the Computer side to create a new +policy it + +![658_1_img-1](../assets/497_1_img-1.webp) + +**Step 5 –** At the "Specify policy target screen be sure to use switched mode for the policy. + +![658_2_img-2](../assets/497_2_img-2.webp) + +**Step 6 –** For the Apply action use the script below (remember to use the PowerShell Script option +from the drop down). + +`start-transcript -path "c:\temp\wlan\install.log"` + +# Set Download variables + +`$WLANDownloadFolder = "c:\temp\wlan"` + +#To get a direct download link replace the www.dropbox.com in your shared link with +dl.dropboxusercontent.com + +`$WLANDownloadURL = "https://dl.dropboxusercontent.com/s/giyj5ei7b3ggyt2/CompanyWiFi.xml?dl=0"$WLANLocalDownloadLocation = "c:\temp\wlan"$WLANLocalDownloadFile = "c:\temp\wlan\CompanyWiFi.xml"` + +# Create WLAN folder if not already there + +`New-Item -ItemType directory -Path $WLANDownloadFolder ` + +`start-transcript -path "c:\temp\wlan\install.log" -appen` + +# Download WLAN Profile XML File + +`If ((Test-Path $WLANLocalDownloadFile -PathType Leaf) -eq $False) { Invoke-WebRequest -Uri $WLANDownloadURL -OutFile $WLANLocalDownloadFile }` + +#Apply WLAN profile + +`netsh wlan add profile filename="c:\temp\wlan\CompanyWiFi.xml"` + +` user=all stop-transcript` + +**Step 7 –** Verify that "Run script as user" check box is checked, then click next. + +![658_3_img-3_950x601](../assets/658_3_img-3_950x601.webp) + +**Step 8 –** For the "Policy process mode configuration" screen specify "Once or when forced", then +click save. + +![658_4_img-4](../assets/658_4_img-4.webp) + +:::note +The same policy will work if applied to user side and user OU as well. +::: + + +:::note +If needed you can delete this WLAN profile from a computer using an elevated PowerShell +command prompt. +::: + + +`netsh wlan delete profile name="Company WiFi"` diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/wlannetwork.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/wlannetwork.md new file mode 100644 index 0000000000..0fde95a912 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/tipandtricks/wlannetwork.md @@ -0,0 +1,56 @@ +--- +title: "How to import a WLAN / 802.11 / Wireless profile from a Network Share using Endpoint Policy Scripts Manager?" +description: "How to import a WLAN / 802.11 / Wireless profile from a Network Share using Endpoint Policy Scripts Manager?" +sidebar_position: 10 +--- + +# How to import a WLAN / 802.11 / Wireless profile from a Network Share using Endpoint Policy Scripts Manager? + +From an elevated PowerShell prompt on a machine where the WiFi profile is setup and working run the +following to show all WLAN profiles on the PC: + +`netsh wlan show profiles` + +Export the profile you need by running the command below - substituting values relevant to your WiFi +settings/Environment + +`netsh wlan export profile name="Company WiFi" key=clear folder=c:\temp` + +:::note +This means the XML file will contain your WiFi password in clear text, please take +whatever measures are needed to protect the contents of this file as dictated by your company's +policy. +::: + + +Copy the `C:\temp\Company WiFi.xml` to a share accessible by the users and computers that will need +the WiFi Profile. i.e. + +`"%logonserver%\share\WiFi\Company WiFi.xml"` + +Create the WLAN GPO and apply it to the OU where the Computers live, next use Netwrix Endpoint +Policy Manager (formerly PolicyPak) Scripts Manager > on the Computer side to create a new policy +item. + +![497_1_img-1](../assets/497_1_img-1.webp) + +At the "Specify policy target screen be sure to use switched mode for the policy. + +![497_2_img-2](../assets/497_2_img-2.webp) + +For the Apply action use the command below (remember to use the PowerShell Script option from the +drop down). + +`netsh wlan add profile filename="%logonserver%\share\WiFi\Company WiFi.xml" user=all` + +Verify that "Run script as user" check box is checked then click "Save" + +![497_3_img-3](../assets/497_3_img-3.webp) + +:::note +If needed you can delete this WLAN profile from a computer using an elevated PowerShell +command prompt. +::: + + +`netsh wlan delete profile name="Company WiFi"` diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/_category_.json new file mode 100644 index 0000000000..8a78f7cedc --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Troubleshooting", + "position": 20, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/adminapproval.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/adminapproval.md new file mode 100644 index 0000000000..96d1a14d8e --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/adminapproval.md @@ -0,0 +1,107 @@ +--- +title: "Upgrading MS Teams to latest version displays prompts for Admin Approval" +description: "Upgrading MS Teams to latest version displays prompts for Admin Approval" +sidebar_position: 90 +--- + +# Upgrading MS Teams to latest version displays prompts for Admin Approval + +PROBLEM: + +When updating Microsoft Teams to the latest version you receive an Admin Approval message like the +one below. + +![927_1_image-20231116160521-2](../assets/927_1_image-20231116160521-2.webp) + +CAUSE: + +Customer has enabled AA + Enforce Admin Approval for installers + +![1306_2_02a0661341d87f03cca56ccbf243d833](../assets/1306_2_02a0661341d87f03cca56ccbf243d833.webp) + +But when MS Teams attempts to update, Windows runs a helper process (msiexec.exe without any +arguments as SYSTEM). This msiexec.exe creates another child process (msiexec -embedding `{GUID}`), +and Admin Approval correctly classifies it as installer and intercepts it as expected. + +### WORKAROUND 1: (Recommended) + +:::note +Works only for Endpoint Policy Manager Least Privilege Manager versions 24.4 and later +::: + + +Using Endpoint Policy Manager Least Privilege Manager, now has a parent process condition to the +Endpoint Policy Manager Least Privilege Manager explicit policy. Therefore you can instruct Endpoint +Policy Manager Least Privilege Manager to securely to elevate a command like msiexec -embedding \*, +if it is known that its parent is also msiexec.exe, and signed by Microsoft. + +![1306_3_c1ba4f8f05b21e5d6adf327d817593e9](../assets/1306_3_c1ba4f8f05b21e5d6adf327d817593e9.webp) + +The manual steps to generate the XML are: + +![1306_4_0db039eed39f20ab325fac0ca5b30a6c](../assets/1306_4_0db039eed39f20ab325fac0ca5b30a6c.webp) + +![1306_5_23eaaa42422c8cfce3e46d27a9dddbb2](../assets/1306_5_23eaaa42422c8cfce3e46d27a9dddbb2.webp) + +![1306_6_ad797e8b1ecf0b43d8f8a388ffedcde5](../assets/1306_6_ad797e8b1ecf0b43d8f8a388ffedcde5.webp) + +![1306_7_f8c69edce2b216b5a2e1e3238a79c2e9](../assets/1306_7_f8c69edce2b216b5a2e1e3238a79c2e9.webp) + +![1306_8_4af3ffdd4277ec275d61a4aeb4adb125](../assets/1306_8_4af3ffdd4277ec275d61a4aeb4adb125.webp) + +Additionally, you will need a Endpoint Policy Manager Least Privilege Manager UWP Policy which +specifies that "Any UWP app allowed" as follows: + +![1306_9_85037c3c83c955ec3a44d5631189d585](../assets/1306_9_85037c3c83c955ec3a44d5631189d585.webp) + +Or you can specify some applications which appear to be required during a Teams upgrade. + +![1306_10_4188230b3e50a95465a6cf8a84abb867](../assets/1306_10_4188230b3e50a95465a6cf8a84abb867.webp) + +You can use this XML which is coded for Computer-side policy to accomplish the goals stated in this +Workaround #1. + +IMPORTANT: If using this XML, you must be running PolicyPak Admin Console (MMC) version 24.4.x and +higher otherwise the Parent Process filter will be missing from the imported policy. + +Code Snippet: +[https://raw.githubusercontent.com/endpointpolicymanager/snippets/master/kb-articles/1306/out2.xml](https://raw.githubusercontent.com/endpointpolicymanager/snippets/master/kb-articles/1306/out2.xml) + +### WORKAROUND 2: (Also Recommended) + +Using PolicyPak Scripts and Triggers, create the 2 separate PowerShell policies as shown in the +screen shots below. + +![927_2_2_950x130](../assets/927_2_2_950x130.webp) + +:::note +If you are not licensed for Endpoint Policy Manager Scripts & Triggers you can still use +Workaround 1 by creating the policies below in Microsoft Group policy using regular computer or user +side scripts. +::: + + +Policy 1: PowerShell script scoped to MACHINE that remove all versions of MS Teams that are +currently installed on endpoint. + +Policy 2: PowerShell script scoped to USER that Installs the latest version of MS Teams. + +Code Snippet: +[https://raw.githubusercontent.com/endpointpolicymanager/snippets/master/kb-articles/1306/Script2.ps1](https://raw.githubusercontent.com/endpointpolicymanager/snippets/master/kb-articles/1306/Script2.ps1) + +:::note +You will need to update the path to the latest version of MS Teams file for your +environment in policy #2, see below. +::: + + +![927_3_3_950x296](../assets/927_3_3_950x296.webp) + +[https://www.endpointpolicymanager.com/pp-files/PPScripts\_\_MS_Teams_update_to_resolve_issue_with_Admin_Approval_prompts.xml](https://www.endpointpolicymanager.com/pp-files/PPScripts__MS_Teams_update_to_resolve_issue_with_Admin_Approval_prompts.xml) + +### WORKAROUND 3: For CSEs previous to 24.4 (Not recommended - as any MSIEXEC command line with "-embedding \*" will be elevated - use at own risk) + +Using Endpoint Policy Manager Least Privilege Manager create the 2 separate policies as shown in the +screen shot below. + +![927_4_image-20231213102010-1](../assets/927_4_image-20231213102010-1.webp) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/cylance.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/cylance.md new file mode 100644 index 0000000000..7a0576b8e9 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/cylance.md @@ -0,0 +1,20 @@ +--- +title: "What must I do in Cylance such that it will run Powershell scripts via Endpoint Policy Scripts Manager?" +description: "What must I do in Cylance such that it will run Powershell scripts via Endpoint Policy Scripts Manager?" +sidebar_position: 10 +--- + +# What must I do in Cylance such that it will run Powershell scripts via Endpoint Policy Scripts Manager? + +If you want to use Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts AND Cylance together +to run Powershell scripts.. then.. + +Log into the Cylance console. Select Protection from the menu, then click Script control. + +Select one or more scripts from the list. Click SAFE. These scripts are added to the Global +Safelist, and Endpoint Policy Manager Scripts will run PowerShell scripts as expected. + +:::note +This note came from Cylance and is not validated by Endpoint Policy Manager. + +::: diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/onapplyscript.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/onapplyscript.md new file mode 100644 index 0000000000..a595bd7e7b --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/onapplyscript.md @@ -0,0 +1,26 @@ +--- +title: "What is the expected behavior after an Endpoint Policy Manager Script \"ON/APPLY\" script is modified?" +description: "What is the expected behavior after an Endpoint Policy Manager Script \"ON/APPLY\" script is modified?" +sidebar_position: 20 +--- + +# What is the expected behavior after an Endpoint Policy Manager Script "ON/APPLY" script is modified? + +Here is the expected behavior when you modify a script: + +- If a REVERT script is present, it is run. +- Then, the newly changed ON/APPLY script is run. + +These two actions will occur in the same (next) Group Policy, MDM or Netwrix Endpoint Policy Manager +(formerly PolicyPak) Cloud  process. + +As an example: + +- You have an ON/APPLY script which deploys 7zip from `\\server\share` and +- You have an OFF/REVERT script which UNINSTALLS 7Zip .. THEN +- You change ON/APPLY script to change the location to `\\server123\share123` + +Then the expected behavior we should see is: + +- 7zip uninstall (REVERT script is run.) +- 7zip reinstall (Changed on script is run.) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/overview.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/overview.md new file mode 100644 index 0000000000..10a6a8cfd4 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/overview.md @@ -0,0 +1,51 @@ +--- +title: "Troubleshooting Overview" +description: "General troubleshooting guidance for Scripts and Triggers Manager" +sidebar_position: 1 +--- + +# Troubleshooting Overview + +The most common problem with Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts & Triggers +Manager happens during the initial application. Here are some tips when trying to troubleshoot +Endpoint Policy Manager Scripts & Triggers Manager. + +Endpoint Policy Manager Scripts & Triggers Manager's log files are found in the following folder: + +`%Programdata%\PolicyPak\PolicyPak Scripts Manager`. This is because Endpoint Policy Manager Scripts +& Triggers Manager affects the Computer side (and all users on that computer). It's also possible +there might be some user-side logins in the following folder: + +`%appdata%\local\PolicyPak\PolicyPak Scripts Manager`. But these will not be useful since all +Endpoint Policy Manager Scripts & Triggers Manager work happens on the Computer side. + +There are several files to check in the folder: + +`%Programdata%\PolicyPak\PolicyPak Scripts Manager`. These files are as follows: + +- `ppUser_OnLogon.log`: New data is added to this log when Group Policy applies at the time of login + (and items are set for the user, not the computer). +- `ppUser_Switched.log`: New data is added to this log when Group Policy applies at the time of + login (but items are set for the computer). +- `ppUser_OnGroupPolicy.log`: New data is added to this log when Group Policy applies in the + background (on GPupdate or when Group Policy applies in the background). +- `ppUser_onPolicyChanged.log`: New data is added to this log when Group Policy applies in the + background or when a method other than Group Policy is used (Microsoft Endpoint Manager [SCCM and + Intune], Endpoint Policy Manager Cloud, and so on). + +**Step 1 –** Start with troubleshooting to verify that you are set up with the following scenarios: + +- You have the group policy object (GPO) or file. +- You have a collection within the GPO. +- You have the policies within the collection. + +Figure 33 shows an example of a Endpoint Policy Manager Scripts & Triggers Manager log with some +annotations. + +![troubleshooting](../assets/troubleshooting.webp) + +Figure 33. An example of a Endpoint Policy Manager Scripts & Triggers Manager log. + +**Step 2 –** If needed, logs are automatically wrapped up and can be sent to +[support@endpointpolicymanager.com](mailto:support@endpointpolicymanager.com) using the `PPLOGS.EXE` command on any endpoint +where the client-side extension is installed. \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/powershellscripts.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/powershellscripts.md new file mode 100644 index 0000000000..85c79b958e --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/powershellscripts.md @@ -0,0 +1,89 @@ +--- +title: "How do Endpoint Policy Scripts Manager PowerShell Scripts behave when PowerShell is blocked or disabled using the following methods?" +description: "How do Endpoint Policy Scripts Manager PowerShell Scripts behave when PowerShell is blocked or disabled using the following methods?" +sidebar_position: 60 +--- + +# How do Endpoint Policy Scripts Manager PowerShell Scripts behave when PowerShell is blocked or disabled using the following methods? + +## Scenario 1: Blocking / Denying PowerShell with Least Privilege Manager + +In Netwrix Endpoint Policy Manager (formerly PolicyPak) version 2790 and lower if you use the +Endpoint Policy Manager provided block PowerShell guidance XML, running PowerShell scripts will be +blocked. +Result: Endpoint Policy Manager Logs will show similar error messages to below when Endpoint Policy +Manager attempts to run a PowerShell script. + +![867_1_image-20210721211958-1](../assets/867_1_image-20210721211958-1.webp) + +:::note +Endpoint Policy Manager Scripts and Triggers Manager logs can be found here on the +endpoint(s): +::: + + +- `%programdata%\Policypak\Policypak Scripts Manager` +- `%localappdata%\Policypak\ Policypak Scripts Manager` + +In Endpoint Policy Manager version 2791 and higher if you use the Endpoint Policy Manager provided +block PowerShell guidance XML, running PowerShell scripts will be NOT be blocked, unless you ENABLE +the following Endpoint Policy Manager ADMX setting. +"Endpoint Policy Manager ADMX Settings > Client-Side Extensions > Least Privilege Manager > Block +Processes created by Endpoint Policy Manager Scripts Manager" + +![867_2_image-20210721211958-2](../assets/867_2_image-20210721211958-2.webp) + +## Scenario 2: PowerShell is disabled via a Software Restriction policy using Group Policy on User Configuration side as in image below. + +![867_3_image-20210721211958-3](../assets/867_3_image-20210721211958-3.webp) + +:::note +If you have a Software Restriction policy in place that blocks PowerShell. +::: + + +Result: Any Endpoint Policy Manager Scripts & Triggers Manager policies will still be able to +execute PowerShell Scripts successfully, and the Endpoint Policy Manager Logs will show a successful +run message similar to below when Endpoint Policy Manager runs a PowerShell script. + +![867_4_image-20210721211958-4](../assets/867_4_image-20210721211958-4.webp) + +:::note +Endpoint Policy Manager Scripts and Triggers Manager logs can be found here on the +endpoint(s): +::: + + +- `%programdata%\Policypak\Policypak Scripts Manager` +- `%localappdata%\Policypak\Policypak Scripts Manager` + +## Scenario 3: PowerShell is disabled via a Software Restriction Policy (SRP) using Group Policy on Computer Configuration side as in the image below. + +![867_5_image-20210721211958-5](../assets/867_5_image-20210721211958-5.webp) + +If you have a Software Restriction Policy in place that blocks PowerShell. +Result: Any Endpoint Policy Manager Scripts & Triggers Manager policies that do not run as SYSTEM +will be blocked from running, and Endpoint Policy Manager Logs for the user will show blocked events +messages similar to below. + +![867_6_image-20210721211958-6](../assets/867_6_image-20210721211958-6.webp) + +:::note +Endpoint Policy Manager Scripts and Triggers Manager logs can be found here on the +endpoint(s): +::: + + +- `%programdata%\Policypak\Policypak Scripts Manager` +- `%localappdata%\Policypak\Policypak Scripts Manager` + +:::note +To ensure the SRP policy is applied properly during testing you can try running PowerShell +manually from CMD as a standard user under either scenario 2 or 3 and if the SRP is applied properly +then PowerShell will be blocked. +::: + + +![867_7_image-20210721211958-7](../assets/867_7_image-20210721211958-7.webp) + +![867_8_image-20210721211958-8](../assets/867_8_image-20210721211958-8.webp) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/scriptlocation.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/scriptlocation.md new file mode 100644 index 0000000000..b9bb10f1aa --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/scriptlocation.md @@ -0,0 +1,34 @@ +--- +title: "Where do scripts run? How are they protected from unauthorized access? How can I change the location of where scripts are stored?" +description: "Where do scripts run? How are they protected from unauthorized access? How can I change the location of where scripts are stored?" +sidebar_position: 30 +--- + +# Where do scripts run? How are they protected from unauthorized access? How can I change the location of where scripts are stored? + +Scripts from Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts Manager are pre-stored +before running in the following folder: + +`\ProgramData\PolicyPak\PolicyPak Scripts Manager\Temporary Scripts` + +![827_1_image002_950x293](../assets/827_1_image002_950x293.webp) + +During script processing time: + +- The files can be listed and enumerated by any user. + +- But they can only be read by the correct contextual person. + +For instance: + +- Scripts configured to be run as a USER can be read by THAT user and LOCAL SYSTEM. +- Scripts configured to be run as SYSTEM can only be read by LOCAL SYSTEM. + +If you want to change the temporary script location place you can use the ADMX settings to do it; +but then you are responsible for setting the right protection on the folder and self-testing that it +works as expected. +Find the setting Computer Configuration | Admin Templates Manager | PolicyPak ADMX Settings | +Client-Side Extensions | Scripts Manager | Use custom location for temporary script files like +what's seen here. + +![827_3_image004](../assets/827_3_image004.webp) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/systemprocesses.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/systemprocesses.md new file mode 100644 index 0000000000..c881232e07 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/systemprocesses.md @@ -0,0 +1,21 @@ +--- +title: "Why don't Batch and PowerShell scripts get blocked when SYSTEM processes are blocked" +description: "Why don't Batch and PowerShell scripts get blocked when SYSTEM processes are blocked" +sidebar_position: 70 +--- + +# Why don't Batch and PowerShell scripts get blocked when SYSTEM processes are blocked + +When implementing SecureRun to block both User and System processes (as demonstrated in +[SecureRun to block User AND System executables](/docs/endpointpolicymanager/knowledgebase/leastprivilegemanager/videolearningcenter/bestpractices/usersystemexecutables.md) +video) we find that EXEs, MSIs and VB scripts get smacked down as expected when running as the USER, +ADMIN or SYSTEM account. However, Batch and PowerShell scripts that are started from within a +previously opened cmd.exe or powershell.exe window do not get blocked when running as a system +process. Why don't they? + +This is expected behavior. When you run an EXE, MSI and VB script a new process is created. +PolicyPak Least Privilege Manager then intercepts that process and applies the appropriate rule to +it. Batch and PowerShell scripts when run from within an open cmd.exe or powershell.exe window, +however, do not open a new process; they run within that existing process. As no new process is +started, there's nothing for Least Privilege Manager to intercept and the command is thereby allowed +to run. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/vpn.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/vpn.md new file mode 100644 index 0000000000..9c0a7d4dfd --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/vpn.md @@ -0,0 +1,106 @@ +--- +title: "How to use Scripts Manager Triggers to Map Network Drives when a VPN is Connected" +description: "How to use Scripts Manager Triggers to Map Network Drives when a VPN is Connected" +sidebar_position: 50 +--- + +# How to use Scripts Manager Triggers to Map Network Drives when a VPN is Connected + +## Prerequisites: + +- VPN used must be in the list of supported VPNs in the article below. + + [Which VPN Solutions are currently supported for use with Scripts Manager VPN Triggers?](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/knowledgebase/troubleshooting/vpnsolutions.md) + +**Step 1 –** Create a new policy (Set Launch Folder Windows in a Separate Process to Enabled) using +Scripts & Triggers on the computer side, choose switched-mode like in the screenshot below. + +![639_1_image-20210424015614-1](../assets/579_1_image-20190918135807-1.webp) + +**Step 2 –** At the "On apply action" screen select "PowerShell script" from the dropdown, then in +the main text window, paste in the script below, check the option "Run script as user, then click +"Next". + +``` +# Set Launch Folder Windows in a Separate Process to Enabled +if((Test-Path -LiteralPath "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced") -ne $true) { +    New-Item "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -force -ea SilentlyContinue  +}; +New-ItemProperty -LiteralPath 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name 'SeparateProcess' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue;  + +``` + +![639_2_image-20210424015614-2](../assets/mappeddrives/639_2_image-20210424015614-2.webp) + +**Step 3 –** Then click "Next" at the "On revert action" screen to skip that screen, then at the +"Specify process mode" screen choose the "Once" option. + +![639_3_image-20210424015614-3](../assets/mappeddrives/639_3_image-20210424015614-3.webp) + +**Step 4 –** At the "Policy settings" screen give the policy a descriptive name then click "Finish. + +![639_4_image-20210424015614-4](../assets/mappeddrives/639_4_image-20210424015614-4.webp) + +**Step 5 –** Now create another policy (Map drives when VPN connects) using Scripts & Triggers on +the computer side, choose switched-mode like in the screenshot below. + +![639_5_image-20210424015614-5](../assets/579_1_image-20190918135807-1.webp) + +**Step 6 –** At the "On apply action" screen select "PowerShell script" from the dropdown, then in +the main text window, paste in the script below then change the drive mappings to match the settings +needed for your environment, check the option "Run script as user, then click "Next". + +``` +# Wait for DNS to settle after VPN connects +Start-Sleep -s 10 +# Map G Drive +if (-not(get-psdrive -name "G" -ErrorAction SilentlyContinue)) { +    New-PSDrive -name "G" -PSProvider FileSystem -Root \\Server\share1 -Persist +} +# Map H Drive +if (-not(get-psdrive -name "H" -ErrorAction SilentlyContinue)) { +    New-PSDrive -name "H" -PSProvider FileSystem -Root \\Server\Share2 -Persist +}  + +``` + +![639_6_image-20210424015614-6](../assets/mappeddrives/639_6_image-20210424015614-6.webp) + +**Step 7 –** Click "Next" at the "On revert action" screen to skip that screen, then at the "specify +process mode" screen choose the "On trigger" option, then choose "VPN connect" from the drop down +before clicking "Next" to continue. + +![639_7_image-20210424015614-7](../assets/mappeddrives/639_7_image-20210424015614-7.webp) + +**Step 8 –** At the "Trigger settings" screen enter an asterisk (wildcard, etc.) for the server +name, then click "Next". + +![639_8_image-20210424015614-8](../assets/mappeddrives/639_8_image-20210424015614-8.webp) + +**Step 9 –** At the "Policy settings" screen give the policy a descriptive name then click "Finish. + +![639_9_image-20210424015614-9](../assets/mappeddrives/639_9_image-20210424015614-9.webp) + +:::note +You should have two policies now: +::: + + +![639_10_image-20210424015614-10](../assets/mappeddrives/639_10_image-20210424015614-10.webp) + +**Step 10 –** Lastly, test the policy by logging into a computer, (or run `gpupdate `if already +logged in) and then connect to a VPN as a user that should receive the policy. If everything works +you should see the network drives show up in File Explorer, you may need to click refresh if you had +File Explorer already open to update the window contents. + +![639_11_image-20210424015614-11](../assets/mappeddrives/639_11_image-20210424015614-11.webp) + +**Step 11 –** Optionally, create a new Scripts and Triggers policy that disconnects the drives when +the VPN disconnects by using the script below and also changing the trigger to "VPN disconnect". + +![639_12_image-20210424015614-12](../assets/mappeddrives/639_12_image-20210424015614-12.webp) + +![639_13_image-20210424015614-13](../assets/mappeddrives/639_13_image-20210424015614-13.webp) + +**Step 12 –** "On trigger" does not work with Revert action script which is why you need to create a +new policy to disconnect the drives. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/vpnsolutions.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/vpnsolutions.md new file mode 100644 index 0000000000..96ca28150d --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/vpnsolutions.md @@ -0,0 +1,15 @@ +--- +title: "Which VPN Solutions are currently supported for use with Scripts Manager VPN Triggers?" +description: "Which VPN Solutions are currently supported for use with Scripts Manager VPN Triggers?" +sidebar_position: 40 +--- + +# Which VPN Solutions are currently supported for use with Scripts Manager VPN Triggers? + +The following VPNs are currently supported for use in Scripts Manager VPN Triggers: + +1. Anything in the box from Microsoft +2. Cisco AnyConnect +3. Fortinet +4. OpenVPN (GUI) +5. OpenVPN (Connect) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/windows7tls.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/windows7tls.md new file mode 100644 index 0000000000..2f99796905 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/technical-notes/troubleshooting/windows7tls.md @@ -0,0 +1,105 @@ +--- +title: "How do I update Windows 7 machines to TLS 1.2 such that they work with Endpoint Policy Manager Cloud?" +description: "How do I update Windows 7 machines to TLS 1.2 such that they work with Endpoint Policy Manager Cloud?" +sidebar_position: 80 +--- + +# How do I update Windows 7 machines to TLS 1.2 such that they work with Endpoint Policy Manager Cloud? + +First know that Windows 7 is not officially supported by Netwrix Endpoint Policy Manager (formerly +PolicyPak) and may or may not work for all functions. + +Pre-read the following to know what is known to NOT work in Windows 7 before continuing: + +[How does Endpoint Policy Manager support (and not support) Windows 11?](/docs/endpointpolicymanager/knowledgebase/gettingstarted/knowledgebase/gettingstarted/windows11.md) + +Then after that, if you still wish to use Endpoint Policy Manager with Windows 7 and Endpoint Policy +Manager Cloud, you must update Windows 7 to be TLS 1.2 complaint. + +Then to adjust on these computers, all pre-Windows 10 machines must be upgraded to use TLS 1.2 on +the client. The how-to from Microsoft is +here:[https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client)The +quick version goes like this: + +- Have Service Pack 1 installed (on Windows 7). +- Have the Windows Update KB3140245 installed. (Download from + [https://www.catalog.update.microsoft.com/search.aspx?q=kb3140245](https://www.catalog.update.microsoft.com/search.aspx?q=kb3140245).) +- Update the registry. (Download the Microsoft + [https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392#bkmk_easy](https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392#httpssupportmicrosoftcomen-ustopicupdate-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392bkmk_easy) + which is downloadable as a .MSI for easy deliver.) + +Note that Endpoint Policy Manager Support cannot be engaged for you to update these machines on your +behalf. And we cannot automatically validate or report that you have performed the steps correctly. + +If you wish to script the installation of the KB3140245 hotfix and the Registry with the "Easy fix" +you can do so with two scripts. These scripts will work with Endpoint Policy Manager Cloud and +Endpoint Policy Manager Scripts Manager (GPO, MDM or Cloud.) + +The video explaining how to do this by hand, or by script, or using Endpoint Policy Manager Scripts +can be found at : How do I update Windows 7 machines to TLS 1.2 such that they work with Endpoint +Policy Manager Cloud? + +Note for the MSU file, you will need to stage it on Amazon S3 or another publicly readable service +like Azure Blob storage. The file cannot automatically be downloaded by Windows 7 in its original +home location because that download requires TLS 1.2; and the machine you're trying to update +doesn't support that yet.  Note also that the script references the 64-bit MSU file. You will need a +separate script to deliver the MSU to 32-bit Windows 7 machines. Or if you have Windows 8 machines +or Server 2008 R2 machines, use the corresponding MSU from the Microsoft Catalog referenced above. + +Script 1: Win 7 MSU Update + +``` +# Microsoft MSU will be coming from = https://z_deleteme.s3.amazonaws.com/windows6.1-kb3140245-x64_5b067ffb69a94a6e5f9da89ce88c658e52a0dec0.msu +#Script starts here +Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force +# Set Download variables +$DownloadFolder = "c:\temp\apps" +$DownloadURL = "https://z_deleteme.s3.amazonaws.com/windows6.1-kb3140245-x64_5b067ffb69a94a6e5f9da89ce88c658e52a0dec0.msu" +$LocalDownloadFile = "c:\temp\apps\kb3140245-x64.msu" +#Create temp folder if not present +$tempfolder = "C:\temp" +if (-not (Test-Path $tempfolder -PathType Container)) +{ +New-Item -ItemType directory -Path $tempfolder +} +# Create apps folder and enable logging +New-Item -ItemType directory -Path $DownloadFolder +start-transcript -path "c:\temp\apps\kb3140245-x64_PS.log" -append +# Download and install kb3140245-x64.msu +If ((Test-Path $LocalDownloadFile -PathType Leaf) -eq $False) +{ +Invoke-WebRequest -Uri $DownloadURL -OutFile $LocalDownloadFile +#install kb3140245-x64.msu silently and enable verbose logging +wusa.exe c:\temp\apps\kb3140245-x64.msu /quiet /norestart /log:c:\temp\apps\kb3140245-x64_MSU.log +} +#Script ends here +``` + +Script 2: Win 7 Easy Fix + +``` +# Microsoft EasyFix will be coming from here: https://download.microsoft.com/download/0/6/5/0658B1A7-6D2E-474F-BC2C-D69E5B9E9A68/MicrosoftEasyFix51044.msi +#Script starts here +Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force +# Set Download variables +$DownloadFolder = "c:\temp\apps" +$DownloadURL = "https://download.microsoft.com/download/0/6/5/0658B1A7-6D2E-474F-BC2C-D69E5B9E9A68/MicrosoftEasyFix51044.msi" +$LocalDownloadFile = "c:\temp\apps\MicrosoftEasyFix51044.msi" +#Create temp folder if not present +$tempfolder = "C:\temp" +if (-not (Test-Path $tempfolder -PathType Container)) +{ +New-Item -ItemType directory -Path $tempfolder +} +# Create apps folder and enable logging +New-Item -ItemType directory -Path $DownloadFolder +start-transcript -path "c:\temp\apps\MicrosoftEasyFix51044.msi_PS.log" -append +# Download and install MSEasyFix +If ((Test-Path $LocalDownloadFile -PathType Leaf) -eq $False) +{ +Invoke-WebRequest -Uri $DownloadURL -OutFile $LocalDownloadFile +#install MSEasyFix silently and enable verbose logging +msiexec.exe /i c:\temp\Apps\MicrosoftEasyFix51044.msi /qn /L*V C:\temp\apps\MSEasyFix_install.log +} +#Script ends here +``` diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/_category_.json new file mode 100644 index 0000000000..88d2e60183 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Video Learning Center", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/_category_.json new file mode 100644 index 0000000000..f084c60ffe --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Getting Started", + "position": 10, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/cloud.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/cloud.md new file mode 100644 index 0000000000..e2b44b1b59 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/cloud.md @@ -0,0 +1,105 @@ +--- +title: "Deploy any script via the Cloud to domain joined and non-domain joined machines" +description: "Deploy any script via the Cloud to domain joined and non-domain joined machines" +sidebar_position: 20 +--- +# Deploy any script via the Cloud to domain joined and non-domain joined machines + +Use Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts whenever you need to deliver +something that in-box Policy, Preference or Endpoint Policy Manager cannot normally do. Find your +scripting superpowers and manage those non-domain joined machines! + + + +### PolicyPak Scripts-Deploy any script via the Cloud to domain joined and non-domain joined machines + +In a previous video, you saw me use Endpoint Policy Manager "Scripts Manager" to create a "User Side +Script Policy" that will deliver a shortcut. Just a simple little base hit thing for us to hang our +hat on. In this video, I'm now going to take the same exact policy that we have. Just to quickly +review it, the first thing it's going to do is when the policy applies, it's going to drive in a +shortcut, and when the policy doesn't apply anymore, it's going to drive in a script that will +delete a shortcut. Pretty simple. + +In order to use this in Endpoint Policy Manager Cloud land, all you're going to do is take the item, +you can either right click and "Export as XML" or you can just drag and drop it right into a folder, +which is what I'm going to do. Now it should live right there in the folder. We'll get to that guy +in a second. + +The second thing I want to do for all my Endpoint Policy Manager Cloud people here is maybe I want +to do something on the system side. I want to rename the "Ethernet" adapter. If you try to do this +as a standard user and you try to "Rename" this, you kind of think it let's you but then you get +prompted. You're not allowed to do this, but you could do this if you were system context as a +systemwide script. + +How would we do that? I found this little handy-dandy script off the Intertubes right here. We're +going to "Get" the "NetAdapter," the one that is called "Ether\*," and then "Rename" it to a +"NewName" that I'm going to call "AwayNet." It doesn't matter. It's just a simple script for us to +use for this demonstration. + +This time, I'm going to go on the computer side, go to "Scripts Manager," right click, "Add/New +Policy" here. I'm not going to do the thing I did earlier. I don't want to "Apply this policy to all +users who log on to the computer." No, this time I want to "Apply this policy to computer." This is +a systemwide policy that's going to affect everybody on the system. + +I'm going to just make an on script. This is a "PowerShell script." I'm going to paste in my little +script here. It's going to find the ones called "Ether\*" and "Rename" them to "AwayNet." Just +something simple just for you to see it work. I don't need a "revert action." When this thing hits, +I just want to do it. I don't care if it ever peels back. I just want to set it and forget it and +not think about it anymore. + +That's it. I can make it "Always," "Once" or "Once or when forced." I'll just do it one time. I +don't see any reason to do it more than once, so I'll go ahead and just do it "Once." I will say "PP +Scripts Computer System script." + +You could also wrap this whole thing up in "Item Level Targeting" if you wanted. You could say only +do this thing when it's a laptop ("Portable Computer") or it's Windows 10 ("Operating System") or +I'm on this "IP Address Range" or whatever. I'm not going to do that. I'm just going to hit it for +everybody and be ready to go. Now that I've got that script here, I'm going to drag and drop this +guy into my Endpoint Policy Manager Scripts XML folder ("PPSCRIPTS XML") for safekeeping. + +Now I'm ready to go into Endpoint Policy Manager Cloud, which is right here. If you'll remember, +Endpoint Policy Manager Cloud has this idea of the special "All" group where every computer will get +this or your "Company Groups" so you can dictate which computers are going to get these settings. +I'm going to go whole hog and I'm going to put these both into "All." + +I'm going to "Upload and link a new XML here." I'm going to "Browse" for the first one. This is the +user side one that's going to create a shortcut, so "PPSCRIPTS: Shortcut Create." I'll go ahead and +"Add" this guy. Then I'll go ahead and add my second one, "Upload and link a new XML here." This one +is going to be the one for the computer side, so "PPSCRIPTS: Rename NIC." There we go. So I'm ready +to go. I'll go ahead and click there, and we should be ready to rock. + +At this point now, I'll go over to my endpoint. I'm going to install the "Endpoint Policy Manager +Cloud Client." Now in your world, you might already have the Endpoint Policy Manager Cloud Client +already installed. This does require admin rights, so I'm going to get prompted here. But I'm doing +this as a standard user, so we can see that two things will happen after I join Endpoint Policy +Manager Cloud and get placed into the All group. The first thing is I should see the script +generated shortcut here, and the second thing is that I should see the Ethernet get renamed from +"Ethernet0" to I think it was called AwayNet. + +You can see here's the "All" group. There we go. The shortcut just showed up here. Let's go ahead +and "Close" that. I'm just going to refresh this. Let's see what happens. There we go. As soon as I +hit F5, it came right in. We're ready to go. + +With that in mind, now what I could also do is I could maybe make this shortcut go away. How do I do +that? Go back to Endpoint Policy Manager Cloud. Let's say goodbye to that shortcut here. Here we go, +"Shortcut Create." Then we'll go ahead and "Unlink XML Data file from Computer Group" so it's no +longer applying to that computer anymore, or all the computers. Go back to Endpoint Policy Manager +Cloud. + +We could either just wait a little while if we wanted to. Endpoint Policy Manager will sync +naturally every 60 minutes or so. Or we can run "ppcloud /sync" and this will note that the PP +Script item isn't there anymore. Watch the little birdie here. If all goes well, just like that it +gets automagically deleted just like that. + +That's the beauty of Endpoint Policy Manager Cloud and Endpoint Policy Manager Scripts. You can set +an on script and an off script. You can wrap it all up with item-level targeting and say only do +this thing when it's true and peel it back when it's not true. You can do things on the user side +for users to see, and you can do things on the system side that will affect the entire computer. + +With that in mind, don't forget Endpoint Policy Manager Cloud is amazing not just for domain joined +but also for non-domain joined machines, computers that may never come back into the office and +never check in. Now you have an extra way to manage the heck out of them. + +I hope this helps you out. Looking forward to getting you started with Endpoint Policy Manager Cloud +real soon. +See ya. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/onpremise.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/onpremise.md new file mode 100644 index 0000000000..5eb38fa53c --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/gettingstarted/onpremise.md @@ -0,0 +1,120 @@ +--- +title: "Use with on-prem Group Policy" +description: "Use with on-prem Group Policy" +sidebar_position: 10 +--- +# Use with on-prem Group Policy + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts Manager goes beyond in-box Group Policy +and enables you to deliver settings MORE than once, use any language you want, and eliminate +[https://www.endpointpolicymanager.com/pp-blog/group-policy-loopback](https://www.endpointpolicymanager.com/pp-blog/group-policy-loopback) +so you can apply scripts to all users on the machine. + + + +### PolicyPak Scripts-Use with on-prem Group Policy + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Endpoint Policy Manager +Software. In this video, you can learn all about Endpoint Policy Manager Scripts Manager with using +Group Policy. Now if you have Endpoint Policy Manager Cloud or Endpoint Policy Manager with your MDM +service, there will be other videos for that. This one is just about using Endpoint Policy Manager +Scripts Manager with Group Policy. + +As a former Group Policy MVP, I'm a huge fan of the stuff Microsoft provides. There are a billion +things you can do in "Administrative Templates" and "Preferences," but sometimes every once in a +while there's going to be something you can't do with either the Microsoft stuff or with our stuff, +with Endpoint Policy Manager. In those cases, you may need to script it, so that's why we've created +Endpoint Policy Manager Scripts Manager. + +Scripts Manager exists on both the computer side and the user side, and I'm going to show you both +in this video. The first one I'm going to show you is on the user side, "Scripts Manager." We're +going to right click, "Add," either a "New Collection" or a "New Policy." I'm going to start off +with just a "New Policy." A "New Collection" just holds multiple policies. + +This is why it's so great and it stands head and shoulders above what Microsoft provides. The first +thing is that Microsoft scripts can only work at startup, shutdown, log on and log off. Ours can run +at multiple times. I'm going to show you that right now. + +You can also run pretty much any script type that matters, for instance, a "PowerShell" script. I +have one that's going to create a shortcut. I know you can create a shortcut with Group Policy +Preferences, but I'm doing it here just as an example so you can see a script run and see that it's +"PowerShell." + +When this GPO applies to the user, it's going to run this PowerShell script. Here's the other best +part. When the GPO no longer applies, you can run this other script. So you get a script when you +get the GPO, and this is a script you get when you don't get the GPO. So the first script creates a +shortcut, and this script will remove a shortcut. So in this way, you can put what happens on the +positive action and what happens on the negative action, "On apply action" and "On revert action." + +Then you can dictate when the script is going to kick in. The default is "Always," which is every +time Group Policy processes. So every time you log on and always in the background with background +Group Policy. You can make it run "Once" and never again, or you can make it run "Once or when +forced" and it will only "Run the script when gpupdate/ force or (our command) ppupdate/ force +runs." I'm going to do it "Always." + +I'll go ahead and click "Next" and give it a name, like "User side script policy." Then here's the +other best part. This whole thing can be wrapped around inside "Item Level Targeting." You can say +only do this script ON and OFF when these conditions are true. It will evaluate the condition and do +the ON script when it's true and run the OFF script when it isn't true. + +For instance, if you wanted to run this script when you're on this "IP Address Range" and then run +the revert script when you're not on this "IP Address Range," you could do that. You could say only +do this thing when you're on a laptop ("Portable Computer"), or you could say only do it when a +person is in a particular "Security Group" and lots of other conditions as well. + +I'm not going to do that here, but it's fantastic and you get the general gist there. I'll go ahead +and click "Finish." With that in mind, let's run over to our endpoint machine here. We can go ahead +and run GP Update ("gpupdate"), and you're looking for a shortcut to appear here not through Group +Policy Preferences but through Endpoint Policy Manager Scripts which is going to use PowerShell. +There you go. It happens in real time just like that. + +While this is still cooking, let's go back to our management station and let's make the script fall +out of scope. I'm going to right click and "Delete" the GPO link so the GPO doesn't apply anymore to +our "East Sales Users." When that happens and then they run GP Update ("gpupdate") or log on, watch +the icon right here. We have a remove script that's going to know that that takes effect and runs +the remove script at that point just like that. + +If that wasn't awesome enough, Endpoint Policy Manager Scripts has even more superpowers. This is +where it happens on the computer side. Let's go to our "East Sales Desktops" here and we'll "Create +a GPO in this domain, and link it here" called "PP SCRIPTS COMPUTER SIDE." + +Now in "PP SCRIPTS COMPUTER SIDE," you have two amazing superpowers. We'll go here and go to the +computer side, "Endpoint Policy Manager /Scripts Manager." You can right click, "Add/New Policy" +script. You have two choices. One is do a system like thing: "Apply this policy to computer." This +applies the policy to the whole computer at large. Like if you wanted to wipe out a folder or kick +off a process or do something on the system, you could do that here. + +But my favorite is this guy right here: "Apply this policy to all users who log on to the computer +(switched mode)." So instead of having to worry and think and wrack your brains about how loopback +is going to work and which settings are going to be involved there, no problem. We're going to just +drop a script in and all users who log on to this computer are going to get it just like that. + +We'll go ahead and run the "PowerShell" apply script here. We're going to "Run script as user" +because otherwise we wouldn't see the shortcut being created. We'll go ahead and copy that and put +the script in there just like that. When it no longer applies, we're going to run another +"PowerShell script." Again, we'll "Run script as user," and we will run the remove command at that +point. + +We can run it "Always," "Once" or "Once or when forced" with "gpupdate/ force or ppupdate/ force." +I'm going to go ahead and run it "Always" here. We can call this "PP Scripts Computer side." You can +also do "Item Level Targeting" and – wait for it – here's the best part. You can say do this script +for all users on the computer except and rather limit based upon who's in a "Security Group." So not +necessarily everybody on the computer like if it's a terminal server. You can make it say only these +particular users when they're on this computer, which is amazing. That is a humongous superpower. + +With that in mind, I'm ready to go. Let me go over to my endpoint here. Now I'm ready to run GP +Update ("gpupdate"). Watch right here. You're going to see the exact same thing we saw on the first +part of the video, but this time the script is hitting the computer and each user who logs on to +that computer. That's the amazing part. + +Just to prove a point, I'll go ahead and "Sign out" here and log on as a guy that has never logged +on before. I'll go ahead and log on as a guy "eastsalesuser8." I don't know. This guy has probably +never logged on before. Let's wait for the profile to be generated, and the first time the guy logs +on he gets the script. If it no longer applies, the script will peel back just like that. + +Endpoint Policy Manager Scripts, new component, it's fantastic and ready for you to use right now. + +Thanks so much for watching. If you're using Endpoint Policy Manager Cloud or Endpoint Policy +Manager with your MDM service, we have other videos to show you how that works. + +Thanks so very much and talk to you soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/_category_.json new file mode 100644 index 0000000000..6a7f3b8136 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Methods", + "position": 20, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/mdm.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/mdm.md new file mode 100644 index 0000000000..2137348e7c --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/mdm.md @@ -0,0 +1,205 @@ +--- +title: "Endpoint Policy Manager Scripts and YOUR MDM service: Un-real power" +description: "Endpoint Policy Manager Scripts and YOUR MDM service: Un-real power" +sidebar_position: 10 +--- +# Endpoint Policy Manager Scripts and YOUR MDM service: Un-real power + +MDM services cannot deliver scripts and UN-deliver scripts. That's where Netwrix Endpoint Policy +Manager (formerly PolicyPak) Scripts Manager AND your MDM service become awesome. Check out this +video for an overview of WHY you need it and some examples of PP Scripts + MDM in use. + + + +### PolicyPak Scripts and YOUR MDM service-Un-real power + +Hi, this is Jeremy Moskowitz, Desktop Management and former Group Policy MVP. In this video, I'm +going to show you first why your MDM solution isn't that good at scripting and how we here at +Endpoint Policy Manager with our Endpoint Policy Manager Script Manager plus your MDM is probably +way better than what your vendor provides by itself. + +The first thing is that maybe your vendor doesn't provide any scripting ability in their MDM +solution. Some of them don't. Some of them do. I'm going to talk about the ones that do but if you +don't have any scripting ability, well, now you do with Endpoint Policy Manager Script Manager. + +If you're a MobileIron customer, this is an extra add-on. In other words, this thing called +MobileIron Bridge you have to pay into in order to run existing PowerShell scripts that they provide +or you can create yourself. But the point is if you want to do this idea, you have to buy into it as +a MobileIron customer. + +A lot of these vendors only let you use one script type. Most of them are restricted to PowerShell +but if you've got some intricate scripts that are already VB or batch file scripts, you're kind of +out of luck. I'll show you how to fix that problem. + +These scripts will never update. Typically, these scripts are applied and run only one time unless +the script itself is updated. In our world that's different, and I'll show you how that's different. + +These other solutions let you target only computers and not users. That's kind of a bummer because +you might want to do something that affects every user on the machine, and you may want to do things +that affect the system itself. With these other systems, you kind of can only do the latter. You can +only affect the system itself. + +All the logic must be contained inside the script. This is a big problem because you might have a +script that you might want to say, "Do this thing when it's a desktop; do this other thing when it's +a laptop." That stinks because then you have to figure out how to determine those conditions being +true, and you have to jam that all into the script. So if you're not a bona fide scripting expert, +that can be pretty hard. I'll show you how to work around that. + +Most of these scripts cannot be retriggered. The idea is that if you've deployed a script, then that +script has no way to get rerun. These scripts have no way to get retriggered. So once that script +comes down, there's really no way for you to retrigger that and see that happen again. Typically you +need to just update the script and wait for MDM to redeploy it. There's no way to rerun that script +for testing purposes. + +These last four – number 3, 2, 1 and 0 – are kind of all about Intune restrictions. At Microsoft +Ignite this last year, they made a big deal that you can now deploy PowerShell scripts using Intune. +The crowd went wild and that's great, but it should be noted about what the limitations are. I want +to go through that here. + +The first thing is that it only lets you do PowerShell scripts. Actually, that's another thing. It +only lets you do PowerShell scripts just like some of the other vendors. If you have things that are +not in PowerShell, you can't do it. + +The other key restriction is that the scripts must be very, very small: 10 KB for ACSII or 5 KB for +Unicode, which is really, really small. + +The second thing which might even be more important is that you can only use the 32-bit version of +PowerShell. So if you have 64-bit PowerShell cmdlets, those are not a thing you can do inside the +Intune plus PowerShell. + +The scripts only run when the computer is actually already pre-associated with a user. If you have +non logon devices like kiosk machines, then MDM plus Intune plus scripting is not a thing you can do +here. It's kind of a major restriction. + +Also, the scripts will not run with hybrid scenarios. That is, if the computer is both on-prem +domain joined and Azure domain joined, then it's a no-go. The script will not run in that case. + +So how do we overcome all that? We've really thought those problems all the way through and tried to +wrestle them all the way to the ground. + +The first thing is that Endpoint Policy Manager Scripts is included with the On-Prem and MDM +edition, and it works across any MDM service. + +We can target stuff to both user and computer side. It just works the way you would expect. + +We can use all sorts of languages, like VB, JS, BAT and PowerShell as a language. + +Scripts can be applied ONCE, ALWAYS, and ONCE plus a retrigger if you want to. + +We have no size restrictions. + +We can work with kiosk mode. + +We can work with hybrid join. + +And my favorite two superpowers is this idea where you get an ON script and an OFF script. So when +the policy no longer applies, you're predetermining what's supposed to happen when that policy no +longer applies. + +And all of our stuff can be wrapped up inside item-level targeting to make it drop-dead easy. In +other words, if you have a script that you want to say, "Do this thing when it's a laptop," great. +We can figure that out very quickly using item-level targeting. + +That's it for the little mini stuff here. Now I'm hoping you watched the previous videos where I +created existing policies here in Endpoint Policy Manager Scripts land. I have one here on the user +side which is going to deliver a shortcut and it's also going to un-deliver a shortcut when the +policy no longer applies. + +Here's he "Apply action" that's going to do deliver a shortcut when the policy applies. Here's the +"Revert action" that's going to nuke the shortcut when the policy no longer applies. We talked about +this in other videos that you can wrap the whole thing up in "Item Level Targeting" which is +awesome. + +You can just point and shoot your way to glory and say I'm going to do this ON script when it's a +"Portable Computer" or when the "Operating System" is Windows 10 or when the "CPU Speed" or when the +"IP Address Range," whatever your goal is you can set the targeting filters so that this script will +only fire off when the condition is true. And when the condition isn't true anymore, we're going to +run the OFF script. + +I've already done this script. Actually, in a previous video, I dragged it over here to the desktop +in a little folder called "PPSCRIPTS XML." It's right here, the scripts for the user side to make +the shortcut. + +The other thing I did in the other video here is I created another script that will rename my +network adapter, so it's going to do a system wide thing. It's going to find the ethernet adapter +and "Rename" it to be called "AwayNet." Just something so you can see me do something on the +computer side. + +Like I said, Endpoint Policy Manager can use not just "PowerShell" but it can use "Batch script," +"VB Script" and "JavaScript." We've got that ON script and that OFF script. + +I've already dragged and dropped this over to a file, and it's ready to go. Now we're ready to close +out the policy editor, and now we're ready to convert the XMLs into an MSI. How do you do that? +We're going to go to the "PolicyPak/PolicyPak Exporter Tool." The Endpoint Policy Manager Exporter +utility lets you "Create a new MSI installer" to then upload to your MDM service. + +Let's go ahead create those. We're going to "Add Existing Files." Here they are. I'll just go ahead +and "Open" those guys. Now at this point, you can see that the first item here is going to go to +"Users & Groups." Now I haven't declared any users. This would be for users that would be domain +joined, so in hybrid scenarios we would do that. + +Because the machine I'm going to be demonstrating on has no domain joined property, I'm going to set +it to "Computer." This is really important. This script, even though it's a user side thing, is +going to hit "All Users" on the "Computer." That's the amazing part. It's going to hit all users on +the computer. This other thing that's a system policy, it's going to rename the network card, that +is on the "Computer" side. That is on the system side, and there's no changing that. + +We'll go ahead and click "Next" here, and we'll call this "Packaged Endpoint Policy Manager Settings +for SCRIPTS." Something like that so you know what you're doing here. We'll go ahead and click +"Next" and finish it out. We'll go ahead and save it here in the same folder, and we'll call it +"PPSCRIPTSMSI.msi." There we go. There's our file ready to go. + +Let's upload it to our MDM service. The one I happen to be using is "AirWatch." Again, we work with +MobileIron. We work with Intune. We work with other ones. I've already got the "Endpoint Policy +Manager Client-Side Extension" – that's the moving part to make Endpoint Policy Manager do it's +magic – uploaded. I've got our "Licenses" uploaded. I've got some older "Settings" that are +uploaded. + +Let me go ahead and "Add Application" here. I'm going to go ahead and find the MSI file we just +generated together. Where is that guy? On the "Desktop," "PPSCRIPTS XML," here we go: +"PPSCRIPTSMSI." We'll go ahead and "Save" it. It's not a "dependency app." Okay, very exciting +stuff. + +I'm going to just zip through this whole thing really fast. This only takes a quick second here. I'm +going to go ahead and "Add Assignment" to everybody. We'll go ahead and do everybody here. There we +go. Ready to go. We'll deploy it to all computers here. + +Now this is the thing that takes a while, which is to say MDM runs on its own schedule. I've got it +deployed. It's going to everybody. If I take a look at my endpoint here, the first thing is you can +see that I am enrolled in my "AirWatch" or my MDM service. Again, it doesn't matter which one. I'll +go ahead and close that out. + +You can also see that my MDM service has deployed my "Endpoint Policy Manager Client-Side +Extension." That's the magic that makes this all go. There are the "Licenses" to light up Endpoint +Policy Manager. I'll leave this open for now. + +The last thing is that we want to see the result. The result we're looking for when the script is +finally downloaded by our MDM is service is that it's going to rename the "Ethernet" adapter and +also going to give us a shortcut. That's just a simple script that I created in previous videos. +What I'll do now is I'll pause the video. We'll come back and we'll see the result of the MDM +service. + +Okay, I've waited a while. My MDM service and my client have talked to each other, and here are the +results. The first thing is that here is the "Packaged Endpoint Policy Manager Settings for SCRIPTS" +MSI that's automatically downloaded. Again, our MDM service delivered that to us. + +And look, we have the shortcut that affects all users on the machine. I did have to hit F5 to +refresh this, but you can see the ethernet adapter has changed from "Ethernet" to "AwayNet." So it's +doing all those things. + +And here's the other best part. I'm not going to use MDM to do this part. I'm just going to do this +by hand. But what happens if the script is revoked? Let's go ahead and pretend that using our MDM +service we decide that we don't want this script anymore. I'm going to go ahead and just "Uninstall" +the preconfigured "Packaged Endpoint Policy Manager Settings for SCRIPTS" here. + +If I were to go put the password in here, watch what's going to happen here. We've removed it here, +and watch the icon disappear because we have that ON script idea and that OFF script idea. We were +able to deliver the ON script when the policy and MSI applied, and we're able to revoke that policy +with the script when the OFF script was ready to apply just like that. + +Again, no other MDM solution can do that. And again, we're not an MDM solution. We hook into and +make your MDM solution even better. I hope this helps you out and gets you a better understanding of +where Endpoint Policy Manager Scripts plus your MDM solution equals way more awesome than you had +five minutes ago. + +Thanks so much for watching, and we'll talk to you soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/pdqdeploy.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/pdqdeploy.md new file mode 100644 index 0000000000..e802cd77b7 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/methods/pdqdeploy.md @@ -0,0 +1,97 @@ +--- +title: "Removing Unwanted Windows Apps Using Endpoint Policy Manager and PDQ Deploy" +description: "Removing Unwanted Windows Apps Using Endpoint Policy Manager and PDQ Deploy" +sidebar_position: 20 +--- +# Removing Unwanted Windows Apps Using Endpoint Policy Manager and PDQ Deploy + +Once you have your applications deployed using PDQ, how do you quickly REMOVE in-box junk, +recommended, and advertised apps like Candy Crush, Windows Mail, XBOX apps and so on? +Easy. +By using Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts Manager, and a Endpoint Policy +Manager preconfigured script. + +Check out this video to see Endpoint Policy Manager instantly remove junk from the Windows 10 +desktop… in no time flat. + + + +Shane: Hey, everybody, I'm Shane. + +Jeremy: I'm Jeremy. + +Shane: What are we going to do here? + +Jeremy: Let me ask you. Do you have people who ask you from time to time, "How the heck do you get +rid of all the" – I'm not going to call it crap, I'll call it junk – "how do get rid of all the junk +that Microsoft preinstalls?"Shane: The noise? + +Jeremy: The noise, and get down to just maybe the good apps that you want instead of all the stuff +that's preinstalled. Do you get that from time to time? + +Shane: I've actually asked that. + +Jeremy: Yeah, it's very annoying. + +Shane: It was a slam-dunk in previous versions of Windows. + +Jeremy: Yeah, but now it's like all this stuff. And there are two types of packages. There are +packages that are preinstalled. Then there are packages that are suggested, and they're kind of like +almost installed. Wouldn't it be amazing if we could get rid of all that stuff all in one fell +swoop? + +Shane: Let's do it. + +Jeremy: Let's do it. We're going to leave this machine up and running here. I've actually got this +script. You can get this script from Endpoint Policy Manager.com. It's not hard to generate if you +want to do it yourself. Basically, what you're doing is you're getting an AppX package +("Get-AppxPackage"), finding its name, and removing the AppX package ("Remove-AppxPackage").We're +going to take this whole giant script. We've got like, I don't know, 90 things. Then we're going to +use Endpoint Policy Manager Scripts Manager. Endpoint Policy Manager Scripts Manager is a built-in +thing for us. We'll go to "WEB Engineers." We're going to say "PP Uninstall Junk Apps." Maybe +"unwanted apps" is probably the nice way to do it: "uninstall unwanted apps." + +Shane: Okay. + +Jeremy: Now the thing is, you could do this is a garden-variety Windows script, but then it's going +to run every time, slowing the machine down at log on. Wouldn't it be better if you could deploy it +once and never again? That's the lash-up. + +We'll go to user side, "Endpoint Policy Manager" and we'll dive down under "Scripts Manager." We'll +then right click and "Add" a "New Policy." Now here's the other part about this. You might want to +have some packages that are going to be removed, say, when you're on the sales team, but then you +want to get back some packages if you're on the marketing team. So you need an on script and an off +script. I'm not going to do the off script part, but you can use your imagination. + +Here's the on script. I'm going to use "PowerShell script," "Run script as user" and paste in all +that stuff. We're going to get rid of all these things in real time. But you can envision that +there's an off script as well, so when I move from sales to marketing I'm turning back on some +packages. I'm installing some things. + +Shane: And you have a cheat sheet right there too. + +Jeremy: Yeah, you're ready to rock. You could do it "Always." Probably overkill for what we're doing +here, but there could be a script where if the user keeps making a change over and over again, +you're going to keep changing it over and over again. "Oh, really? Who's in charge? Us or the users? +It's us." Or "Once," which is what we're going to do here, or "Once or when forced."Let's just do it +one time and never again. We'll go ahead and click on "Next" here. We'll call this "remove junk +apps," and we're ready to rock. It's just that simple. We'll go over to our endpoint machine which +has all the stuff here, and we'll watch it in real time. We'll go ahead and go to a "Command +Prompt." + +Shane: You're going to go ahead and force a GP Update, I take it? + +Jeremy: You are reading my mind. Now we're going to run "gpupdate /force," but we're going to watch +it in real time. Now it takes a second or two to kick in, but you'll know it's kicking in when all +of a sudden you're going to start seeing things fly off the Start Menu and fly off the "Recently +added" list. I see some fluttering. I see some activity. There we go. Boom, boom, boom. It's nuking +each of the things off. + +Now notice this once category we have here: "Good Apps That won't Delete." That's the kind of stuff +you'd be deploying using PDQ Deploy. In my case, I just put "Notepad" in there. You can see, using +this script, it's substantially taking away all the things that most people don't want in their +builds. And it does it one time and never again. + +Shane: Endpoint Policy Manager, baby. + +Jeremy: Here for you, guys. Thanks so much. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/_category_.json new file mode 100644 index 0000000000..89d82e3860 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips and Tricks", + "position": 30, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/bitlocker.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/bitlocker.md new file mode 100644 index 0000000000..8f1f14ebff --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/bitlocker.md @@ -0,0 +1,121 @@ +--- +title: "Implementing BitLocker through Group Policy Using Endpoint Policy Scripts Manager and Administrative Templates Manager" +description: "Implementing BitLocker through Group Policy Using Endpoint Policy Scripts Manager and Administrative Templates Manager" +sidebar_position: 60 +--- +# Implementing BitLocker through Group Policy Using Endpoint Policy Scripts Manager and Administrative Templates Manager + +If you need to encrypt your company data to protect it against prying eyes, Netwrix Endpoint Policy +Manager (formerly PolicyPak) can help configure and implement BitLocker into your existing +environment. + + + +Hi, this is John from Endpoint Policy Manager. We're going to look at deploying BitLocker. With more +and more out of the office in potentially less secure locations, protecting data from theft is of +increasing importance. BitLocker offers companies an easy cost effective way of encrypting the data +on laptops and desktops. In this video we'll look at a simple no-touch rollout of BitLocker to a +group of users using Endpoint Policy Manager Application Template Manager and Scripts Manager. + +Other than a reboot, the user doesn't have to do a thing. There are two assumptions. One, you must +be using a compatible version of Windows. Two, the TPM or Trusted Platform Module chip must be +installed on the computer. Let's take a look at the work station here. + +I'm logged on as a standard user. I have no administrative rights, except I've opened up +administrative command line just so I can check on the status of the BitLocker implementation. If we +take a look, we can see that BitLocker is not installed. It is fully decrypted. Protection is off. +There are no key protectors. Everything is standard computer. + +Let's go to our admin server. I've got the GPMC open here. Here's my OU that my computer belongs to. +I'm going to create a group policy object inside here. I'll right click, create a GPO in this +domain. We'll just call it BitLocker Demo. + +Let's go in and Edit. On the computer side we're going to expand Endpoint Policy Manager. We're +going to click on Administrative Templates Manager. We're going to create a New Collection. A +collection is there to kind of combine all of our policies together in one. + +I can spell BitLocker Configuration. If I had multiple configuration options that I need to employ, +different groups based on security groups are based on computer types where there's laptops, +desktops. I can go in here and add some item level targeting to target those groups and create +different collections for those different groups. + +Right now I'm just going to create one. I'm just going to go inside here, create a New Policy. Now +I'm going to expand Windows Components, BitLocker Drive Encryption. The first thing I'm going to do +is I'm going to Restore BitLocker Recovery Information in Active Directory. I'm going to Enable +this. I'm going to Require BitLocker to Backup to the Active Directory, and I'm going to Recovery +Passwords and Key Packages. + +Click OK. I'm going to add another one, so Windows Components, BitLocker Drive Encryption. I'm going +to choose Drive Encryption for Windows 10. Enable this. By default it's at 128. That may be fine, +but I want to upgrade it a bit; XTS-AS 256 for the operating system. For any local drives same +thing. + +If I'm going to do any removable drives, the best practice is to use AES-CBC. It's the driver we use +in any other devices that are not running Windows 10 Version 1511. Click OK. Click Close, and I'm +done here. + +Now I come on down to Scripts Manager. Add a New Policy. There's only one script here, so I don't +need to create a collection, though I can still add item level targeting if I wanted to or if I +needed to. Apply to computer policy. I'm going to put a Batch Script. I have a Batch Script copied +here. + +Paste, there we go. This is going to turn the BitLocker on. I'm going to encrypt the system drive. +I'm going to encrypt just the used portion of the system drive, not the entire drive, though that is +an option if you wanted to do that. + +There are many other options as well for managed VDE switches. You can take a look and see what you +need for your environment or you want to use. For a basic installation, this is all that's really +required. Click on Next. + +If it comes where I no longer want to encrypt the drive, they're moving to a different environment +that requires different encryption, different options, or they're just leaving the company and +they're no longer part of this GPO, we have a revert script that will actually remove BitLocker from +the machine. It will just turn it off on the system drive. Again, I can specify any drive I want +here as well. For now, for this demo, we're just going to do the system drive. + +Click on Next. I don't want to always employ this. Once you enforce, you want to be a little safe, +so you have that option of doing GP update/force. This will also cause this to run. One should be +sufficient for you. + +Name of policy, so BitLocker Script, very descriptive. That's enabled. Again, I can add Item Level +Targeting here if I had multiple scripts designed for different environments. Click Finish, and I'm +done. + +Come over here back to my work station. Now I'm running GP update just to force the hands of time a +little bit. When the user either logs in, this is going to be implemented or just during the course +of the day when GP update runs in the background, it's also going to get employed. I can see over +here it's telling the user that the encryption has begun, but the computer needs to be restarted in +order for this to actually take effect. They don't have to do anything right now. They are not +forced to do anything, but it's an option if they wanted to do it. + +If I go here, I can see that now BitLocker 2.0 is installed. It's still fully decrypted, 0% +protection is off. The key protector is installed here. The TPM module is being used to store the +encryption password. It's also saying here that you need to reboot the computer for this to take +effect. + +They can either do it now, wait until the end of the day, do it at lunch. The choice is yours or +theirs. I'm just going to restart now. When we come back, this will be fully rebooted and logged in. + +Now my computer is rebooted. I can open up the command line again. I'm going to take a look at the +status now. We can see encryption is in progress. It's 70% done. + +Encryption method is XDC-AES 256. We're good to go. In a few minutes this will be completely +encrypted, and it's done. The user didn't have to do anything other than reboot the computer, which +they're going to do at the end of the day anyways. + +Let's check on the status again; 83%. Let's wait a few minutes. We'll check back in when it's 100%. +We checked back in now. We checked on the status. It is 100% encrypted. + +Now the computer is leaving the OU for whatever reason. We no longer want to employ BitLocker. We're +going to unlink the GPO from this OU and thereby from this computer. We're going to run GP update, +accelerate the hands of time a little bit. + +Now what's going to happen is the reverse script is going to kick into action. It's going to start +decrypting the data that's there, and it will be back to the way it was before we employed +BitLocker. That's done. It started. We'll check on the status now. + +You can see the decryption is in process. Percentage encrypted is down to 26.1%. We'll check back in +a couple minutes when it's all done. Let's see where we stand now. + +It's at 0%. BitLocker version is at none. It's fully decrypted. No key protectors. It has been +successfully uninstalled. Thanks for watching. Have yourself a great day. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/chocolaty.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/chocolaty.md new file mode 100644 index 0000000000..5912304376 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/chocolaty.md @@ -0,0 +1,137 @@ +--- +title: "Endpoint Policy Manager Scripts: Automate Software deployments with PP Scripts and Chocolaty.org" +description: "Endpoint Policy Manager Scripts: Automate Software deployments with PP Scripts and Chocolaty.org" +sidebar_position: 10 +--- +# Endpoint Policy Manager Scripts: Automate Software deployments with PP Scripts and Chocolaty.org + +Want a quick way to deliver applications to your end users without having to bring up a server +infrastructure? Got remote workers and don't know how to service their software? Hook Chocolaty into +Netwrix Endpoint Policy Manager (formerly PolicyPak), and... bingo. You're done. Remotely install +just about any pre-packaged software from Choco's repository. And use Endpoint Policy Manager +Scripts to install or un-install. Couldn't be simpler. + + + +Hi, this is Jeremy Moskowitz and in this video, we're going to talk about automating remote +installation of software from Chocolaty.org using Endpoint Policy Manager. Now what I'm about to +show you works across all of the Endpoint Policy Manager platforms, either the Group Policy edition, +the MDM edition, or the cloud edition, I'm just going to show you the Group Policy edition, but it +all works exactly the same. If you don't know that Chocolaty.org, it's a bunch of applications that +are pre-packaged and ready to rock. I've got the screen up here demonstrating their policy here that +describes that each of the packages kind of goes through a quality check with a human that verifies +it and goes through Virus Total and so on. That's pretty good. Of course, it may not be a perfect +system, but I just want to put that out there and show you how I like to use it. + +Anyway, the point is that they have literally thousands of packages that you can choose from to +actually deploy, and I'm going to show you how to do it using Endpoint Policy Manager, but I want to +do a little walk before I run test, as I do in lots of my videos. I'm going to just show you how +Chocolaty works without Endpoint Policy Manager first and then we're going to add Endpoint Policy +Manager to it second. + +So the first thing I'm going to do is I'm going to just run an ad admin PowerShell. This is +administrator. Now this administrative PowerShell. The first thing I want to do is I want to take +the Install Chocolaty commanded, which is a one-liner, that puts the Chocolaty guts in place. Hint, +hint, we're going to do this exact same thing using Endpoint Policy Manager in just about three +minutes from now. I just want to zip through that. There you go. You can see that the Chocolaty guts +are kind of getting installed as we speak and we'll kind of just give that a second to to finish up. + +Then the second thing I want to do is try to install my first Chocolaty package. Now if you look at +the packages list, really, it couldn't be easier. You look at the package name and they give you the +command, and you copy and paste it in, and you're off to the races. Now, if you want to go one +little micro step further, there's a little bit of extra goo you can put on the end of a command +like the command can be --force and also force dependencies. So for instance, if I wanted to do +7Zip, which I already have here, so what I could do is I could take this lock, stock, and barrel or +I can paste in Choco Install, 7Zip install, --force, --force-dependencies-yes-yes. That's a lot of +dashes. The point is that this will forcefully do any kind of requirements behind the scenes that +maybe the package won't do naturally. By the time this is over – again, this is a walk before you +run with Chocolaty part first. By the time you're done, hey, look at that, 7Zip File Manager didn't +exist ten seconds ago, and it exists now. Look at that. It runs. + +Now that we we've done the walk before we run test, now, it's time to do this all on Endpoint Policy +Manager land. What I'm going to do is I'm going to pause the video and revert back to before the +time that I had Chocolaty. Hang tight for a second. Okay, I'm back and I've reverted this machine +back. It ain't got no Chocolaty on it. So now we're going to do is we're going to go to our – this +is my management station here. I was actually play with this earlier, so I'm not going to use any of +those. I'm going to start from scratch, so what I'm going to do is create a new GPO and link it to +my users. Again, you can do this on the computer side as well. Again, you could do this in Endpoint +Policy Manager Cloud. You can take what we're about to do here and export it for wrapping up to MDM. +I'm just keeping it simple, and I'm going to do PPChoco Demo. + +I've got my Chocolaty demo GPO. It's linked over to my east sales users and I'm ready to make a +little bit of magic. Now remember, the steps – the first step is I got to get the Chocolaty guts +deployed to either the computer side or the user side. Remember, how do we do this? We could only do +it when it was running with admin rights, ha ha. Well, Endpoint Policy Manager's Scripts Manager has +a secret superpower which we're about to use. If we go to Add a New Policy here, we'll then take +take that script that was on the Chocolaty website, which is just the the getting going started gut +stuff, and we'll take that PowerShell script and just paste it right in lock, stock and barrel +running it as a user but with elevated rights. That's the magic, so we can just kind of get that +running underneath the hood. We don't need a revert action and we only need to run this one time. +Once it's done, we're off to the races. So we'll call this Install Choco's guts and we're done. + +Now the next thing is all about the applications. So we can add a new policy here and maybe what +I'll do is I'll just add a new PowerShell script and I'll go ahead and do that same 7Zip install. +Choco install 7Zip.install, which I got right off the website. Then I'm putting in a -force and the +-force dependencies and the –yes, once again running with elevated rights. Now that's the apply +action. Maybe sometimes you want to say goodbye to that app. How do we do that? Well, that's the +revert action, and that command is Choco uninstall 7Zip.install --yes, which means quiet in the +background and so on. I'm also going to run that thing with elevated rights. I'm going to just run +this one time and that's it. + +If I were to do a 7Zip install and uninstall, I'll show both of these. I'll also do maybe one more +for good measure, so if I were to make a new policy here, something a little bit bigger – I'll do +Filezilla, which is actually a slightly longer download process. If I were to go to PowerShell +script – ooh, that's the uninstall for Filezilla. I need to grab this string for install. Bingo, so +Choco install Filezilla force, force dependencies, yes, and then do it with elevated rights. Then +the revert action would be, again, a PowerShell script take Filezilla and do Choco uninstall +Filezilla -yes yes yes. We'll run that with elevated rights and what we'll say here is once again +once and then we will say "install/uninstall Filezilla." + +Now again, you could wrap this around item-level targeting, and you could say do this thing when I'm +on this IP range. For instance, when I'm in the office, install Filezilla. When I am out of the +office. Uninstall Filezilla. This totally works. You could also target it if you wanted to when it's +a particular name of a machine, so only deploy this when the computer name is a match or not on VDI +or whatever your scenario is. It totally works. I'm not going to do that not, just doing a quick +download here. + +Now what we'll do is we'll go back over to our machine I'm already logged on. I don't have +Filezilla. I don't have WinZip, and I don't have the Choco guts. What I'm going to just do is run GP +Update and then take a minute break. It doesn't take too long. It does have to get through all them +first. Once it does, it downloads it directly from the internet. Now Choco has got its own internal +servers that you can set up if you want to. You don't have to use the common repository out on the +internet if you don't want to, nor can you, I think, if you're trying to do lots, and lots, and +lots, and lots of installs. You can set up your own repositories, but this is just a quick, simple  +way for me to demonstrate to you that you can use Endpoint Policy Manager scripts to automate the +software delivery of your packages to your target machines using Chocolaty if that's what you wanted +to do. + +There we go. That was it. So you can see 7Zip and Filezilla. We could just go ahead and click it +here and there we go. 7Zip launches and if we were to go to Filezilla here, give that a second, +boom, there you go. If you wanted to be fancy, of course you could use Endpoint Policy Manager Start +Screen and Task bar Manager or File Associations Manager as well, and you can guarantee that the +icons are correctly in the right place here and in the task bar and also the file associations. +That's easily done. I'm not going to do that here. + +The last thing I do want to, however, show is the uninstallation of these things, for instance, like +I said, if you are not in the office or the guy moves from sales to marketing or something like +that. I'm just going to unlink the GPO. If this were an MDM or a Endpoint Policy Manager Cloud +policy, the exact same thing would happen. The policy would simply update in the background. We'd +get the signal, and that signal we said is on revert, perform the Choco Uninstall of both 7Zip and +also Filezilla. We'll just give this a second to catch up and then we're not removing Choco's guts. +Remember that? We're simply removing the actual applications that we specified If we just wait a +minute or two, what we should see is that those applications should just peel right back. + +Alright, so now that GP Update has been run, we just have to wait a minute or two for it to kick in. +What we're expecting to see here is when we go back to the Start menu here, what we're looking for +is that Filezilla is removed from F. Yep, that's gone, and 7Zip should be also removed here, too. +There we go; we can see that it's out of the recently deployed list because now it's recently +obliterated. + +\ + +That's all there is to it. you can use Endpoint Policy Manager scripts to deliver the Choco guts, +the Choco install, and have a revert script that'll perform the Choco uninstall. I love this +solution I think it really helps out and gives you the ability to deploy software really quickly to +your endpoints no matter where they are. If they're working from home or whatever using Chocolaty. +Hope this helps you out. Looking forward to getting you started with Endpoint Policy Manager real +soon. Take care. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/customdefaultfileassociations.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/customdefaultfileassociations.md new file mode 100644 index 0000000000..04aa3a239b --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/customdefaultfileassociations.md @@ -0,0 +1,34 @@ +--- +title: "Policy Scripts Manager: Set Custom Default File Associations in Windows 10" +description: "Policy Scripts Manager: Set Custom Default File Associations in Windows 10" +sidebar_position: 30 +--- +# Policy Scripts Manager: Set Custom Default File Associations in Windows 10 + +How to apply custom default application associations to Windows 10 using Netwrix Endpoint Policy +Manager (formerly PolicyPak) Scripts Manager. + + + +Hi, this is David in Endpoint Policy Manager tech support. In this video I'm going to show you how +to apply custom default application file associations using Endpoint Policy Manager Scripts Manager. +If you're missing any applications needed for your custom file associations, you'll need to install +those before continuing. If the necessary applications are already installed, then it's time to set +up your custom file associations. + +Now that our custom file associations are set, the next step is to use PowerShell running as +administrator to export our custom file associations to the XML file. Next we're going to grab the +XML file containing our custom default file associations and copy it up to a network share that's +accessible to all users who need to receive these settings. With that done, we're going to head over +to our computer running the Group Policy management console and create the Scripts Manager policy, +which will distribute this policy to our users. + +We're going to create this policy on the user side since we want it to apply to our users and not +the computer. Be sure to select PowerShell Script from the dropdown and to also uncheck the Run +Script as User option at the bottom of the screen. That's it. Our policy is all ready to go. The +only step remaining is to test. + +Here I'm logging in as EastSalesUser1, who is one of the users who should be receiving this policy. +There you have it. Everything is working as expected. I hope that you'll find this video helpful and +informative. If you have any questions, please ask in our forums under the Scripts Manager forum. +Thank you. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/printers.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/printers.md new file mode 100644 index 0000000000..997e353216 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/printers.md @@ -0,0 +1,119 @@ +--- +title: "Shared Printers without Loopback: Use Endpoint Policy Manager Scripts and PowerShell to deploy and remove printers" +description: "Shared Printers without Loopback: Use Endpoint Policy Manager Scripts and PowerShell to deploy and remove printers" +sidebar_position: 50 +--- +# Shared Printers without Loopback: Use Endpoint Policy Manager Scripts and PowerShell to deploy and remove printers + +Hate using loopback for printers? Then DONT. Use Netwrix Endpoint Policy Manager (formerly +PolicyPak) Scripts manager to do "loopback without loopback." In this demonstration we'll show you +how to ADD a shared printer to every user who logs onto a machine... just like loopback. With +Endpoint Policy Manager, its easy. Here you go ! + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can deploy shared +printers without loopback using Endpoint Policy Manager Scripts Manager. You're going to have to do +a little walking before you run here, and you're going to open up a command prompt with PowerShell +as a standard user, doesn't have to be an admin or anything, and you're going to just run your test +commands first to make sure they work. + +The first one you're going to do is add-printer -ConnectionName against the server and the printer, +so mine is \\dc2016\printer1. When I do this, you can see there it is. Printer1 comes along. Now if +this – this might take a minute the first time because it takes a little while for those drivers to +come down, so because I did this demo for practice before the video, those drivers were already +here, so mine is going to look a little bit faster than what you're going to see in your real life. +Just count to 60, and they'll get there. Don't worry. + +The next thing you want to try to do is to do the remove printer. It's typically the same exact +thing, it's just remove-printer -name quote and then the name of the printer so \\dc2016\printer1. +If you're not sure, okay, there's another way to verify that. If you do a get-printer, it'll show +you all the names here, so let me go ahead and just readd that printer one more time just to show +you what the names look like once you're added. You're going for this string for the remove line. +That's how you test it out. You do an add, you do a remove, and you make sure you've got it ready to +rock. Once you've got it ready to rock, then what you're going to do is get started in Endpoint +Policy Manager Scripts Manager. + +Let me pause the video and go over to my management station. Okay, here I am now in my management +station, and again, the idea is to do shared printers without loopback, so that means to every +computer – every user who logs onto a particular set of desktops. What I'll do here, for my East +Sales users I'll do PP Scripts No LOOPBACK Shared Printer. Now what we'll do is we'll right click +and click Edit here, and then we'll dive down under the computer side – that's where loopback +happens on the computer side, even though we're going to do no loopback. We'll then go to Scripts +Manager here, right click Add a New Policy here. I've got my PowerShell that we had from the first +part right here just in NotePad hanging out ready to go. + +What we'll select here is "Apply this policy to all users who log on to the computer (switched +mode)". Switched mode is our loopback without loopback thing. All users who log on to the computer. +The apply action would be to get the printer, and that's a PowerShell script, and then we'll go +ahead and take the printer command that we learned in the first step and bang. Just put it right +there. The script can be run as user. It doesn't need to be elevated. It doesn't need to be run +interactively. You just throw that in there. + +Then the next thing you're going to do is called the revert action. We know what that is. That's the +remove printer script that we learned earlier, so go ahead and take that. That is the PowerShell +script here. We'll bang that in there, and that's remove printer. Again, run as a user. Doesn't have +to be elevated. Doesn't have to run interactively. That's all you got to do. You can set this to +apply Always, which is probably the right idea, so every time group policy processes, you're +evaluating and seeing if you need this thing, and if you do, boom, put it on. If the user nukes the +printer, it'll put it back, so I suggest Always for this kind of a script. + +Then what we'll do is we'll call this Get DC printer1 script and then this is your choice about +item-level targeting about when you get the thing when you don't get the thing. You might want to +get this thing when you are on a portable computer but not on a portable computer. You might want to +get it when you're in a Security Group or not in a Security Group. You might want to get it when +you're on an IP range and not get it when you're not on an IP range. That's why you have the apply +script and the not apply script. + +We can still do this by simulating what happens if somebody – what we can do is add in a Security +Group here. User is a member of East Sales users, so we're saying this will apply when the guy's +East Sales user, and it'll revert back or unapply it when the guy's not a member of East Sales users +anymore. How are we going to simulate that? Let's go ahead and find out. Let's go ahead and do that. +We're going to get the printer when we're a member of East Sales, and we're going to remove the +printer when he's not a member of East Sales. Why don't I go ahead and show you this what happens. +Let's go ahead and sign out and sign back on because this'll be the experience of what all the users +would be. + +If I were to log on as eastsalesuser1 – okay, let's go ahead and check this. Now we've got to hustle +over to the printer, Printers & scanners, and let's see what happens. Boom, it's already there. +Alright, now what I want to do is I want to log off. That worked out great. Now what I want to do is +log off, sign out here, and I want to sign on as eastsalesuser2 who's also a member of the East +Sales group. Let's go ahead and do that, eastsalesuser2. Remember, this is loopback without +loopback. We're just dictating these settings. We don't care who logs on the machine. We are +limiting it here with item-level targeting to say you must be part of the East Sales users group in +order to get it, so let's see what happens for Mr. eastsalesuser2. Alright, let's hustle over to +printers here, Printers & Scanners. It's probably going to beat us and get there before we do. Yep. +There we go. There's printer1 on dc2016. + +Now what I want to do is I want to be a little naughty, and I want to take the guy out. I want to +take eastsalesuser1 out of the East Sales users OU – group, rather. Let me go to users. That's not +where it is. Let's go over here to East Sales, East Sales users. I've got a group here, and I'm +going to remove Mr. eastsalesuser1 here, and when I do this, this is going to make this GPO fall out +of scope. In other words, it's not going to apply to Mr. eastsalesuser1 anymore, remember. We said +that this policy will only take effect when the person is part of the East Sales user Security +Group, and as such, now what we should see is that it's going to run the remove script. It's going +to run the off script, and therefore remove it. + +This is great. This can enable you to do all sorts of great things like one of a member of a group +or on this IP range or any number of things. If I were to go back over to printers here, what should +we see? Let's go ahead and give this another try. Let's go ahead and log out here and log on one +more time. Endpoint Policy Manager will do a caching of the item-level targeting evaluation, and so +because I'm going so fast, it might actually remember this group membership even though it's not +actually true. We'll give it a minute, and then we'll try again. + +Here we go. Alright, let's hustle back over to printers here. There we go. We just had to – like I +said, we had to wait a minute because Endpoint Policy Manager will cache the item-level targeting +filters, but you can see the guy's not in the group anymore, and we ran the off script and you're +off to the races. A little troubleshooting stuff here. Because we're doing switched mode, let me +just show you where this would live for the logs if you want to take a look at logging. If you go to +the users profile under AppData\Local – AppData\Local\PolicyPak, that's where it is, +AppData\Local\PolicyPak. Under Scripts Manager what you're looking for is ppswitched at logon or +policy changed. + +Generally, the latest file data's the one you're after. Take a look at ppswitched log here. What +you're going to see is you'll see it apply and unapply, so you can see getting the thing, boom, +script is run successfully, and then if we want to go to the bottom here looking for the unapply +one, last thing, here we go. "Item-level targeting evaluated to FALSE", and therefore, because of +that, we're going to run the off one. Hopefully this gives you a little bit to go on here, and +hopefully this video helps you out. You could do shared printers without loopback on the computer +side. Hope this video helps you out. Thanks very much. Talk to you soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/unwantedapps.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/unwantedapps.md new file mode 100644 index 0000000000..1396dc5907 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/unwantedapps.md @@ -0,0 +1,14 @@ +--- +title: "Removing Unwanted Windows Apps Using Endpoint Policy Manager Scripts & Triggers Manager" +description: "Removing Unwanted Windows Apps Using Endpoint Policy Manager Scripts & Triggers Manager" +sidebar_position: 40 +--- +# Removing Unwanted Windows Apps Using Endpoint Policy Manager Scripts & Triggers Manager + +Once you have your applications deployed, how do you quickly REMOVE in-box junk, recommended, and +advertised apps like Candy Crush, Windows Mail, XBOX apps and so on? Easy. By using Netwrix Endpoint +Policy Manager (formerly PolicyPak) Scripts & Triggers Manager, and a Endpoint Policy Manager +preconfigured script. Check out this video to see Endpoint Policy Manager instantly remove junk from +the Windows 10 desktop… in no time flat. + + \ No newline at end of file diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/windows10prolockscreen.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/windows10prolockscreen.md new file mode 100644 index 0000000000..4649650b67 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/tipsandtricks/windows10prolockscreen.md @@ -0,0 +1,72 @@ +--- +title: "Replace the Windows 10 PRO Professional Lock screen" +description: "Replace the Windows 10 PRO Professional Lock screen" +sidebar_position: 20 +--- +# Replace the Windows 10 PRO Professional Lock screen + + + +### PolicyPak Scripts: Replace the Windows 10 PRO Professional Lock screen + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Netwrix Endpoint Policy Manager +(formerly PolicyPak) Software. In this video, I'm going to show you how you can use Endpoint Policy +Manager Scripts Manager to change the Desktop background on Windows 10 Professional. + +As you may or may not know, there's a policy setting that does this on Enterprise and Education, but +there's no easy-peasy way to do this on Professional except if you've got Endpoint Policy Manager. +So what you can do is use Endpoint Policy Manager Scripts Manager ("PPSCRIPTS to change wallpaper") +to force the wallpaper you want on Professional ("Force wallpaper on Pro"). + +My lash-up for this is that I already have a wallpaper in a share. I've got it called "dc2016share," +and it's called "wallpaperHD.jpg." That's the only thing you need to know. We're going to supply the +script for you. + +Let me show you what the GPO looks like here. Again, I'm linking it to my "East Sales Desktops" +here. Actually, what I can do is "Delete Policy" and start over so I can show you how the policy is +created. What I'll do is just right click, "Add" a "New Policy" here. + +Again, this is on the computer side, so your computer has to be in that OU. I want to "Apply this +policy to computer." That's what I want to do. I want it to apply to the computer, and then all +users are going to pick this up. So that's what I want. + +I'm going to make this a "PowerShell script." Again, we supply the script, so I'm going to copy and +paste it in here for you. The only line you need to change is the "Path" to your wallpaper. If it's +over the network, that should be fine for most cases. If you need to copy it locally first, you can +do that also. Maybe you put it in C:temp or whatever first. And that's it. You're ready to go. So +I'll go ahead and click "Next." + +This would be an "On revert action." I don't want to specify anything on revert. I'm going to set it +to just go "Once." Once it's set, I'm good to go. I don't see any reason why I need to make it +"Always" apply over and over again. "Once" seems like enough. I'll call this "Force wallpaper on Pro +without GP setting." + +And don't forget we also have this amazing "Item Level Targeting" idea where you can say only do +this when the condition is true. Maybe when the "Operating System" matches "Windows 10" +"Professional" version. Maybe you only want this policy setting to hit your Windows 10 Professional +machines. That would work. You could also say when the machine's "Computer Name" is the lab +machines, like "\*lab\*" or something like that. So now when these two conditions are true, that's +when this thing is going to fire off. + +I'm not going to do that now, but that should give you some ideas of where you could use item-level +targeting. I'll go ahead and click "Finish." That's all there is to it. Here we are on our machine, +and I want to show you what the typical example might look like for a user. + +What I'll do is just go ahead and click and log on here. The user's going about their business, +having a good day and so on. We'll go ahead and let them finish logging on here. Okay, now that +they're finished logging on, nothing really changes for them because we're not talking about their +Desktop. Their Desktop is easily changeable using Group Policy, and we're not trying to solve that. + +See this little flutter of activity? You see that little circle going on? That's it. It's doing it +right now as a one-time action, kicking in and doing the work. And that's it. It's done. It happened +silently in the background. Nobody knew anything. But now when they log off, let's see the magic. +Let's go ahead and "Sign out" here. + +From this point forward, every user gets the exact same beautiful Desktop background that you want. +That's it. Using Endpoint Policy Manager, coming to the rescue again, saving the day for admins who +are using Windows 10 Professional. + +Hope this helps you out. Looking forward to getting you started with a trial real soon. Talk to you +soon. + +Thanks so much. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/_category_.json new file mode 100644 index 0000000000..31597950e7 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Triggers Examples", + "position": 40, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/anyconnect.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/anyconnect.md new file mode 100644 index 0000000000..5397fa6f50 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/anyconnect.md @@ -0,0 +1,56 @@ +--- +title: "Endpoint Policy Manager Scripts and AnyConnect: Run a script after you connect via VPN" +description: "Endpoint Policy Manager Scripts and AnyConnect: Run a script after you connect via VPN" +sidebar_position: 60 +--- +# Endpoint Policy Manager Scripts and AnyConnect: Run a script after you connect via VPN + +Got Cisco AnyConnect? And want to make a specific script run ON connect and another script when the +VPN disconnects? If yes, you're gonna love this ! + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can run a script like +map a drive or map a printer or clean up the computer, whatever you want to do, on Cisco AnyConnect +VPN connection. This is part of Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts and +Triggers. To get started, you should probably have the script that you want to do beforehand. When I +connect over to my any VPN, I don't have a lot going on over there, so I'm going to do it locally, +but it should give you the idea. By way of example, here's a folder called temp2. Let's say when I +connect, I want to do echo aaa >> c:\temp2\a.txt and hey, look at that, I made a file called a.txt. +Then on disconnect, maybe I want to delete c:\temp2\a.txt. Now, basically, what we're saying is that +this is going to be my on script, and this is going to be my off script. + +You should make sure your script works before you go to the next step. What we'll do is we'll go +over to group policy land. You can do this in Endpoint Policy Manager Group Policy, you can do this +Endpoint Policy Manager MDM, you can do this in Endpoint Policy Manager Cloud. It doesn't matter. +What we'll do here is we'll get started in the VPN editor here – I'm sorry – in the Endpoint Policy +Manager Scripts Manager here, and what we'll do is we'll right click Add a New Policy here. What +we'll do is we'll use any kind of script. You can use PowerShell, Batch, VB, whatever. I'm going to +use Batch just to keep it simple here. + +Like I said, I'm going to take – I'm going to use echo aaa >> c:\temp2\a.txt. That's going to be +what happens when we connect. Now there is no revert action. I'll show you how to do a revert action +in a second. The trigger that we're looking for is VPN connect. You don't have to specify Cisco +AnyConnect. We'll just know that that's what you're using. You can specify a particular server or +any server. I'm going to put a \* for the wildcard in here, and then that's it. That's the on piece. + +Now let's go ahead and do the off piece. The off piece would be – we'll make another Batch script, +and we're just going to delete c:\temp2, just like that, a.txt. Then we're – no revert action here. +We're going to say on the trigger of VPN disconnect – ah ha, that's the thing, and any kind of +server. We'll go ahead and say \* here as well. This will work for your Cisco AnyConnect or any +other supported one as well. That's it. Let me go ahead and show you what's next. + +Now back on the client, we'll do a quick gpupdate. We'll give this a second to catch up. I've got my +Cisco AnyConnect ready to go over here, and just to make sure I'm not pulling a fast one on you +here, you'll see I've got in the temp2 folder, no file, so let's go ahead and click Connect here. +I'll put in my credentials when I am prompted. Give this a quick second. We've established our +connection and so on, and let's take a look. Great. There's our file. On Cisco AnyConnect, we ran +the script. Now let's go ahead and do a disconnect here. Let's go back to Cisco AnyConnect, and +we'll click Disconnect. Now that's over, let's go ahead and check it out. + +If we go back to the temp2 folder, boom, no more file. Just like that, you were able to figure out +whatever script you want in advance, do a quick test drive by first make sure that works. Once +you've got it all set, bring it in to Endpoint Policy Manager Scripts with the Trigger function, and +you can have a nice on script and a nice off script, and you are off to the races with Endpoint +Policy Manager and Cisco AnyConnect. Hope this video helps you out. Looking forward to getting you +started with Endpoint Policy Manager real soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/events.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/events.md new file mode 100644 index 0000000000..6c69a68222 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/events.md @@ -0,0 +1,50 @@ +--- +title: "Endpoint Policy Manager Scripts & Triggers: Events !" +description: "Endpoint Policy Manager Scripts & Triggers: Events !" +sidebar_position: 70 +--- +# Endpoint Policy Manager Scripts & Triggers: Events ! + +Use the Event Log to trigger when any kind of scriptable event should occur. + + + +Hi, this is Jeremy Moskowitz. In this video I'm going to show you how you can use Netwrix Endpoint +Policy Manager (formerly PolicyPak)'s Scripts & Triggers Manager to set off any kind of script you +want when any kind of event happens in the Event Viewer. I'm going to do kind of a goofy example. +I'm going to say when you run GP Update and it's successful on the user side, then open Notepad. Not +a great example, but good for our learning. + +In real life, you might have an event that writes the event log when your VPN connects. When you do +that, then you can run a log on script or something like that. We can also do that if we have +support of VPN. If you don't, this is a good option. + +You can also do it any time anything else happens in the event log. I'm just going to use mine as an +example. Again, my example is when I look at the system events and I look for Event 1503, that means +user was processed successfully in Group Policy land, and I want to kick off Notepad. We need to +keep a few things in our head. + +We need to know that it's Event 1503, that it's the system log, and it's the Microsoft Windows Group +Policy Source. What we'll do is we'll create a new – we're here in the Group Policy Editor. Go to +Desktop Automation Pack and Scripts & Triggers Manager. We'll go to New Policy here. + +I'm going to have a new Batch Script, which is going to start Notepad.exe. I want to do it as the +user and interactively. Start Notepad. Then what I'm going to do is say my Trigger is the Event Log. +The Event Log I want, the source is going to be the Windows System Log. Then you click out. + +Then you pick the type, which is Microsoft Group Policy. You're going to go Microsoft Windows Group +Policy. Then you click out. We're saying this log, this source. You don't pick the [01:46] button +here. You pick the first log and then you pick the source second. + +Then if any of these fire off, that would do the thing, or you can pick the Event ID, which is in my +case 1503. It's the only event that I want. We'll go ahead and click Next here. This is the query +that we're establishing. Then we will check it out. That's all there is to it. + +We'll leave the Event Viewer open just for a second. I'll go ahead and close out these guys here, +just doing some sample test before. Now we can just run GP Update here. Let's go ahead and see what +happens. On Group Policy Update, provided the user side completes, there we go, Notepad. + +With that in mind, this gives you the opportunity to look for any kind of event you're looking for +in any Event Log. When it happens on the client machine, do a complex action or a simple action. I +hope this video helps you out. Looking forward to getting you started with Endpoint Policy Manager +Scripts & Triggers real soon. Thanks so much. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/lockunlocksession.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/lockunlocksession.md new file mode 100644 index 0000000000..3c7c4946b4 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/lockunlocksession.md @@ -0,0 +1,63 @@ +--- +title: "Endpoint Policy Manager Scripts + Triggers: Perform actions at LOCK and UNLOCK of session" +description: "Endpoint Policy Manager Scripts + Triggers: Perform actions at LOCK and UNLOCK of session" +sidebar_position: 30 +--- +# Endpoint Policy Manager Scripts + Triggers: Perform actions at LOCK and UNLOCK of session + +In this demo you'll see how to use Session Lock and Session Unlock trigger types with Netwrix +Endpoint Policy Manager (formerly PolicyPak) Scripts. It's easy to do ! Pre-test your script first, +then you're off to the races. Remember which processes require RUN INTERACTIVE though! + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can use Endpoint +Policy Manager scripts and triggers to fire off activities when the session is locked and unlocked. +Now you should practice what you're doing to do before you jump into Endpoint Policy Manager scripts +and triggers. In this simple example, I'm going to start a process, Notepad, when I unlock the +computer, and I'm going to kill all Notepads when I lock the computer. I'm going to start when I +unlock and I'm going to kill all Notepads when I unlock. + +Let's try this out one by one. If I were to have a Notepad already running here – in fact, if I were +to have multiple Notepads here just to prove a point, I can run PowerShell as a standard user here. +It doesn't have to be PowerShell, by the way; you can do the same thing with Batch Files or +whatever. If you wanted to see what happens if you stop the – if you were to run the PowerShell +command stopprocessnotepadforce, bang, you can see that that worked. If you wanted to see that +starting a process, Notepads works with this script, startprocess, C windowsnotepad. Bang, you can +see that that works. + +Now that you've pretested your scripts, you're ready to go into group policy land and of course, +this works as well, perfectly well, in MDM or Endpoint Policy Manager Cloud. I'm just using group +policy in my example here. I do "PP scripts and triggers with lock and unlock." If I were to dive in +here and click Edit, what I'll do is I'll go to the users side here and then you could go to Scripts +Manager, and then right-click Add a New Policy here. What we'll do – again, I'm using PowerShell +scripts but you don't have to. You can use Batch or VB for Javascript. I'm going to use PowerShell +here and I've got the same script hanging out right here. + +What I'm going to do is kill all Notepads on lock, so bang. This script does not have to be run +interactively because soon as you hit lock – there's no output to the screen, so it doesn't have to +be run interactively. There's no revert action here required for scripts. Then the trigger that we +said that we want is going to be at session locked. That's when we're going to nuke these things. +Session lock trigger policy, that's good enough for now. + +Now let's create another policy here for the other guy, so let's go to PowerShell script, and now +we're going to start process on unlock. There's the start process for Notepad. Now this does have to +be run interactively because this is going to throw something out on the screen. Now this is going +to throw a little micro PowerShell blue for a second. If you don't like that, you can probably get +away with Batch script or one of the other scripts. I'm just using PowerShell for whatever reason. + +There's no revert action here and again, this is going to be on the trigger of the unlock. That's +it. We're ready to rock, and we're ready to test it out. Let's go back over here. We'll run GP +Update, give this a second to catch up. Alright, now that we've got all this, let's go ahead and run +a couple of Notepads just to get started and we'll go ahead and get another one up and running here, +bing, bing, bing. Alright, so again, we're just testing out the trigger mechanism. + +What we want to do is hit Control-Alt-Delete and lock and when we do that, what do we expect? We +expect that those two Notepads are obliterated and now let's go ahead and unlock and what should we +see? We should see that one new Notepad show up here. There we go. We can see we've only got the one +Notepad session here and if we were to lock again – okay, lock, bang, it's obliterated in the +background. Of course, we can't see it. Now if we unlock, bang, we put it back on. + +Endpoint Policy Manager scripts and triggers enables you to at session lock or unlock time, do some +superpower magic and hopefully this example will give you some great stuff for your imagination. +Hope this helps you out. Looking forward to helping you get started real soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/mapdrivetriggers.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/mapdrivetriggers.md new file mode 100644 index 0000000000..3e6c68278f --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/mapdrivetriggers.md @@ -0,0 +1,84 @@ +--- +title: "Endpoint Policy Manager Scripts + Triggers: Map a printer or drive when a process runs and un-map it when closed." +description: "Endpoint Policy Manager Scripts + Triggers: Map a printer or drive when a process runs and un-map it when closed." +sidebar_position: 20 +--- +# Endpoint Policy Manager Scripts + Triggers: Map a printer or drive when a process runs and un-map it when closed. + +How do you map a printer or drive when you launch an application like Acrobat Reader ? Using Netwrix +Endpoint Policy Manager (formerly PolicyPak) Scripts + Triggers of course. Its easy to do... just +pre-try your script first, then use Endpoint Policy Manager Scripts + Triggers to do the magic. Its +easy! + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can use Endpoint +Policy Manager scripts and triggers to map a drive, or map a printer, or do some other exciting +thing when you launch a process. Wouldn't it be neat if you double-click on, say, Acrobat Reader and +when you do and when Acrobat Reader launches, then bingo. You either get a printer or you get a +drive map or whatever you want. + +Before we run through this, let's do a little walking here. The way you're going to walk is to test +this out first on a machine or two with the script you're going to actually use. I've already done +this in advance, and there's two ways to map a printer with a script. One way is through PowerShell. +I found that this doesn't always kick in a hundred percent of the time, but it does work sometimes, +so I can just show you right here. If I were to Add Printer, Dash Connection Name, +wak-wak-server-wak-printer1 here. It may or may not decide to kick in. We're going to find out +together and give this a second to catch up. Yeah, see, that decided not to work, and it should +work. There's absolutely nothing wrong with this command. That should work in PowerShell land. + +Instead, we're going to fall back to this old-school method called run dllprintui against the print +UI entry input. Then we're going to give it the server and printer name, so let's go ahead and try +this one on for size. Let's go ahead and see that, and look at that, magically delicious. We can see +we got a little run there, and now we're just waiting for the printer to kick in and there we go. I +mean, each one of these could actually work and it could take a little bit of time the first time. +Don't panic if when you try this technique out it doesn't kick in the very first time. It's just an +affect of the Windows 10 and the printer script. + +Now the removal script is remove-printername. This generally works pretty fast, so we'll go ahead +and give this a shot here and then boom, there we go. There's the printer removal. How do we take +what we just learned and use Endpoint Policy Manager scripts and triggers? + +Here are the exact same commands here, and what we'll do is – what we'll say is hey, let's create a +new GPO for all of our east sales users. "When we run Acrobat, then map our special printer." That's +what we'll call that, and then we'll click on Edit here. What we're going to do is create two +different scripts with triggers. What we'll do is we'll go to Scripts Manager here. You can do this +on either the user or the computer side. I'm going to do this on the user side, so go to Add Policy +here and what we're going to do is add in that script. Now that first script, like I said, that +PowerShell one gives me a little bit of fits, so what I'm going to do is take the old-school run +dll32printer guy here. Bang, so I'm copying that in. There's the bad script. + +Now there is no revert script when you use triggers, so we'll just go ahead and click Next and then +on the trigger, what we want to do is on a process start. On process start, we want to run this +thing. What's the process? Well, let's go ahead and – well, let's run Acrobat Reader. If we run +Acrobat Reader on this machine, you can see that it's running here and we can just select that +process from the actual running process right here. Let's go ahead and pick that guy. Thank you for +popping up, Acrobat Reader. Here we go. Here's Acrobat Reader. When we see Acrobat Reader run as the +process, then perform the work. Policy start trigger, so we'll call this "Acro Map Printer." + +Now we actually have to do another one when the process stops. We'll create a new policy here. This +one will be the PowerShell script because we saw that one worked out pretty well, so we'll go ahead +and pick that guy. Remove Printer Name, so PowerShell script this time. Remove the printer name and +then no revert script there. This time what we'll do is we'll say "On trigger when it's a process +close," and we'll pick the process again. We'll select from the process here. We'll go ahead and +pick Acrobat Reader, and we're off to the races. + +Again, if you didn't have the process running, you can just pick it by the file and so no. go ahead +and click Next and now we'll say unmap printer. Here we go, unmap printer. You can put any number of +things in here, but I'm just doing this nifty printer mapping thing. Now that we're all set and +ready to go here, let me go ahead and run GP update to just get the signal that we're doing this new +thing. Give this a second to finish up. Alright, now let's take it for a test drive. Let's go ahead +and just leave that window down there and let's run Acrobat Reader. I'm going to move this out of +the way so we can actually see it. There we go. You can see the printer 2016 is actually mapped +automatically. When we close this process here, watch what happens to the printer. It's going to get +nuked. + +Alright, let's do it one more time just for good measure. Double-click on Acrobat Reader. What +happens? Boom, the printer's installed. When we uncheck or when we close Acrobat Reader, the printer +is automatically nuked because of Endpoint Policy Manager scripts. + +Don't get dismayed if this doesn't work the very first time. Again, it's some kind of affect around +how the printer takes a couple seconds the very first time to probably get that driver in and +rocking and rolling. After that, you can see it actually happens really, really quickly. I hope this +helps you out and you're ready to use Endpoint Policy Manager scripts and triggers. Thanks very +much. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/scripttriggers.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/scripttriggers.md new file mode 100644 index 0000000000..115b12a0dd --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/scripttriggers.md @@ -0,0 +1,71 @@ +--- +title: "Endpoint Policy Manager Scripts and Triggers: Get to understand login script trigger with GP and MDM systems !" +description: "Endpoint Policy Manager Scripts and Triggers: Get to understand login script trigger with GP and MDM systems !" +sidebar_position: 10 +--- +# Endpoint Policy Manager Scripts and Triggers: Get to understand login script trigger with GP and MDM systems ! + +No login scripts in MDM and Intune got your down? Looking to have something faster and more reliable +(and something that works offline) for GPO and Netwrix Endpoint Policy Manager (formerly PolicyPak) +cloud? Then check out Endpoint Policy Manager Scripts + Login Script Triggers... right here! + + + +Hi, this is Jeremy Moskowitz. In this video, we're going to learn how to use triggers with regards +to Endpoint Policy Manager scripts. There's a bunch of problems we want to overcome. The first one +is that if you're using a machine that's connected to an MDM service like this one is, there's no +log-on script. There's also no log-off script. What I'm going to show you how to do is how to create +a trigger for your machines for your MDM service. Another thing we want to solve today is if you are +domain-joined, there's no way to trigger something when a particular application is run. I'm going +to show you both of those things right now with Endpoint Policy Manager Scripts Manager. + +What we're going to do is our our east sales users, we're going to create a GPO called Endpoint +Policy Manager Scripts and Triggers. Of course this GPO name could be whatever you want. Then I'll +go ahead and click Edit here and this is just built right into Endpoint Policy Manager. You can do +this on the users side or the computers side, so the idea is that you can say for everybody who logs +on the machine, they're going to get this script, or you can do this script on the computer side. +We'll go ahead and right-click and Add New Policy here. What we'll do is we'll define our script. + +For this simple example, I'm going to do a PowerShell script that puts a shortcut icon. Here is the +script that we're going to use, so I'm just going to take it. It's going to put a shortcut icon the +desktop. We're going to run this script as user. If you have a complex or unusual script that you +need to run at system, you can run it with elevated rights, which is pretty nifty. We're going to +skip over this idea of revert action because revert actions are not supported on trigger-based +scripts. What we'll then do is say instead of always, once, or once when forced, now we'll get to +use on trigger. We'll just do a simple log-on trigger. Now log-on, you can also do at shutdown. You +can do it when the session is locked or unlocked for Citrix and terminal server. You can also do +when process starts, stops, or on a particular schedule, which is also incredibly nifty. + +I'm just going to do log-on for right now. The other part about log-on is that you can also delay X +number of minutes after log-on. I'm not going to do that. I'm going to have it just fly right away. +Once we've done this log-on trigger script policy here, we're off to the races. Let's go ahead and +check it out. I don't have my item here. What I am going to do is run GP Update just to get the +signal for this policy. Just give this a second to catch up. Now that that's done, let's go ahead +and go over and let's log off. We'll log on here, and now that we're logged on, boom, there it is. +Our scripted activity is right there right at log-on time. Again, if we wanted to push this into X +number of minutes into the future after log-on, we can certainly do that. + +Now it's time to save this out for use with MDM. We'll go ahead and export this as XML, call this PP +Export Script 1 here. Remember, we have this little utility that's an MSI wrap-up utility here. +That's the Exporter tool. Then what we want to do is create a new MSI, and we'll add that existing +file here. Let's find my Export Script 1 file and I'm going to change this for use on the computer. +Every user on the computer will now get this script. Then I'll go ahead and click Next and I'll save +it out as an MSI to upload to my MDM service. I'll call it Exported GPOs. + +Now it's time to get this into my MDM service like InTune right now. Here we are in Microsoft +InTune, and you can see we've already pre-staged and assigned the Endpoint Policy Manager client set +extension and the Endpoint Policy Manager license. Now it's time to add in the exported group policy +objects. All three of these things are going to make it go. Here we are back on our MDM-enrolled +machine. We've gotten it synchronized. It got the policy. We're all set to go. Only thing that's +left is to sign out, sign back on, and see that our log-on script is now hitting with Endpoint +Policy Manager scripts and triggers. + +If we go ahead and log back on here, give it a second to catch up, and here we are. We'll all logged +on. There it is, the Visit Endpoint Policy Manager item, and like I said, if we decide – a user +throws that in the trash and then they log out and log back on, what's going to happen? This is a +log-on script. It's happening through MDM. It's going to happen absolutely every single time because +that's what we said to do. Let's go ahead and log on, see that that's true. There we go. Our log-on +script is running. + +If you like the idea of Endpoint Policy Manager scripts and triggers, you're welcome to watch some +more videos on how the triggers work. Thanks so very much and talk to you soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/shutdownscripts.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/shutdownscripts.md new file mode 100644 index 0000000000..1d972562b3 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/shutdownscripts.md @@ -0,0 +1,40 @@ +--- +title: "Endpoint Policy Manager Scripts + Triggers: Shutdown scripts on computer side" +description: "Endpoint Policy Manager Scripts + Triggers: Shutdown scripts on computer side" +sidebar_position: 40 +--- +# Endpoint Policy Manager Scripts + Triggers: Shutdown scripts on computer side + +Want to do ANY kind of shutdown script... with Group Policy, an MDM service like Intune, or +PolicyPak cloud? Here's how to do it, with PolicyPak Scripts and Triggers.... and Shutdown triggers +! + + + +Hi, this is Jeremy Moskowitz, and in this video we're going to use PolicyPak scripts and triggers to +do something at computer shutdown time. We're going to keep it simple in this video and we're going +to just simply delete everything in the Temp folder. Of course that command is going to be del +C:/temp/q. I like to pre-test things before I put them into scripts. There you go and if you take a +look at Temp, look at that, nothing in Temp. Let me copy a bunch of junk back here into Temp so I +have something to actually delete later. Here we go, so I've copied a bunch of stuff back into Temp. + +Again, the point is the script that we have just verified as del C:/temp/q – here's all my stuff +now. Let's go ahead and go to PolicyPak Scripts and Triggers. I'm going to do this for all of my +computer in sales, so "Clean up Temp at computer shutdown time" with PolicyPak's Scripts and +Triggers. Go ahead and click Edit here and this one, we're going to do on the computer side. We'll +do computer side PolicyPak Scripts Manager and then we will right-click, Add a New Policy here. This +one we're going to do for the computer. This is the computer doing the work, not the user doing the +work. What we're doing to do here is say "run a batch script." It can be PowerShell or whatnot. +We're just going to run a batch script, del C:/temp/q, and that's it. There is no revert action on +trigger-based scripts. Then the trigger that we want is going to be on shutdown. + +Let's go ahead and try this on for size. What I need to do first, just run GP Update here. Give this +a second to finish up. Alright, now that we're done – so one last time here that I have a bunch of +junk in Temp  and now, let's restart the computer, which is of course a shutdown and I'll come back +at log-on time and we'll see what happens in the Temp folder. We're ready to log on here. Go ahead +and do that, give this a second to log on. Now that we're logged on, let's see if the actual +activity worked. If we go to the Temp folder, there we go, all cleaned up. PolicyPak Scripts and +Triggers to the rescue. + +Hope this helps you out. Remember doing this on the computer side because you can only do shutdown +on the computer side. Hope this helps you out. Thanks very much and talk to you soon. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/vpnconnect.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/vpnconnect.md new file mode 100644 index 0000000000..34b0774a45 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/triggersexamples/vpnconnect.md @@ -0,0 +1,60 @@ +--- +title: "Endpoint Policy Manager Scripts & Triggers: Perform Scripts on VPN Connect and VPN Disconnect" +description: "Endpoint Policy Manager Scripts & Triggers: Perform Scripts on VPN Connect and VPN Disconnect" +sidebar_position: 50 +--- +# Endpoint Policy Manager Scripts & Triggers: Perform Scripts on VPN Connect and VPN Disconnect + +Want to map a drive or perform any other login script when you connect via VPN? Easy. Use Netwrix +Endpoint Policy Manager (formerly PolicyPak) Scripts & Triggers with this awesome way to handle this +problem. + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can use Endpoint +Policy Manager Scripts and Triggers to map a drive or do any kind of log on script thing you want +after you connect through VPN, and you can do another kind of action like unmap network drives or do +any other kind of script when you disconnect from VPN. Before you get started, you should have your +script ready to go. I don't have anything interesting over on my VPN itself, so I'm going to do some +stuff locally, but this should give you the idea. For instance, when I connect to VPN, wouldn't it +be amazing when I create a file called echo aaa to a file C:\temp\a.txt. Look at that, I've created +a file. Then when I'm disconnecting from the VPN, I want to delete C:\temp\a.txt. + +These are my two commands. This is going to be my on connect script, and then my other one will be +my disconnect script, so I'm going to go ahead and copy that. Time to go over to group policy land +or you can do this in Endpoint Policy Manager MDM land, or you can do this in Endpoint Policy +Manager Cloud land. What we'll do is we'll go to PP VPN 123, so we'll go ahead and create this group +policy object here with the Editors, and you can do this on the user or the computer side. I'm going +to dive down under Endpoint Policy Manager on the user side here for this example. Then I'm going to +go to Scripts Manager, and I'm going to plunk in that script. + +Add a New Policy here and this policy is going to be a Batch script. If you want to do PowerShell or +one of the other script types, that's totally fine. You can run the script – this script will be +running fine as the user. If you want to run it as system, you can do that. If you need it to run +with a user with elevated rights, we can do that too. You're off to the races. That's going to be +our connect script. + +We don't need a revert action. What we need is a trigger that say at VPN connect – at VPN connect +for any server at all or if you want to specify a server you can do that – \* is usually sufficient +for most people. Boom. You're done. On VPN connect, go ahead and make that file happen or map that +drive or anything else you wanted to do. The next thing we want to do is our disconnect script, so +we'll go ahead and make a Batch script. Like I said, very simple script. We're just going to delete +that file after we disconnect, so I'll just paste that in here. Bing, bang, bing. Click Next, and no +revert action. We want to make it a trigger. That trigger is going to be on VPN disconnect, and then +we will once again say on any server disconnected, and then we're off to the races. + +That's all there is to it. I'm going to run gpupdate and get my policy here ,and then the next time +I connect to my VPN server, I'll show you that – I'll delete the file first. It is deleted. Then +we'll show you at connection, we'll create the file, and at disconnect, we will automatically remove +the file. Let's go ahead and check that out. Just to prove we're not pulling a fast one on you here, +nothing in the temp folder. Here's my VPN connection. Endpoint Policy Manager trigger will kick in +after the VPN connection is completed, and we'll watch that file get created in real time. Again, if +this was map a drive, run a whole log on script, do anything you want, that's totally fine. I'm just +keeping it simple. There's my file. All automatic. It did the thing. + +Now when it's time to disconnect – let me go ahead and disconnect here – we have that second +trigger, which says on VPN disconnect, what are we going to do? Take another directory here and +bang, delete the file. Just like that using Endpoint Policy Manager Scripts and Triggers, you can do +any kind of scripty thing you want on a VPN connection and also a VPN disconnection. Hope this video +helps you out. Looking forward to getting you started with Endpoint Policy Manager real soon. Thank +you very much. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/videolearningcenter.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/videolearningcenter.md new file mode 100644 index 0000000000..183703fb4d --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/videolearningcenter.md @@ -0,0 +1,45 @@ +--- +title: "Video Learning Center" +description: "Video Learning Center" +sidebar_position: 20 +--- + +# Video Learning Center + +See the following Video topics for Scripts and Triggers Manager. + +## Getting Started + +- [Use with on-prem Group Policy](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/gettingstarted/onpremise.md) +- [Deploy any script via the Cloud to domain joined and non-domain joined machines](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/gettingstarted/cloud.md) + +## Tips and Tricks + +- [Endpoint Policy Manager Scripts: Automate Software deployments with PP Scripts and Chocolaty.org](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/tipsandtricks/chocolaty.md) +- [Replace the Windows 10 PRO Professional Lock screen](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/tipsandtricks/windows10prolockscreen.md) +- [Policy Scripts Manager: Set Custom Default File Associations in Windows 10](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/tipsandtricks/customdefaultfileassociations.md) +- [Removing Unwanted Windows Apps Using Endpoint Policy Manager Scripts & Triggers Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/tipsandtricks/unwantedapps.md) +- [Shared Printers without Loopback: Use Endpoint Policy Manager Scripts and PowerShell to deploy and remove printers](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/tipsandtricks/printers.md) +- [Implementing BitLocker through Group Policy Using Endpoint Policy Scripts Manager and Administrative Templates Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/tipsandtricks/bitlocker.md) + +## Scripts & Triggers with Cloud + +- [Endpoint Policy Manager Cloud Scripts Manager: Distribute and Import X.509 certificates](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/withcloud/x509certificates.md) +- [Endpoint Policy ManagerScripts .. Deploy Software via VPN or with Endpoint Policy Manager Cloud](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/withcloud/cloud.md) +- [Endpoint Policy Manager Cloud TCP/IP Printer setup using Scripts Manager](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/withcloud/printersetup.md) +- [Using Endpoint Policy Manager Cloud and Auditpol.exe to enable Advanced Auditing on non-domain joined computers](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/withcloud/auditpol.md) + +## Triggers Specific Examples + +- [Endpoint Policy Manager Scripts and Triggers: Get to understand login script trigger with GP and MDM systems !](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/scripttriggers.md) +- [Endpoint Policy Manager Scripts + Triggers: Map a printer or drive when a process runs and un-map it when closed.](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/mapdrivetriggers.md) +- [Endpoint Policy Manager Scripts + Triggers: Perform actions at LOCK and UNLOCK of session](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/lockunlocksession.md) +- [Endpoint Policy Manager Scripts + Triggers: Shutdown scripts on computer side](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/shutdownscripts.md) +- [Endpoint Policy Manager Scripts & Triggers: Perform Scripts on VPN Connect and VPN Disconnect](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/vpnconnect.md) +- [Endpoint Policy Manager Scripts and AnyConnect: Run a script after you connect via VPN](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/anyconnect.md) +- [Endpoint Policy Manager Scripts & Triggers: Events !](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/triggersexamples/events.md) + +## Methods: MDM, PDQ, etc. + +- [Endpoint Policy Manager Scripts and YOUR MDM service: Un-real power](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/methods/mdm.md) +- [Removing Unwanted Windows Apps Using Endpoint Policy Manager and PDQ Deploy](/docs/endpointpolicymanager/knowledgebase/scriptstriggers/videolearningcenter/methods/pdqdeploy.md) diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/_category_.json b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/_category_.json new file mode 100644 index 0000000000..9443037c26 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "With Cloud", + "position": 50, + "collapsed": true, + "collapsible": true +} diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/auditpol.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/auditpol.md new file mode 100644 index 0000000000..e050a1ab5e --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/auditpol.md @@ -0,0 +1,68 @@ +--- +title: "Using Endpoint Policy Manager Cloud and Auditpol.exe to enable Advanced Auditing on non-domain joined computers" +description: "Using Endpoint Policy Manager Cloud and Auditpol.exe to enable Advanced Auditing on non-domain joined computers" +sidebar_position: 40 +--- +# Using Endpoint Policy Manager Cloud and Auditpol.exe to enable Advanced Auditing on non-domain joined computers + +Use Netwrix Endpoint Policy Manager (formerly PolicyPak)'s Scripts and Triggers Manager and +Auditpol.exe to configure advanced auditing on your remote (domain or non-domain joined) computers. + + + +Hi, this is John from Endpoint Policy Manager. In this video, we're going to show you how you can +enable advanced auditing for remote domain or nondomain joined computers using Endpoint Policy +Manager Cloud. Local domain joined computers have the ability to create group policy objects to +enable the various auditing policies. Remote, nondomain joined machines do not have this luxury. +Microsoft, however, provides a command line utility called Auditpol to facilitate this option, and +Endpoint Policy Manager provides the vehicle in which to distribute this policy to remote machines +whether domain joined or not. Let's dive in. Let's take a look how Endpoint Policy Manager can help +you enable advanced auditing. + +We have our Endpoint Policy Manager Cloud web GUI. We're going to create a policy for my test group. +I'm going to create and link a new policy here, and we're going to scroll down to Scripts Manager +and use this to deliver the policy. I'm going to give it a quick little name, call it Advanced +Auditing. We're going to create a collection because when you're doing this, you're probably not +going to create just one. You're going to create several policies. A collection will give you a way +of grouping them together. You also have the ability if you wanted to add item level targeting, so +if you need to further group these computers by say computer type, computer name, laptops or not, +whether they belong to a certain IP address range or not, you can add this here as well as you can +with most other Endpoint Policy Manager policies. + +We're not going to do this right now. We're just going to create our collection, click OK. Then +inside the collection, we're going to create a new policy. Now, this is done on the machine side so +we're going to click on Machine. Under Name, we'll do file system audit. It's going to be enabled, +and of course, we can also add item level targeting here as well. The Apply Action, this is where we +can apply our script. I precreated the script down here. We're just going to copy it and paste it. +This is using the Auditpol set command for the file system subcategory, and I'm going to audit both +success and failures. + +Now on the revert action should this machine fall out of scope – it's no longer in that group that +it belongs – I'm going to disable it. Add a Batch Script. Paste in the command, so same command, but +now I am going to disable success and failure audits. Under Policy process mode, you can apply it +Once, Always, or Once or when forced. Once is all we need to do. Once it's applied, it's going to +stay there. It's not going to change, so [03:10]. Click OK, and now we have our policy created. + +I'm going to go ahead, and I'm going to temporarily disable this policy, so I don't want it coming +down just yet. Let's take a look here. Here's my command to check on the auditing. See what's set, +what isn't set for the object access. We can see the file system, which is what I set my command, is +not yet set. There's no auditing involved. Come over here to my event viewer, just do a little +refresh. Okay, there's nothing in my event log. I'm going to open up a file, close it up, refresh, +still nothing. Now let's go over, and let's reenable this. Click on it. Enable the policy, Yes. +Minimize that, and we're going to sync up the cloud. + +Now you can see the Advanced Auditing, what I just created, is now a policy that's been brought down +from the cloud. I'm going to go and check my get command for Auditpol. I'm now auditing success and +failures for the system, and I come over here and access my file, refresh. I've got a bunch of +audits. You can see here that it's for the file access test file, which is what I opened up. There's +four entries here, all for that one file. We can see that we're able to enable advanced auditing +using Endpoint Policy Manager, using this command line and Scripts Manager. + +Now, you know we put a reverse script if this policy's computer is for whatever reason no longer +falls under scope, so we're going to disable the policy and remove the auditing. Let's come back +over here. Disable the policy. Click Yes. This could've been the computer no longer being associated +with this particular group, being put in a different group in a different set of policies, maybe a +different set of auditing. Either way. Minimize that. Let's update the policy. Now you'll see the +policy is no longer there. Query object access, and again, back to no auditing. Let's clear the log. +Open up my file. Close it. Refresh. No logging. Okay, so this is how we can enable advanced auditing +in remote domain or nondomain joined computers. Thanks for watching. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/cloud.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/cloud.md new file mode 100644 index 0000000000..e0b7e99f1c --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/cloud.md @@ -0,0 +1,105 @@ +--- +title: "Endpoint Policy ManagerScripts .. Deploy Software via VPN or with Endpoint Policy Manager Cloud" +description: "Endpoint Policy ManagerScripts .. Deploy Software via VPN or with Endpoint Policy Manager Cloud" +sidebar_position: 20 +--- +# Endpoint Policy ManagerScripts .. Deploy Software via VPN or with Endpoint Policy Manager Cloud + +If you have remote workers and you want to deploy software to them, it's easy with Netwrix Endpoint +Policy Manager (formerly PolicyPak). Using Endpoint Policy Manager Scripts you can deploy software +to your machines which are domain joined and VPN, or those with Endpoint Policy Manager Cloud. +Here's how to do it! + + + +Hi, this is Jeremy Moskowitz, and in this video, I'm going to show you how you can use Endpoint +Policy Manager Scripts to deploy software to remote workers. In this demonstration, this machine, +the one with the green background, that's going to represent my domain joined-machine over VPN to my +Active Directory domain. This machine with the blue background is going to represent that's going to +join Endpoint Policy Manager Cloud. He's not domain-joined, but he is going to get Endpoint Policy +Manager Cloud, and I'm going to show you how to deploy software like Chrome or Firefox or whatever +you want using Endpoint Policy Manager Scripts. + +To get started here we have a couple of examples for you to use. We have them in a KB article called +"How to Silently install Firefox ESR, Chrome and WinZip using Endpoint Policy Manager Scripts +Manager." We provide a couple of example scripts. For anything else, you're on your own, but these +should get you off to the races to get started. By way of example, let's go ahead and take this +first script. This is the Firefox install script. I'm going to show you how we do it. I'm going to +copy that script, and again, I'm going to be doing two things here, one for my on-prem world/my VPN +world and the other one for my Endpoint Policy Manager Cloud world, so I'm going to create a GPO +here, and I'm going to call this PP Scripts Software Deploy. It doesn't matter what I call it, of +course. I'll right click and click Edit here. + +Then I'm going to go to Computer side Endpoint Policy Manager Scripts. Scripts Manager can work +either on the user or the computer side. These scripts have been tested to work on the computer +side. The scripts will also be delivering to the entire computer, which is also called the systems +side. When you install them on the system, every user gets it, but you can also for some software +might want to apply directly in the user profile. This is being deployed for the entire computer +here. Go ahead and click Next. This is going to be a PowerShell script. We'll go ahead and paste +that. You can see that the script starts and the script ends. + +The magic really happens is that there's a download URL from the manufacturer or from another +source. We're going to copy it locally and then execute it and then write some output in case +something doesn't go perfectly well. Go ahead and click Next. We have this idea of a revert script. +Revert script is if the policy no longer applies or if you have something like item level targeting, +which is in the next page, the idea is that you can run maybe a removal script if that's interesting +for you. We suggest that you do these scripts once or when forced. Once will do it one time, but if +you get into trouble, you can have the user run gpupdate /force, and it'll attempt to rerun the +script and therefore reinstall the software. We'll go ahead and call this Firefox install. + +Again, optionally, we have item level targeting. This can say do the script when the following is +true like maybe when it's a laptop, only when it's a laptop, or you can say when the machine is on +this IP range or not on this IP range, for instance you want to make sure it's out of the office. +Only when it's out of the office, go ahead and install the software. You can do that if that's what +you want to do. I'm not going to do that now. + +The second thing I'm going to do is I'm going to add a new policy here for my Chrome, so I'm just +going to go back to Endpoint Policy Manager Scripts and get that – get the Chrome script that we +have here, and then go back, paste it in. I'll copy it, go back, I'll paste it in. Then I don't want +to run an off script, and I want to do it once or when forced, and I'll call this Chrome install. +Now, you can take these scripts, these same scripts, and in Endpoint Policy Manager Cloud, of which +I am logged onto over here – in Endpoint Policy Manager Cloud land, you might want to on a +particular computer group or on this special group called All, you can create and link a new policy, +so you can go to Endpoint Policy Manager Settings, Scripts Manager, and you can go through the +Scripts Manager. I want to call this Chrome Deploy, and then add a new policy here to the machine +side, and on the Apply we want to make a PowerShell Script and paste that script in. There we go. No +revert action, and we want to do it once or when forced. There we go. It's the exact same thing in +Endpoint Policy Manager Scripts land, same basic gist. You can see it's now linked over to my +special All group. + +Another thing you may want to try to do is if you go to the one you created earlier, you can take a +look and view it as an XML in Notepad. You can copy it. I'm going to right click and copy that. Then +I'm going to go over back to Endpoint Policy Manager Scripts, and you can in the All group or +whatever group you want upload and link a new XML here and simply paste in what you did on-prem. You +could do Firefox Deploy. The basic gist is that you can either use the in-cloud editor or you can +use the work you've already done in group policy land to just right click and export. You're off to +the races. + +Now we've set it up for both our group policy/VPN and our Endpoint Policy Manager Cloud guy. What +we're going to do is on this machine we're going to run gpupdate. Actually, we don't need a force, +and the idea is that this will just run in the background all automatically, and if I were to go to +this machine that's not domain joined and join him to Endpoint Policy Manager Cloud – let's go ahead +and do that. Remember, this has to be done in advance because you're going to get prompted for admin +credentials, so this has to be done before the machine goes on the road here, and he's going to +download the client-side extension, claim a license, and get automatically joined to that special +All group, and then those policies will come down. I just want to make sure that that happens here +before we continue. There's the special All group. There's a policy that's also linked to the All +group. + +At this point, it's a little bit of a waiting game. Most of the time these things happen pretty +fast, so I'm just going to wait for that to finish up here. What I'll do is I'll just pause the +camera and come back, and we'll see in a minute or two what the results are. Okay, and we're back. +You can see there's the Firefox icon and there's the Chrome icon. Again, this is my not-domain +joined Endpoint Policy Manager Cloud machine. If I were to refresh here in program files, I can see +there's Google Chrome and I can see there's Firefox. If I were to go over to my domain joined +machine through VPN, if I just refresh here, again I'll see Chrome and I will see Firefox there, and +then lastly, we – these particular scripts are smart. + +If you take a look in the Temp folder, you'll see that there's a folder called Apps, and if you +wanted to, you could take a look at the log files to see what's actually transpired here. For +instance, you could just see ah-ha, everything was successful. If there was any problems or +whatever, you'd see the output here. That's really all there is to it to using Endpoint Policy +Manager Scripts Manager to deploy your software through the internet, through your domain joined +machines and VPN, or to your not domain joined machines with Endpoint Policy Manager Cloud as well. +Hope this helps you out. Looking forward to getting you started with Endpoint Policy Manager real +soon. Take care. diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/printersetup.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/printersetup.md new file mode 100644 index 0000000000..bb802503e8 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/printersetup.md @@ -0,0 +1,8 @@ +--- +title: "Endpoint Policy Manager Cloud TCP/IP Printer setup using Scripts Manager" +description: "Endpoint Policy Manager Cloud TCP/IP Printer setup using Scripts Manager" +sidebar_position: 30 +--- +# Endpoint Policy Manager Cloud TCP/IP Printer setup using Scripts Manager + + diff --git a/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/x509certificates.md b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/x509certificates.md new file mode 100644 index 0000000000..ac10df7776 --- /dev/null +++ b/docs/endpointpolicymanager/scripts-and-triggers-manager/video-learning-center/withcloud/x509certificates.md @@ -0,0 +1,81 @@ +--- +title: "Endpoint Policy Manager Cloud Scripts Manager: Distribute and Import X.509 certificates" +description: "Endpoint Policy Manager Cloud Scripts Manager: Distribute and Import X.509 certificates" +sidebar_position: 10 +--- +# Endpoint Policy Manager Cloud Scripts Manager: Distribute and Import X.509 certificates + +Use Netwrix Endpoint Policy Manager (formerly PolicyPak) Cloud and Scripts Manager to distribute and +import X.509 certificates to your endpoints, regardless of where they may reside, for use with +Endpoint Policy Manager VPN Manager or any any other purpose you have. + + + +Script: + +``` +# Create Cert - update path for certificate as needed below$CertFile = "C:\temp\Cert\FABRIKAM-VPN-DEMO-ROOTCA-CERT.cer"Write-Output "-----BEGIN CERTIFICATE------=Certificate in BASE64 x.509 format text goes here=------END CERTIFICATE-----" | Out-File $CertFile# Import cert - replace certificate name and path as needed below.certutil -addstore root "C:\temp\Cert\FABRIKAM-VPN-DEMO-ROOTCA-CERT.cer" +``` + +Hi, there. This is John Demianiuk with Endpoint Policy Manager Software. I'm going to show you how +to use Endpoint Policy Manager Cloud and Scripts Manager to distribute and import your custom 509 +Certificates to use with Endpoint Policy Manager VPN Manager or for any other purposes you may need +on your endpoints. First off, we need a donor Certificate file. Let's head over to my donor machine. + +We have Certificates Manager open. You can see we have our fabrikam-DC2016-CA certificate. We're +going to use this as our donor, and we're going to distribute this to our endpoints. Let's start by +taking an export of this file. We're going to do this in Base-64, so Export 64, and Finish. Let's +head over back to our work station here. I've got a copy of the exported file here. Let's right +click on this. Let's take a look in Notepad and see what it looks like. This is our file in Notepad. +This is the certificate that we need to distribute to the endpoints. + +The next thing we need in order to get this done is we need the scripts. This is going to be +available in our Guidance Downloads. If it isn't yet, it will be. If it isn't yet, I will be +providing the script in the discussion or comments below. Let's take a look and see where you can +get it from. + +The first thing is to log onto our Endpoint Policy Manager Portal. All of our clients have access to +the portal. If you're not sure what your log on is, you can contact sales and they'll get you set +up. First thing you need to do once you log in, head to Downloads. If you're downloading just the +guidance, you can head over to Guidance XMLs and Scripts. Inside here there's a bunch of scripts and +XML files for policies to help you do common things that you may need to do on your machine. I +already have the script downloaded. I've got the script in here. This is basically the script. We +have scrubbed out the certificate file, and this is the area that you would put in your own +certificate file here. + +Let's start creating the rule. Let's head over to the Endpoint Policy Manager Cloud Editor. I'm +going to go straight into Computer Groups to create this rule. I know I'm going to put it right in +my test computer. I'm going to highlight my Test Computer Group. I'm going to Create and Link a New +Policy in this section here. + +Scroll down and find Certificates Manager and click OK. New policy is Cert File. Create a new +policy. This is going to be on the machine side. Apply Action is where we're going to place our +PowerShell script. Of course, we have to click the dropdown to PowerShell. We're going to copy over +the script that we already created or downloaded. + +Let's get our certificate. I already have the Begin and End Certificate sections, so I don't need to +copy those. I'm going to replace this middle section here. There is no revert action, so we'll just +click on OK. We've got our policy now. We'll click OK. That's saved to my Test Computer Group. + +Let's theoretically switch over to my endpoint. We're going to download the policy and enforce that +policy on this endpoint. First let's take a look at a couple things. This is the temporary folder +that I put the certificate file in. You can put this in any folder you want. You can name it +anything that you want. The script allows you to specify the folder name and the file name to be +whatever you want it to be. + +We'll take a look at Certificate Manager. [04:37] says where the certificate was. There is nothing +here. Let's open up command prompt. The first thing we're going to do is we're going to download the +file or the policies. To do that, type in ppcloud/sync. Here's our policy cert file here. + +The next thing we're going to do is we're going to tell Endpoint Policy Manager to apply those +policies. You don't have to do this. I'm just accelerating the hands of time to get this done. +Endpoint Policy Manager does by default every hour run a sync and update your policies. That is +done. It is downloaded and applied to the computer. + +If we take a look into the shortcut folder, there is our policy. You can double click on this to see +what it looks like. We don't have to install it, of course, because it already is installed. To show +that, I'm going to come back over here and Refresh. Here's our fabrikam-DC2016-CA policy, our +certificate all set to go. + +That said, again, this is great for use with VPN Manager. Again, this is for absolutely any purpose +you need to get custom X509 Certificates onto your endpoints. Thanks a lot and have a great day. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/_category_.json new file mode 100644 index 0000000000..318c3df90c --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/_category_.json @@ -0,0 +1,7 @@ +{ + "label": "Start Screen & Taskbar Manager", + "position": 50, + "link": { + "type": "generated-index" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/assets/startscreentaskbarmanager.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/assets/startscreentaskbarmanager.webp new file mode 100644 index 0000000000..7f8f412fca Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/assets/startscreentaskbarmanager.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/_category_.json new file mode 100644 index 0000000000..e2b65c331d --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/_category_.json @@ -0,0 +1,7 @@ +{ + "label": "Manual", + "position": 1, + "link": { + "type": "generated-index" + } +} diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_10_image-20200212183953-6_756x226.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_10_image-20200212183953-6_756x226.webp new file mode 100644 index 0000000000..bec634f736 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_10_image-20200212183953-6_756x226.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_12_image-20200212183953-7_500x38.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_12_image-20200212183953-7_500x38.webp new file mode 100644 index 0000000000..2d354948c4 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_12_image-20200212183953-7_500x38.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_14_image-20200212183953-8.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_14_image-20200212183953-8.webp new file mode 100644 index 0000000000..75bf2ca086 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_14_image-20200212183953-8.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_16_image-20200212183953-9.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_16_image-20200212183953-9.webp new file mode 100644 index 0000000000..0fee34834c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_16_image-20200212183953-9.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_18_image-20200212183953-10_541x36.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_18_image-20200212183953-10_541x36.webp new file mode 100644 index 0000000000..00d10c820d Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_18_image-20200212183953-10_541x36.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_1_image-20200212183953-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_1_image-20200212183953-1.webp new file mode 100644 index 0000000000..d2e1f1527e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_1_image-20200212183953-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_20_image-20200212183953-11_470x38.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_20_image-20200212183953-11_470x38.webp new file mode 100644 index 0000000000..3bacede0da Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_20_image-20200212183953-11_470x38.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_24_image-20200212183953-13_618x256.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_24_image-20200212183953-13_618x256.webp new file mode 100644 index 0000000000..63a19585eb Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_24_image-20200212183953-13_618x256.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_26_image-20200212183953-14_468x38.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_26_image-20200212183953-14_468x38.webp new file mode 100644 index 0000000000..f3342557d4 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_26_image-20200212183953-14_468x38.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_3_image-20200212183953-2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_3_image-20200212183953-2.webp new file mode 100644 index 0000000000..9a18d16e5e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_3_image-20200212183953-2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_5_image-20200212183953-3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_5_image-20200212183953-3.webp new file mode 100644 index 0000000000..2de54d0f9e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_5_image-20200212183953-3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_7_image-20200212183953-4_834x93.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_7_image-20200212183953-4_834x93.webp new file mode 100644 index 0000000000..38b5bbb577 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_7_image-20200212183953-4_834x93.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_9_image-20201007144149-1_619x269.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_9_image-20201007144149-1_619x269.webp new file mode 100644 index 0000000000..7064583f6c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/719_9_image-20201007144149-1_619x269.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_1_hf-936-img-01.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_1_hf-936-img-01.webp new file mode 100644 index 0000000000..dc68d6a4f9 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_1_hf-936-img-01.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_3_hf-936-img-02.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_3_hf-936-img-02.webp new file mode 100644 index 0000000000..d08bbdcb14 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_3_hf-936-img-02.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_5_hf-936-img-03.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_5_hf-936-img-03.webp new file mode 100644 index 0000000000..1cc063e6ff Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_5_hf-936-img-03.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_7_hf-936-img-04.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_7_hf-936-img-04.webp new file mode 100644 index 0000000000..a5c52b1b79 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_7_hf-936-img-04.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_9_hf-936-img-05.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_9_hf-936-img-05.webp new file mode 100644 index 0000000000..7c314cd1f1 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/724_9_hf-936-img-05.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/731_1_sss.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/731_1_sss.webp new file mode 100644 index 0000000000..1009dc1728 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/731_1_sss.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_10_image-20201225195625-10.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_10_image-20201225195625-10.webp new file mode 100644 index 0000000000..c2ed6bef92 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_10_image-20201225195625-10.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_11_image-20201225195625-11.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_11_image-20201225195625-11.webp new file mode 100644 index 0000000000..48a838a3e7 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_11_image-20201225195625-11.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_12_image-20201225195625-12_339x107.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_12_image-20201225195625-12_339x107.webp new file mode 100644 index 0000000000..c29464b452 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_12_image-20201225195625-12_339x107.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_13_image-20201225195625-13.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_13_image-20201225195625-13.webp new file mode 100644 index 0000000000..a3f98745d6 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_13_image-20201225195625-13.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_14_image-20201225195625-14_409x165.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_14_image-20201225195625-14_409x165.webp new file mode 100644 index 0000000000..5227efe67c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_14_image-20201225195625-14_409x165.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_1_image-20201225195625-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_1_image-20201225195625-1.webp new file mode 100644 index 0000000000..6dbfdf0404 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_1_image-20201225195625-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_2_image-20201225195625-2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_2_image-20201225195625-2.webp new file mode 100644 index 0000000000..753a74d52f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_2_image-20201225195625-2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_3_image-20201225195625-3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_3_image-20201225195625-3.webp new file mode 100644 index 0000000000..d709f93ef8 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_3_image-20201225195625-3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_4_image-20201225195625-4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_4_image-20201225195625-4.webp new file mode 100644 index 0000000000..a34be8c408 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_4_image-20201225195625-4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_5_image-20201225195625-5.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_5_image-20201225195625-5.webp new file mode 100644 index 0000000000..734e8a0cad Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_5_image-20201225195625-5.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_6_image-20201225195625-6.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_6_image-20201225195625-6.webp new file mode 100644 index 0000000000..e1d8d91a13 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_6_image-20201225195625-6.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_7_image-20201225195625-7.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_7_image-20201225195625-7.webp new file mode 100644 index 0000000000..2bda605896 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_7_image-20201225195625-7.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_8_image-20201225195625-8.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_8_image-20201225195625-8.webp new file mode 100644 index 0000000000..304a5881a8 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_8_image-20201225195625-8.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_9_image-20201225195625-9.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_9_image-20201225195625-9.webp new file mode 100644 index 0000000000..e00cb09d03 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/773_9_image-20201225195625-9.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/824_1_image-20210304053215-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/824_1_image-20210304053215-1.webp new file mode 100644 index 0000000000..829975a059 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/824_1_image-20210304053215-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/841_1_image-20201201090844-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/841_1_image-20201201090844-1.webp new file mode 100644 index 0000000000..33d4d2cd6e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/841_1_image-20201201090844-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/914_1_image001.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/914_1_image001.webp new file mode 100644 index 0000000000..4e6f4cd812 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/914_1_image001.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/about_endpointpolicymanager_start_screen_2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/about_endpointpolicymanager_start_screen_2.webp new file mode 100644 index 0000000000..7a11bd3752 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/about_endpointpolicymanager_start_screen_2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/about_endpointpolicymanager_start_screen_3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/about_endpointpolicymanager_start_screen_3.webp new file mode 100644 index 0000000000..f8099606e7 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/about_endpointpolicymanager_start_screen_3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_13.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_13.webp new file mode 100644 index 0000000000..4b45b31d1c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_13.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_14.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_14.webp new file mode 100644 index 0000000000..20e30caffe Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_14.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_15.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_15.webp new file mode 100644 index 0000000000..9dd5bc3923 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_15.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_16.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_16.webp new file mode 100644 index 0000000000..3e6e6d0828 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_16.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_17.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_17.webp new file mode 100644 index 0000000000..f30efc855f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_17.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_18.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_18.webp new file mode 100644 index 0000000000..ef83b16f9e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_18.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_19.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_19.webp new file mode 100644 index 0000000000..fa3273fb7c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/collections_policy_settings_19.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/insouts/about_endpointpolicymanager_start_screen.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/insouts/about_endpointpolicymanager_start_screen.webp new file mode 100644 index 0000000000..3d8d9a012e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/insouts/about_endpointpolicymanager_start_screen.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/insouts/about_endpointpolicymanager_start_screen_1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/insouts/about_endpointpolicymanager_start_screen_1.webp new file mode 100644 index 0000000000..005a95d7bd Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/insouts/about_endpointpolicymanager_start_screen_1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager.webp new file mode 100644 index 0000000000..1b96927c8a Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_1.webp new file mode 100644 index 0000000000..2133dece46 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_2.webp new file mode 100644 index 0000000000..cc0778ee72 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_3.webp new file mode 100644 index 0000000000..33b26eac6f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/quickstart_taskbar_manager_3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_10.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_10.webp new file mode 100644 index 0000000000..15e574b1d1 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_10.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_11.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_11.webp new file mode 100644 index 0000000000..fdd1f2faa8 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_11.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_12.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_12.webp new file mode 100644 index 0000000000..e866793628 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/collections_policy_settings_12.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings.webp new file mode 100644 index 0000000000..a29b213709 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_1.webp new file mode 100644 index 0000000000..d272d646c6 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_2.webp new file mode 100644 index 0000000000..fd1fffb911 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_3.webp new file mode 100644 index 0000000000..07f7c96a23 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_4.webp new file mode 100644 index 0000000000..4989dc1533 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_5.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_5.webp new file mode 100644 index 0000000000..981ef50f85 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_5.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_6.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_6.webp new file mode 100644 index 0000000000..5078ac0e6f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_6.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_7.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_7.webp new file mode 100644 index 0000000000..889030acba Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_7.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_8.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_8.webp new file mode 100644 index 0000000000..7a894d8316 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_8.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_9.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_9.webp new file mode 100644 index 0000000000..f20ee50c51 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/collections_policy_settings_9.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/quickstart_start_screen_manager_3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/quickstart_start_screen_manager_3.webp new file mode 100644 index 0000000000..06af09289f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/settings/startscreen/quickstart_start_screen_manager_3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager.webp new file mode 100644 index 0000000000..ce5c038df0 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_1.webp new file mode 100644 index 0000000000..cbce685d66 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_10.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_10.webp new file mode 100644 index 0000000000..be6fd1a2d8 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_10.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_11.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_11.webp new file mode 100644 index 0000000000..776dd8019a Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_11.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_12.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_12.webp new file mode 100644 index 0000000000..fa2196ff6e Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_12.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_13.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_13.webp new file mode 100644 index 0000000000..db1f04d711 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_13.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_14.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_14.webp new file mode 100644 index 0000000000..0dff09abff Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_14.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_15.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_15.webp new file mode 100644 index 0000000000..efdfe000ff Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_15.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_16.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_16.webp new file mode 100644 index 0000000000..489dca0207 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_16.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_17.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_17.webp new file mode 100644 index 0000000000..e791417a06 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_17.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_18.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_18.webp new file mode 100644 index 0000000000..d6054ad8ae Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_18.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_19.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_19.webp new file mode 100644 index 0000000000..f86ea740a3 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_19.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_2.webp new file mode 100644 index 0000000000..1a036deb3b Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_20.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_20.webp new file mode 100644 index 0000000000..e18e83a99c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_20.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_21.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_21.webp new file mode 100644 index 0000000000..36dd7a9526 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_21.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_22.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_22.webp new file mode 100644 index 0000000000..aa034dcefe Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_22.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_4.webp new file mode 100644 index 0000000000..3e76735bad Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_5.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_5.webp new file mode 100644 index 0000000000..17eae8a42f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_5.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_6.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_6.webp new file mode 100644 index 0000000000..417b4de707 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_6.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_7.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_7.webp new file mode 100644 index 0000000000..5bb83a7126 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_7.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_8.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_8.webp new file mode 100644 index 0000000000..6f366a4bb0 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_8.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_9.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_9.webp new file mode 100644 index 0000000000..88da423505 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/startscreen/quickstart_start_screen_manager_9.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility.webp new file mode 100644 index 0000000000..218f338f8f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_1.webp new file mode 100644 index 0000000000..0f8925b7e5 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_2.webp new file mode 100644 index 0000000000..8964aee89d Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_3.webp new file mode 100644 index 0000000000..751c380e1f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_4.webp new file mode 100644 index 0000000000..277cb86d1f Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/assets/using_the_helper_utility_4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/_category_.json new file mode 100644 index 0000000000..86265a3334 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Collections, Policy Settings, and Item-Level Targeting", + "position": 50, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "collectionssettingsilt" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/collectionssettingsilt.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/collectionssettingsilt.md new file mode 100644 index 0000000000..f6f0005f88 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/collectionssettingsilt.md @@ -0,0 +1,22 @@ +--- +title: "Collections, Policy Settings, and Item-Level Targeting" +description: "Collections, Policy Settings, and Item-Level Targeting" +sidebar_position: 50 +--- + +# Collections, Policy Settings, and Item-Level Targeting + +Policies are the actual items that perform work. Earlier you created policies to make a new Windows +10 Start Menu Group and add icons to it, as well as to pin items to the Taskbar. A collection +enables you to group policies together so they can act together. For instance, you might create a +collection for East Sales computers and another for West Sales computers. Or you might create a +collection for Windows 10 desktops and one for Windows 10 laptops. Item-Level Targeting is used in +Microsoft Group Policy Preferences and other areas of Netwrix Endpoint Policy Manager (formerly +PolicyPak) to target or filter where specific items will apply. Item-Level Targeting can be used in +the following ways: + +- With Endpoint Policy Manager Start Screen Manager and Endpoint Policy Manager Taskbar Manager, + Item-Level Targeting can be used with collections, policies for Windows 10 groups, as well as + policies that add icons to those groups. +- With Endpoint Policy Manager Taskbar Manager, Item-Level Targeting can be used within collections, + as well as policies, that pin icons to the Taskbar. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/expectedbehavior.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/expectedbehavior.md new file mode 100644 index 0000000000..c8894ce8fb --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/expectedbehavior.md @@ -0,0 +1,19 @@ +--- +title: "Expected Behavior When Policies No Longer Apply" +description: "Expected Behavior When Policies No Longer Apply" +sidebar_position: 40 +--- + +# Expected Behavior When Policies No Longer Apply + +When Endpoint Policy Manager Start Screen & Taskbar Manager policies apply, users cannot work around +your settings. However, when the GPO (or other policy delivery method) applying that policy no +longer applies, reverts, or is deleted, the groups will remain with icons intact, as seen in +Figure 49. + +![collections_policy_settings_16](../assets/collections_policy_settings_16.webp) + +Figure 49. After a policy no longer applies, users are free to manage their Start Menu groups. + +At this point, users are free to add or remove icons from the groups or delete the group. If the +policies ever come back into effect, they will reapply and lock down the groups again. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/exportcollections.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/exportcollections.md new file mode 100644 index 0000000000..c535ff89d9 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/exportcollections.md @@ -0,0 +1,51 @@ +--- +title: "Exporting Collections" +description: "Exporting Collections" +sidebar_position: 50 +--- + +# Exporting Collections + +Appendix A: [Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md) explains how +to use the Endpoint Policy Manager Exporter to wrap up any Endpoint Policy Manager directive and +deliver it using Microsoft Endpoint Manager (SCCM and Intune), KACE, your own MDM service, or +Endpoint Policy Manager Cloud. For Endpoint Policy Manager Cloud, you should automatically acquire a +license as seen in Figure 50. For Endpoint Policy Manager with an MDM service, the license should +come in your MSI license bundle. + +![collections_policy_settings_17](../assets/collections_policy_settings_17.webp) + +Figure 50. Endpoint Policy Manager Cloud customers are licensed for Endpoint Policy Manager Start +Screen & Taskbar Manager. + +:::note +For a video demonstrating the use of Endpoint Policy Manager Cloud with Endpoint Policy +Manager Start Screen & Taskbar Manager, see +[Endpoint Policy ManagerStart Screen & Taskbar Manager: Manage non-domain joined machines using Endpoint Policy Manager Cloud](./video-learning-center/methods/nondomainjoined.md). +::: + + +To export a policy for later use with Endpoint Policy Manager Exporter or Endpoint Policy Manager +Cloud, right-click the Start Screen Manager node, or a collection, and select "Export Collections as +XML," as demonstrated in Figure 51 and Figure 52. + +:::note +For a video of exporting Endpoint Policy Manager Start Screen & Taskbar Manager and using +Endpoint Policy Manager Exporter with an MDM service, watch +[Endpoint Policy Manager and MDM walk before you run](/docs/endpointpolicymanager/knowledgebase/gettingstartedmdm/videolearningcenter/gettingstarted/testsample.md). +::: + + +![collections_policy_settings_18](../assets/collections_policy_settings_18.webp) + +Figure 51. Exporting all collections for later use. + +![collections_policy_settings_19](../assets/collections_policy_settings_19.webp) + +Figure 52. Exporting the policy for later use. + +Note that exported collections or policies maintain any Item-Level Targeting set within them. If +you've used items that represent Group Membership in Active Directory, then those items will only +function when the machine is domain-joined. For more information about exporting settings and using +Endpoint Policy Manager Exporter utility, see Appendix A: +[Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md). diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/processorderprecedence.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/processorderprecedence.md new file mode 100644 index 0000000000..bd04311129 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/processorderprecedence.md @@ -0,0 +1,81 @@ +--- +title: "Understanding Processing Order and Precedence" +description: "Understanding Processing Order and Precedence" +sidebar_position: 30 +--- + +# Understanding Processing Order and Precedence + +Within a particular GPO (Computer or User side), the processing order is counted in numerical order. +So lower-numbered collections attempt to process first, and higher-numbered collections attempt to +process last as shown in Figure 46. Then, within any collection, each policy is processed in +numerical order from lowest to highest, as seen in Figure 47. + +![collections_policy_settings_13](../assets/collections_policy_settings_13.webp) + +Figure 46. The order in which collections are processed. + +![collections_policy_settings_14](../assets/collections_policy_settings_14.webp) + +Figure 47. Within collections, group policies are processed in order, starting with the lowest +number. + +Then finally, within a Group, all the icons are placed according to their position (column followed +by row). Note the final placement might not be exactly as expected because of the icons sizes. You +might need to adjust the Position fields to get it to look precisely how you want (as shown in +Figure 48). + +![collections_policy_settings_15](../assets/collections_policy_settings_15.webp) + +Figure 48. The processing order of multiple policy items within a group contained within a +collection. + +## Merging and Conflicts + +Endpoint Policy Manager Start Screen & Taskbar Manager will merge all GPOs and collections, unless +there is a conflict. That means that instead of having one flat Start Menu and Taskbar XML file that +everyone must use and agree upon, you can distribute the directives across Endpoint Policy Manager +collections or GPOs, and everything that doesn't conflict will merge perfectly. + +For example, consider that you have the following two GPOs: + +- GPO1—Browser Apps Group: Chrome, Firefox, Internet Explorer +- GPO2—Office Apps: Word, Excel, PowerPoint + +You will get two unique groups on the Start Menu: Browser App Group and Office Apps. This works the +same for multiple collections (within a GPO or between GPOs). However, you still need to be aware of +conflicts between Endpoint Policy Manager Start Screen policies and Endpoint Policy Manager Taskbar +Manager policies. + +For Endpoint Policy Manager Start Screen policies, the following general rules apply: + +- If you are using "Partial (Preserve)" or "Merge" mode and you create a group with the same name as + a user group (or a pre-created operating system default group, like Play, Create, and so on), your + group will end up removing the existing group. +- If you are using "Partial (Preserve)" and "Merge" mode, and you specify an icon in a group, your + icon placement will end up removing the icon from the existing group. +- When using a GPO, multiple policies can affect the machine due to natural Group Policy precedence. + When a conflict occurs, the general rule is that the GPO that was applied last will have highest + precedence. Then after that, the mode of the group ("Create," "Replace," "Update," or "Delete") + will be evaluated. +- You can have multiple GPOs with Endpoint Policy Manager Start Screen contents (and also get + Endpoint Policy Manager policies from other sources like MDM, Microsoft Endpoint Manager [SCCM and + Intune], etc.) and these policies will all be merged together, unless there is a conflict. See the + next section "Precedence" for details. + +For Endpoint Policy Manager Taskbar Manager, the following general rule applies: in "Merge" mode, +all items are merged together. That means that the operating system defaults, the user-pinned items, +and the items you've pinned will all be merged together. In the case of a conflict, the policy +written last wins. + +## Precedence + +Policies can be delivered by Group Policy and non-Group Policy methods such as Microsoft Endpoint +Manager (SCCM and Intune) via Endpoint Policy Manager Exporter or Endpoint Policy Manager Cloud. As +such, the Endpoint Policy Manager engine needs to make a final determination whether there is any +overlap of policies. Here is how the precedence works: + +- Policies delivered through Endpoint Policy Manager Cloud have the lowest precedence. +- Policies delivered through Endpoint Policy Manager files have the next highest precedence. +- Policies delivered through Endpoint Policy Manager Group Policy directives have the highest + precedence. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/_category_.json new file mode 100644 index 0000000000..89f4a0d09d --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Start Screen Manager Settings", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/groupaction.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/groupaction.md new file mode 100644 index 0000000000..ae984c8650 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/groupaction.md @@ -0,0 +1,35 @@ +--- +title: "Understanding Group Action Modes" +description: "Understanding Group Action Modes" +sidebar_position: 10 +--- + +# Understanding Group Action Modes + +In the Start Screen Tile Group Editor, there are various values that can be selected for the Action +field. The options are described below. + +- Create: The option for "Create" only takes effect when a matching group of the same name is added + by an existing Endpoint Policy Manager policy. If a matching group is found, then selecting + "Create" will add icons to this group. The result is that groups with the same name are not + changed. If a group of the same name does NOT exist, then selecting "Create" will create the group + and add the icons listed in this group. In short, a new group with new icons is only created when + one does not already exist. +- Replace: The option for "Replace" only takes effect when a matching group of the same name is + created by another Endpoint Policy Manager policy—it does nothing if there is not a matching group + of the same name. If a group of the same name is created by another Endpoint Policy Manager + policy, selecting "Replace" will REMOVE all existing icons in the group, and REPLACE them with + what is in this group. If a group of the same name was NOT created by another Endpoint Policy + Manager policy, then NOTHING will occur. +- Update (Default): The option for "Update" will create groups if they don't exist, and update + groups if they do exist. It will then add your icons to the group. Update mode will not update a + group unless the group is already present; so you may want to ensure the "Create if not present" + checkbox is checked (it is by default); this will create groups if they do not already exist. +- Delete: The option for "Delete" will delete a group with a matching name. If a group of the same + name does NOT exist because of a Endpoint Policy Manager policy, then NOTHING will occur. +- Update + "Create if not present": This setting will explicitly check to see if the group already + exists. If the group doesn't exist, and this checkbox is checked, the group will be created. +- Replace + "Skip if not present": This option is only available when "Replace" is selected. When + this checkbox is checked, the group will be replaced only if a matching group name is not found. +- The default behavior is: create new groups if they do not exist and update groups if they do + exist. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/overview.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/overview.md new file mode 100644 index 0000000000..059946e24b --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/overview.md @@ -0,0 +1,120 @@ +--- +title: "Start Screen Manager Settings" +description: "Start Screen Manager Settings" +sidebar_position: 10 +--- + +# Start Screen Manager Settings + +In the Quickstart, we created a collection by right-clicking within Endpoint Policy Manager Start +Screen Manager or Endpoint Policy Manager Taskbar Manager and selecting Add | New Collection as seen +in Figure 32. + +![collections_policy_settings](../../assets/settings/startscreen/collections_policy_settings.webp) + +Figure 32. Creating collections with Endpoint Policy Manager Start Screen & Taskbar Manager. + +For Endpoint Policy Manager Start Screen Manager, collections have two functions. As mentioned +previously, they hold policies that create Windows 10 groups. But a Endpoint Policy Manager Start +Screen Manager collection also defines how those groups will react. The two options for a Endpoint +Policy Manager Start Screen Manager collection can be seen in Figure 33. + +![quickstart_start_screen_manager_3](../../assets/settings/startscreen/quickstart_start_screen_manager_3.webp) + +Figure 33. Collections hold policies and specify the layout mode. + +There are two layout modes for a Endpoint Policy Manager Start Screen Manager collection. One is +"Partial (Preserve)," which will maintain a user's existing groups, as well as any default groups, +while adding your new groups to theirs. Users will not be able to modify the groups you assign. The +other layout mode is "Full (Replace)," which will remove any existing groups and replace them with +your new groups. Users will not be able to modify the groups you assign. + +There are two layout size options for a Endpoint Policy Manager Start Screen Manager collection as +shown in Figure 34. If you do not specify a layout size, the default will be Medium (Two Columns). + +![collections_policy_settings_1](../../assets/settings/startscreen/collections_policy_settings_1.webp) + +Figure 34. Choosing a layout size. + +You can also select the Item-Level Targeting button to specify when this collection will apply. For +instance, you might choose "Partial (Preserve)" on Windows 10 desktops and you might choose to have +another collection with "Full (Replace)" on Windows 10 laptops. + +The "Edit Item Level Targeting" menu item brings up the Targeting Editor, which is shown in +Figure 35. You can select any combination of characteristics you want to test for. Administrators +familiar with Group Policy Preferences' Item-Level Targeting will be at home in this interface as it +is functionally equivalent. + +You can apply one or more targeting items to a policy, which enables targeting items to be joined +logically, also shown in Figure 35. You can also add targeting collections, which group together +targeting items in much the same way parentheses are used in an equation. In this way, you can +create a complex determination about where a policy will be applied. Collections may be set to +"And", "Or", "Is", or "Is Not." + +There are a few things to note about Figure 35. It is representative of the basic capabilities of +the Targeting Editor. Endpoint Policy Manager Start Screen & Taskbar Manager cannot filter by user +group since the node is only available on the Computer side. In addition, Endpoint Policy Manager +Start Screen & Taskbar Manager is only valid for Windows 8.1 and later. + +![collections_policy_settings_2](../../assets/settings/startscreen/collections_policy_settings_2.webp) + +Figure 35. In this example, the Pak would only apply to Windows 10 machines when the machine is +portable and the user is in the FABRIKAM\Traveling Sales Users group. + +Below are some real-world examples of of how you can use Item-Level Targeting. + +- Software prerequisites. If you want to configure an application's settings, first make sure the + application is installed on the user's computer before configuring it. You can use File Match or + Registry Match targeting items (or both) to verify a specific version of a file or a registry + entry is present. (For an example of this, look in the Uninstall registry key.) +- Mobile computers. If you want to deploy settings exclusively for users on mobile PCs, then filter + the rule to apply only to mobile PCs by using the "Portable Computer" targeting item. +- Operating system version. You can specify different settings for applications based on the + operating system version. To do this, create one rule for each operating system. Then filter each + rule using the "Operating System" targeting item. +- Group membership. You can link the Group Policy Object (GPO) to the whole domain or organizational + unit (OU), but only members within a specific group will pick up and process the rule settings. +- IP range. You can specify different settings for various IP ranges, like different settings for + the home office and each field office. + +Close the editor when you are done. Note in Figure 36 that the icon for the policy or collection has +changed to orange, which shows that it now has Item-Level Targeting. + +![collections_policy_settings_3](../../assets/settings/startscreen/collections_policy_settings_3.webp) + +Figure 36. When the icon is orange, the entry has Item-Level Targeting. + +When Item-Level Targeting is on, the policy won't apply unless the conditions are True. If +Item-Level Targeting is on a collection, then none of the items in the collection will apply unless +the Item-Level Targeting on the collection evaluates to True. + +Inside Endpoint Policy Manager Start Screen Manager collections are policies for groups. You created +a Group Policy earlier called "My Important Apps." You can select "Change Group Level Targeting" to +jump right into the Item-Level Targeting Editor, or click "Edit Group," as shown in Figure 37 to see +all Group options (including Item-Level Targeting). + +![collections_policy_settings_4](../../assets/settings/startscreen/collections_policy_settings_4.webp) + +Figure 37. Clicking on "Edit Group" will enable you to see all group level options. + +The group level options can be seen in Figure 38. + +![collections_policy_settings_5](../../assets/settings/startscreen/collections_policy_settings_5.webp) + +Figure 38. Endpoint Policy Manager Start Screen Manager groups have various options you can +configure. + +The fields inside the Group Editor are as follows: + +- Group Name: The name of the actual Windows 10 group that you'll be manipulating on the computer. +- Comment: Space for optional comments to be added. +- State: Determines if the policy should apply or not. +- Action: Default settings are "Update" and "Create if not present." This will be described in more + detail in the next section. +- Update Mode: Determines where new icons will be added. "Add to the Tail" will add new icons from + the end and "Insert at the top" will insert new icons from the front of the group. +- Placeholder: This is needed when an application is absent, but you want to make a pointer or + reference to them anyway. In this case, you can make a "gap" (which puts in a black, empty gap + tile) or you can insert an "Edge link" (which will explain what was missing). This will be + described in more detail in an upcoming section. +- Item-Level Targeting: This was described above. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/placeholder.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/placeholder.md new file mode 100644 index 0000000000..307525d6c4 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/startscreen/placeholder.md @@ -0,0 +1,52 @@ +--- +title: "Understanding Placeholder Modes" +description: "Understanding Placeholder Modes" +sidebar_position: 20 +--- + +# Understanding Placeholder Modes + +In the Start Screen Tile Group Editor, there are two values that can be selected for the Placeholder +field: "Gap" or "Edge link." The purpose of this field is to help identify errors in Endpoint Policy +Manager Start Screen policies. For instance, you might make a policy that is attempting to add an +application that doesn't exist. When you do this with Endpoint Policy Manager Start Screen, +something has to take the place of that application: either a gap or an Edge link. The following are +examples of using these two options when you are trying to add icons for applications that don't +exist on the endpoint. + +Option 1 - Gap: In Figure 39 blank areas that have been "gapped" are highlighted in red. This is +where the icons would go when the application is correctly deployed to the endpoint. + +![collections_policy_settings_6](../../assets/settings/startscreen/collections_policy_settings_6.webp) + +Figure 39. Using the gap placeholder mode. + +Option 2 - Edge Link: In Figure 40, missing applications are noted with the words "Missing +Application" (highlighted in red). + +![collections_policy_settings_7](../../assets/settings/startscreen/collections_policy_settings_7.webp) + +Figure 40. Using the Edge link placeholder mode. + +When you click the Missing Application tile, you are alerted to the nature of the error, as shown in +Figure 41. + +![collections_policy_settings_8](../../assets/settings/startscreen/collections_policy_settings_8.webp) + +Figure 41. Details of an error when Edge tiles are used. + +In this way, users can tell you about missing applications and give you the diagnostic information +you need in order to deploy the application or correct the Endpoint Policy Manager Start Screen +policy. + +One extra note here about missing applications is that if Item-Level Targeting is used on an +application icon, and it evaluates to FALSE, then the result is always a gap. For instance, if you +wanted Adobe Reader to only appear when the machine was a laptop, but you were really using a +desktop (evaluated with Item-Level Targeting), then the result would be as shown in Figure 42. + +![collections_policy_settings_9](../../assets/settings/startscreen/collections_policy_settings_9.webp) + +Figure 42. Applications with Item-Level Targeting evaluating to FALSE will always have a gap. + +The application is not shown and there is no Edge tile to explain why. This is expected when +Item-Level Targeting for an application tile evaluates to False. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/taskbar.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/taskbar.md new file mode 100644 index 0000000000..f79c96d593 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/collectionssettingsi/taskbar.md @@ -0,0 +1,42 @@ +--- +title: "Taskbar Manager Settings" +description: "Taskbar Manager Settings" +sidebar_position: 20 +--- + +# Taskbar Manager Settings + +Collections are also present (and required) for Endpoint Policy Manager Taskbar Manager. In the +Quickstart, we created a collection by right-clicking within Endpoint Policy Manager Start Screen +Manager or Endpoint Policy Manager Taskbar Manager and selecting Add | New Collection. To see the +collection options, you can right-click on the name of the collection and select "Edit Collection," +as seen in Figure 43. + +![collections_policy_settings_10](../assets/settings/collections_policy_settings_10.webp) + +Figure 43. Editing collections for Taskbar Manager. + +The Endpoint Policy Manager Taskbar Manager Pinned Collection Editor can be seen in Figure 44. + +![collections_policy_settings_11](../assets/settings/collections_policy_settings_11.webp) + +Figure 44. Endpoint Policy Manager Taskbar Manager Pinned Collection Editor options. + +The fields inside the Taskbar Manager Pinned Collection Editor are as follows: + +- Collection Name: The name of the collection you'll be creating, which isn't displayed on the + endpoint. +- Comment: Space for optional comments to be added. +- State: Determines if the collection should apply or not. +- Action: Can be set to "Merge" or "Replace." Selecting "Merge" maintains OS defaults and anything a + user has manually pinned to the Taskbar while adding your new items. Selecting "Replace" removes + OS defaults and anything a user has manually pinned while replacing them with your new items. +- Use custom advertisement tile: When desktop items are pinned, they must also be contained in a + Start Menu advertisement tile. The default behavior can be seen in Figure 45, but this can be + changed. If no pinned applications are also in Start Menu groups, then a URL is used as a fallback + display. The icon is then simply a URL within an advertised group. + +![collections_policy_settings_12](../assets/settings/collections_policy_settings_12.webp) + +Figure 45. Pinned desktop icons will appear in the Endpoint Policy Manager Start Screen Manager +advertisement group, or a group of your choice. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/gettoknow.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/gettoknow.md new file mode 100644 index 0000000000..7e49c0cacc --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/gettoknow.md @@ -0,0 +1,37 @@ +--- +title: "Getting to Know Start Screen & Taskbar Manager" +description: "Getting to Know Start Screen & Taskbar Manager" +sidebar_position: 20 +--- + +# Getting to Know Start Screen & Taskbar Manager + +Endpoint Policy Manager Start Screen & Taskbar Manager is contained within two nodes inside the User +and Computer sides: one for Start Screen settings and one for Taskbar settings, as seen in Figure 3. +Start Screen & Taskbar Manager MMC snap-in enables you to create a new Start Screen Manager or +Taskbar Manager policy or collection. + +:::note +You will only see the Start Screen Manager and Taskbar Manager nodes when the latest Admin +Console MSI is installed on the management station. +::: + + +![about_policypak_start_screen_2](assets/about_endpointpolicymanager_start_screen_2.webp) + +Figure 3. The Start Screen Manager and Taskbar Manager nodes. + +The functions of policies, collections, and groups are as follows: + +- Policies are the rules that perform the work (adding or deleting the icons and so on) +- Collections are groupings of policies +- Groups are the actual Windows 10 Start Menu groups that end users will see in the user interface + +To see how to add new collections and policies, see Figure 4. + +![about_policypak_start_screen_3](assets/about_endpointpolicymanager_start_screen_3.webp) + +Figure 4. Adding collections and policies. + +The next sections provide a Quickstart to using the Start Screen Manager node and the Taskbar +Manager node. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/helperutility.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/helperutility.md new file mode 100644 index 0000000000..11b39921fd --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/helperutility.md @@ -0,0 +1,64 @@ +--- +title: "Using the Helper Utility" +description: "Using the Helper Utility" +sidebar_position: 60 +--- + +# Using the Helper Utility + +In the Start Screen & Taskbar Manager Quickstart examples, we recommended that your management +station have the same applications as your target computers, but sometimes that is not practical. +For instance, someone in the Sales department may be the only one who has the "Sales Application +123" desktop application or "Mega Player" UWP installed. Or there could be other instances where you +don't want to install an application on your machine just for the sake of getting it into the Start +Screen or Taskbar. That's where the Start Screen & Taskbar Manager Helper utility comes in. You can +run the Start Screen & Taskbar Manager utility on an endpoint with the application already +installed; however, you should make sure it is one you want to associate a policy with later. + +:::note +For a video overview demonstrating the use of the Start Screen & Taskbar Manager Helper +utility, watch this video: +[Endpoint Policy Manager Start Screen and Taskbar Manager Helper Utility](./video-learning-center/gettingstarted/helperutility.md) +::: + + +The Start Screen & Taskbar Manager Helper utility is found in the Netwrix Endpoint Policy Manager +(formerly PolicyPak) ISO or ZIP download in the PolicyPak Extras folder, as seen in Figure 53. + +![using_the_helper_utility](assets/using_the_helper_utility.webp) + +Figure 53. The Start Screen & Taskbar Manager Helper utility is located in the Extras folder. + +**Step 1 –** When you run the wizard you can choose whether to export registered (desktop) +applications or universal (UWP) applications, as shown in Figure 54. + +![using_the_helper_utility_1](assets/using_the_helper_utility_1.webp) + +Figure 54. The PolicyPak Start Screen & Taskbar Manager Helper utility lets you export registered +and UWP applications. + +**Step 2 –** Then on the "Select registered programs" page, shown in Figure 55, you can leave the +default settings as they are and click "Next." + +![using_the_helper_utility_2](assets/using_the_helper_utility_2.webp) + +Figure 55. The default settings to select all registered applications on the endpoint. + +**Step 3 –** Then on the next screen, shown in Figure 56, you can export the IDs for all the UWP +applications on a machine and click "Next." + +![using_the_helper_utility_3](assets/using_the_helper_utility_3.webp) + +Figure 56. The defaults to select all UWP applications on the endpoint. + +**Step 4 –** Finally, you can export the XML to a file to be used on your management station/GPMC +machine. On your GPMC machine, as you're creating new PolicyPak Start Screen or PolicyPak Taskbar +Manager policies, you can then import from the XML file, as shown in Figure 57. + +![using_the_helper_utility_4](assets/using_the_helper_utility_4.webp) + +Figure 57. On the management station you can import from the XML file. + +At this point, your list will change to what was imported from the XML file. This process means you +don't need to install the actual application on your machine to deliver Endpoint Policy Manager +Start Screen or Endpoint Policy Manager Taskbar Manager policies. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/_category_.json new file mode 100644 index 0000000000..cd9b53d08f --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Ins and Outs", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/advantages.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/advantages.md new file mode 100644 index 0000000000..4882c31aa9 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/advantages.md @@ -0,0 +1,34 @@ +--- +title: "Advantages of Using Start Screen & Taskbar Manager" +description: "Advantages of Using Start Screen & Taskbar Manager" +sidebar_position: 20 +--- + +# Advantages of Using Start Screen & Taskbar Manager + +With Endpoint Policy Manager Start Screen & Taskbar Manager, you don't have to build the perfect +workstation and then export all the Start Screen and Taskbar settings at one time, making sure to +get it all correct the first time or rebuilding the perfect workstation over and over again. +Additionally, if your organization makes a change, for example, to implement 7-Zip instead of +WinZip, you don't have to rebuild your perfect workstation and repeat the process over and over. + +With Endpoint Policy Manager Start Screen & Taskbar Manager you can do the following: + +- Deploy your application as you normally would, using Microsoft Endpoint Manager (SCCM and Intune) + or PDQ Deploy +- Use Endpoint Policy Manager Start Screen & Taskbar Manager to add the application to your desired + Windows 10 Start Screen Group +- Use Endpoint Policy Manager Start Screen & Taskbar Manager to add the application to the Taskbar + +In addition, it's very easy to have different associations for each computer group by making simple +policies for your associations using Endpoint Policy Manager Start Screen & Taskbar Manager. Because +Group Policy creation is distributed (that is, different people can create different GPOs) you can +leverage Endpoint Policy Manager Start Screen & Taskbar Manager when different people have different +needs. In the case of a conflict of two associations, the rules of Group Policy precedence will take +effect. + +Endpoint Policy Manager Start Screen & Taskbar Manager uses the same basic method and policy +settings that the in-box Microsoft method uses. That is Endpoint Policy Manager Start Screen & +Taskbar Manager will create its own XML file (one per computer when computer-side Group Policy is +used and one per user when user-side Group Policy is used). It works with Microsoft's method (using +the XML file and corresponding Group Policy setting), but adds functionality. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/overview.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/overview.md new file mode 100644 index 0000000000..c86908d87c --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/overview.md @@ -0,0 +1,17 @@ +--- +title: "Ins and Outs" +description: "Ins and Outs" +sidebar_position: 10 +--- + +# Ins and Outs + +Start Screen & Taskbar Manager consists of two parts: Start Screen Manager and Taskbar Manager. +Together they have two goals: + +- Create Windows 10 Start Menu groups and place specific applications' icons within them +- Pin applications to the Windows 10 Taskbar + +In this manual, we will walk through examples of how to perform these functions. We'll start out by +understanding the need to manage Start Screen and Taskbar settings and the use of the in-box method +from Microsoft; then, we'll learn how Endpoint Policy Manager can make the whole process easier. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/windows10.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/windows10.md new file mode 100644 index 0000000000..775d9a4bca --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/insouts/windows10.md @@ -0,0 +1,56 @@ +--- +title: "Managing Windows 10 Start Screen and Taskbar with the In-Box Method" +description: "Managing Windows 10 Start Screen and Taskbar with the In-Box Method" +sidebar_position: 10 +--- + +# Managing Windows 10 Start Screen and Taskbar with the In-Box Method + +If you didn't have Start Screen & Taskbar Manager, you could still manage Start Screen and Taskbar +settings on Windows 10, but it would be difficult and not very user-friendly. + +The following is a Microsoft-sanctioned way to establish the Start Screen and Taskbar for Windows +8.1 and Windows 10: + +1. Create a "perfect machine," fully installed with all applications. +2. Correctly configure all the Start Screen settings by putting them into the groups you want and + pinning any items to the Taskbar. +3. Use the Powershell command to export the Start Screen layout XML file. The command would be + something like `export-startlayout –path .xml`. +4. Use Group Policy to ensure that specific computers use this XML file. + +The exported file from this process might look something like what's seen in Figure 1. + +![about_policypak_start_screen](../assets/insouts/about_endpointpolicymanager_start_screen.webp) + +Figure 1. An exported XML file using the Microsoft-sanctioned way to establish the Start Screen and +Taskbar for Windows 10. + +Next, you would configure the Group Policy setting called "Start Layout," seen in Figure 2. + +![about_policypak_start_screen_1](../assets/insouts/about_endpointpolicymanager_start_screen_1.webp) + +Figure 2. Configuring Group Policy settings after establishing the Start Screen and Taskbar using +the in-box, Microsoft-sanctioned way. + +The disadvantages of using this in-box method for Windows 10 are as follows: + +- You need a perfect machine for each new application deployment. +- You will likely need different associations files for different machines. +- You might need to segment your computers into different organizational units (OUs) if you have + different Start Menu groups for each group. +- You need to follow this process, even if you have just one or two applications you want to add to + the Start Screen or Taskbar. +- To get the best experience, you need to do this for all applications a user is going to ever need + on the Start Menu or Taskbar. +- The entire XML file must be "perfect" and not have any variations. + +In summary: + +- When your needs change, there is nothing dynamic about this process. +- This process is all manual. +- This process requires a lot of effort to build the "perfect machine" for each different computer + group, export the files one by one for each group, and ensure all computers get the correct file. + +All of this becomes time consuming and will quickly get out of hand every time you must update and +roll out an application that will be the registered extension or protocol. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/overview.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/overview.md new file mode 100644 index 0000000000..0ba2581d4c --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/overview.md @@ -0,0 +1,77 @@ +--- +title: "Start Screen & Taskbar Manager" +description: "Start Screen & Taskbar Manager" +sidebar_position: 30 +--- + +# Start Screen & Taskbar Manager + +:::note +Before reading this section, please ensure you have read +[Installation Quick Start](/docs/endpointpolicymanager/manuals/introductionandquick/overviewinstall/overviewinstall.md), which will help you +learn to do the following: +::: + + +- Install the Admin MSI on your GPMC machine +- Install the CSE on a test Windows machine +- Set up a computer in Trial mode or Licensed mode +- Set up a common OU structure + +Optionally, if you don't want to use Group Policy, read the section in Appendix A: Advanced Concepts +on Group Policy and non-Group Policy methods (MEMCM, KACE, and MDM service or Endpoint Policy +Manager Cloud) ([Using Endpoint Policy Manager with MDM and UEM Tools](/docs/endpointpolicymanager/manuals/introductionandquick/mdm/uemtools/uemtools.md)) to +deploy your directives. + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Start Screen & Taskbar Manager enables you to +perform the following operations on Windows 10: + +- Place specific tiles for Desktop Edge and Universal Windows Platform (UWP) applications into your + own desired Start Menu groups +- Remove all existing Start Menu groups (created by users or default from Microsoft) +- Configure the Start Menu to enable users to create their own groups +- Pin applications to the Taskbar or remove user-pinned applications from the Taskbar + +:::note +For an overview of Endpoint Policy Manager Start Screen & Taskbar Manager, watch the +videos at +[https://www.endpointpolicymanager.com/products/endpointpolicymanager-start-screen-taskbar-manager.html](https://www.endpointpolicymanager.com/products/endpointpolicymanager-start-screen-taskbar-manager.html). +::: + + +The basic way to use Start Screen & Taskbar Manager is as follows: + +- Create rules to express which applications should appear in which Start Menu group +- Export the Start Screen & Taskbar Manager rules and deliver them using: + + - Microsoft Endpoint Manager (SCCM and Intune) + - Your own systems management software + - A mobile device management (MDM) service + - Endpoint Policy Manager Cloud service + +- Allow the client machine with the Endpoint Policy Manager client-side extension (CSE) to embrace + the directives and perform the work. + +:::note +If you use the Endpoint Policy Manager Cloud service, you can deliver Group Policy +settings even to non-domain-joined machines over the Internet. +::: + + +## Moving Parts + +- A management station. The Endpoint Policy Manager Admin Console MSI must be installed on your + management station where you create group policy objects (GPOs). Once it's installed, you'll see + the Endpoint Policy Manager | Start Screen Manager node and Endpoint Policy Manager | Taskbar + Manager node. +- The Endpoint Policy Manager CSE. This runs on the client (target) machine and is the same CSE for + all Endpoint Policy Manager products. There isn't anything separate to install, and the Endpoint + Policy Manager CSE must be present in order to accept Endpoint Policy Manager Start Screen & + Taskbar Manager directives via Group Policy, or when using Microsoft Endpoint Manager (SCCM and + Intune), KACE, MDM, or similar utilities. +- Endpoints. In order to use these, they must be licensed for Endpoint Policy Manager Start Screen & + Taskbar Manager using one of the licensing methods. +- Endpoint Policy Manager Exporter (optional). A free utility that lets you take Endpoint Policy + Manager Admin Templates Manager and our other products' XML files and wrap them into a "portable" + MSI file for deployment using Microsoft Endpoint Manager (SCCM and Intune), an MDM service, or + your own systems management software. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen.md new file mode 100644 index 0000000000..c3257ed478 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen.md @@ -0,0 +1,23 @@ +--- +title: "XML Data Files from Endpoint Policy Manager Start Screen Manager" +description: "XML Data Files from Endpoint Policy Manager Start Screen Manager" +sidebar_position: 90 +--- + +# XML Data Files from Endpoint Policy Manager Start Screen Manager + +Endpoint Policy Manager Start Screen Manager for Windows 10 settings can be exported as an XML file. +You can export a single policy, a collection, or the whole node. For example, right-click +`Computer Configuration | PolicyPak | Start Screen Manager` for Windows 10 or +`User Configuration | PolicyPak | Start Screen Manager` for Windows 10, and pick the root node or +collection you wish to export, as shown in Figure 22. + +![deploying_policypak_directives_22](/images/endpointpolicymanager/mdm/xmldatafiles/deploying_endpointpolicymanager_directives_22.webp) + +Figure 22. Exporting a whole collection using Endpoint Policy Manager Start Screen Manager. + +You can export a single Endpoint Policy Manager Start Screen Manager entry, as shown in Figure 23. + +![deploying_policypak_directives_23](/images/endpointpolicymanager/mdm/xmldatafiles/deploying_endpointpolicymanager_directives_23.webp) + +Figure 23. Exporting a single Endpoint Policy Manager Start Screen Manager entry. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/_category_.json new file mode 100644 index 0000000000..3f972afea4 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Quick Start - Start Screen Manager", + "position": 30, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/desktopapplications.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/desktopapplications.md new file mode 100644 index 0000000000..6ae182237c --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/desktopapplications.md @@ -0,0 +1,69 @@ +--- +title: "Adding Desktop Applications" +description: "Adding Desktop Applications" +sidebar_position: 30 +--- + +# Adding Desktop Applications + +Next, you'll add a desktop application. + +**Step 1 –** To do this, right-click the policy and select Add | New Desktop Application Tile. When +you add a new desktop application tile, you'll get a wizard asking you the source of the desktop +application, as shown in Figure 18. + +![quickstart_start_screen_manager_13](../assets/startscreen/quickstart_start_screen_manager_13.webp) + +Figure 18. The Endpoint Policy Manager Start Screen Manager Desktop Application Tile wizard has +three methods you can choose. + +**Step 2 –** Once you specify to add a desktop application tile, you can use one of three methods: + +- Registered application (recommended): These are applications that are fully installed on the + machine you using to create the policy, and also fully installed on the target machine. +- Registered application (advanced): Same as above, but with more configurable options, such as + Shortcut Icon. +- Custom application: This is a pointer to any .exe application file. This is useful in cases where + an application is present on the machine, but not fully installed, like a portable application, + ThinApp application, or a single .exe file that requires no installation. + +For this Quickstart, select "Registered application (recommended)," and then click "Next." Then +select Adobe Acrobat from the list (shown in Figure 19) and click "Next." + +![quickstart_start_screen_manager_14](../assets/startscreen/quickstart_start_screen_manager_14.webp) + +Figure 19. Selecting a registered application from the machine. + +**Step 3 –** Then you can select the specifics for the tile, namely the tile position and the tile +size, as seen in Figure 20. + +![quickstart_start_screen_manager_15](../assets/startscreen/quickstart_start_screen_manager_15.webp) + +Figure 20. Desktop Applications can have two tile sizes. + +The values for "Tile Position" are recommended automatically based on other tiles you might have +already placed within this same group. + +:::note +The automatic recommendation does not take into consideration whether you have created the +group already and are updating or changing it. +::: + + +The position is identified by columns and rows within the group. This will allow you to precisely +place your tile within the group with a little experimentation. + +**Step 4 –** You can select a tile size of Small or Medium. (UWP applications can be any of the four +sizes.) For this Quickstart, select the "Medium" size and then click "Next." On the Finish page, +choose a policy name, such as "Acro Reader," as shown in Figure 21, and click "Finish." + +![quickstart_start_screen_manager_16](../assets/startscreen/quickstart_start_screen_manager_16.webp) + +Figure 21. The policy name you select is the internal "display name" of the policy you just created. + +The Start Screen icon policy you created can be seen in Figure 22. + +![quickstart_start_screen_manager_17](../assets/startscreen/quickstart_start_screen_manager_17.webp) + +Figure 22. The Endpoint Policy Manager Start Screen Manager policy is contained within the +collection. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/edgetiles.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/edgetiles.md new file mode 100644 index 0000000000..501d232cd8 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/edgetiles.md @@ -0,0 +1,44 @@ +--- +title: "Adding Edge Tiles" +description: "Adding Edge Tiles" +sidebar_position: 40 +--- + +# Adding Edge Tiles + +Next, you'll add an Edge tile. + +**Step 1 –** To do this, right-click the policy and select Add | New Edge Tile, as seen in Figure +23.  Note that this is a legacy feature and is scheduled to be depreciated as it is for the old +version of Edge. + +![quickstart_start_screen_manager_18](../assets/startscreen/quickstart_start_screen_manager_18.webp) + +Figure 23. Adding Edge tile policies. + +**Step 2 –** You can type in a URL or click "Select from favorites," as shown in Figure 24. + +![quickstart_start_screen_manager_19](../assets/startscreen/quickstart_start_screen_manager_19.webp) + +Figure 24. Specifying the display name and URL for an Edge tile. + +**Step 3 –** You can change the size and color as you wish, as shown in Figure 25. + +![quickstart_start_screen_manager_20](../assets/startscreen/quickstart_start_screen_manager_20.webp) + +Figure 25. Changing the background color of the icon. + +**Step 4 –** The result of adding an Edge tile can be seen in Figure 26. + +![quickstart_start_screen_manager_21](../assets/startscreen/quickstart_start_screen_manager_21.webp) + +Figure 26. The Edge tile appears in the policy list. + +**Step 5 –** At this point, you can run GPUpdate on your endpoint, then log off and log on again. +The result of adding three Start Screen Manager icons in your Start Screen Manager group is shown in +Figure 27. Note that recent builds of Endpoint Policy Manager Start Screen & Taskbar Manager require +you to log off and log on again to see the Start Menu changes. + +![quickstart_start_screen_manager_22](../assets/startscreen/quickstart_start_screen_manager_22.webp) + +Figure 27. The application tiles inside the new group. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/overview.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/overview.md new file mode 100644 index 0000000000..34a8614fac --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/overview.md @@ -0,0 +1,36 @@ +--- +title: "Quick Start - Start Screen Manager" +description: "Quick Start - Start Screen Manager" +sidebar_position: 30 +--- + +# Quick Start - Start Screen Manager + +:::note +For some video overviews of Start Screen & Taskbar Manager, see Start Screen & Task Bar +Manager > [Video Learning Center](./video-learning-center/videolearningcenter.md). +::: + + +If you want to follow along with this Quickstart guide for Start Screen Manager, we suggest you +first download some applications on your Windows 10 management station and your endpoint. Start +Screen & Taskbar Manager is the best and quickest way to set up, test, and manage the Start Screen +and Taskbar from your machine (the Group Policy Editor machine) if you have the same applications as +the target machines. Therefore, we recommend you install Adobe Acrobat Reader twice—once on your +management station and once on your Window 10 endpoint. We suggest the offline MSI installer +package, which can be found at +[https://get.adobe.com/reader/enterprise/](https://get.adobe.com/reader/enterprise/). Make sure, for +the purposes of this Quickstart, you install the same version on your management station as on your +endpoint. + +You should be able to see Acrobat Reader in the Start Menu, as shown in Figure 5. + +![quickstart_start_screen_manager](../assets/startscreen/quickstart_start_screen_manager.webp) + +Figure 5. Adobe Reader is installed on the GPMC machine and the Windows 10 Endpoint. + +After Adobe Reader is installed, we can see that it is not automatically assigned to any group in +the Start Menu. Using Start Screen & Taskbar Manager, we want to place all of our newly installed +applications into a single group called "My Important Apps." In this Quickstart, we will create a +group policy object (GPO) and link it to your sample users. (You could also create and link a GPO to +your computers, but we will not be doing that in this Quickstart.) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/uwpapplications.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/uwpapplications.md new file mode 100644 index 0000000000..aab18b6539 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/uwpapplications.md @@ -0,0 +1,51 @@ +--- +title: "Adding UWP Applications" +description: "Adding UWP Applications" +sidebar_position: 20 +--- + +# Adding UWP Applications + +**Step 1 –** First, you'll add a UWP application, Windows Calculator. To do this, right-click the +policy and select Add | New Universal (UWP) Application Tile. Clicking "Next" will display one of +two things: + +- If your management station has zero or few UWP applications installed (typically when your + management station is a 2012R2 2016 or later server), then you'll see a list of common UWP + applications. +- If your machine is running Windows 10, then you will see the commonly installed UWP apps, plus a + list of the UWP applications installed on your machine (and available to your user account). + +**Step 2 –** An example of the UWP applications picker can be seen in Figure 14. If you are on a +server with few UWP applications, click "Include common apps" to see many Windows 10 built-in apps. +For this Quickstart example, select Calculator, as seen in Figure 14. + +![quickstart_start_screen_manager_9](../assets/startscreen/quickstart_start_screen_manager_9.webp) + +Figure 14. Picking UWP applications from a common list or from your machine. + +:::note +Optionally, if you don't have the application installed on your management station, but +you know the ID of the UWP (also known as the UWA or Universal Windows Application Identifier) you +can select "Custom Universal Windows Platform application," then input the ID. +::: + + +**Step 3 –** Next, in the tile settings window, you'll see that UWP applications have four possible +sizes. For this Quickstart, select the largest tile size, as shown in Figure 15, and click "Next." + +![quickstart_start_screen_manager_10](../assets/startscreen/quickstart_start_screen_manager_10.webp) + +Figure 15. UWP applications have four icon tile sizes. + +**Step 4 –** Next, type a policy name, as seen in Figure 16, and click "Finish." + +![quickstart_start_screen_manager_11](../assets/startscreen/quickstart_start_screen_manager_11.webp) + +Figure 16. Specifying the UWP policy name. + +**Step 5 –** You'll see the UWP application icon entry, as shown in Figure 17. + +![quickstart_start_screen_manager_12](../assets/startscreen/quickstart_start_screen_manager_12.webp) + +Figure 17. The UWP application icon entry. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/windows10.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/windows10.md new file mode 100644 index 0000000000..fff1258dca --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreen/windows10.md @@ -0,0 +1,97 @@ +--- +title: "Creating a Windows 10 Screen Collection and Group" +description: "Creating a Windows 10 Screen Collection and Group" +sidebar_position: 10 +--- + +# Creating a Windows 10 Screen Collection and Group + +**Step 1 –** To start out, assume that we have a GPO named "PP Start Screen & Taskbar Policies," +which is linked to the Sales OU, which contains user accounts. Now, in User Configuration | Endpoint +Policy Manager | Start Screen Manager for Windows 10, select Add | New Collection, as seen in +Figure 6. + +![quickstart_start_screen_manager_1](../assets/startscreen/quickstart_start_screen_manager_1.webp) + +Figure 6. Creating a new collection using Endpoint Policy Manager Start Screen Manager. + +**Step 2 –** Next, you'll see the "Add new collection" dialog, as shown in Figure 7. + +![quickstart_start_screen_manager_2](../assets/startscreen/quickstart_start_screen_manager_2.webp) + +Figure 7. Endpoint Policy Manager Start Screen Manager collections are used to group together +policies and configure the layout mode of all the groups. + +There are two layout modes for a Netwrix Endpoint Policy Manager (formerly PolicyPak) Start Screen +Manager collection. One is "Partial (Preserve)," which will maintain a user's existing groups, as +well as any default groups, while adding your new groups to theirs. Users will not be able to modify +the groups you assign. The other layout mode is "Full (Replace)," which will remove any existing +groups and replace them with your new groups. Users will not be able to modify the groups you +assign. + +**Step 3 –** Let's select the "Partial (Preserve)" layout mode and click "OK" as shown in Figure 8. + +![quickstart_start_screen_manager_3](../assets/settings/startscreen/quickstart_start_screen_manager_3.webp) + +Figure 8. Selecting the "Partial (Preserve)" layout mode. + +You'll see the collection created in both panels in Figure 9. + +![quickstart_start_screen_manager_4](../assets/startscreen/quickstart_start_screen_manager_4.webp) + +Figure 9. A Endpoint Policy Manager Start Screen Manager collection can be seen in both MMC pane +views. + +**Step 4 –** Double-click "Collection 1" to enter it. Then, right-click and select Add | New Group, +as shown in Figure 10. + +![quickstart_start_screen_manager_5](../assets/startscreen/quickstart_start_screen_manager_5.webp) + +Figure 10. Endpoint Policy Manager Start Screen groups must be added to collections. + +**Step 5 –** Next, you'll see the Start Screen Tile Group Editor, shown in Figure 11. + +![quickstart_start_screen_manager_6](../assets/startscreen/quickstart_start_screen_manager_6.webp) + +Figure 11. The Start Screen Tile Group Editor is used to edit the Windows 10 Start Screen group. + +The Group Editor enables you to create or update a Windows 10 Start Menu Group. + +:::note +The Group Editor only applies to groups you make using Endpoint Policy Manager, and +doesn't effect Windows 10 built-in, pre-made groups. +::: + + +The fields inside the Group Editor are as follows: + +- Group Name: The name of the actual item you'll be creating (or changing) on the Windows 10 target + machine. +- Comment: Space for optional comments to be added. +- State: Determines if the policy should apply or not. +- Action: Default settings are "Update" and "Create if not present." This will be described in more + detail in an upcoming section. +- Update Mode: Determines where new icons will be added. "Add to the Tail" will add new icons from + the end and "Insert at the top" will insert new icons from the front of the group. +- Placeholder: This is needed when an application is absent, but you want to make a pointer or + reference to them anyway. In this case, you can make a "gap" (which puts in a black, empty gap + tile) or you can insert an "Edge link" (which will explain what was missing). This will be + described in more detail in an upcoming section. +- Item-Level Targeting: This will be described in more detail in an upcoming section. + +**Step 6 –** For now, input the Group Name "My Important Apps" as seen in Figure 10. Then, keeping +the remainder of the details as shown, click "OK" to continue. Now you'll see a policy entry for the +group "My important apps" as shown in Figure 12. + +![quickstart_start_screen_manager_7](../assets/startscreen/quickstart_start_screen_manager_7.webp) + +Figure 12. A Start Screen group called "My important apps" is created on the end user's machine. + +**Step 7 –** Double-click "My important apps" to go inside the Group. In the next three sections, +you'll add one of each of the icon types (universal [UWP] application tile, desktop application +tile, and Edge tile), by right-clicking and selecting "Add to Group," as seen in Figure 13. + +![quickstart_start_screen_manager_8](../assets/startscreen/quickstart_start_screen_manager_8.webp) + +Figure 13. Use the MMC editor to add a new universal (UWP) application tile, desktop application +tile, and new Edge tile. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/_category_.json new file mode 100644 index 0000000000..d17aafd894 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Troubleshooting", + "position": 70, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/logsusercomputerside.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/logsusercomputerside.md new file mode 100644 index 0000000000..509b8bda94 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/logsusercomputerside.md @@ -0,0 +1,27 @@ +--- +title: "User-Side and Computer-Side Logs" +description: "User-Side and Computer-Side Logs" +sidebar_position: 10 +--- + +# User-Side and Computer-Side Logs + +Endpoint Policy Manager Start Screen & Taskbar Manager settings can be delivered on the User side, +Computer side, or both. Ultimately there is a single file that is created and used to deliver the +Start Screen and Taskbar layout to the user. + +Here is the process the Endpoint Policy Manager client-side extension (CSE) uses when combining +policies from multiple sources: + +- The Computer side is evaluated and written to an XML file. +- The User side is evaluated and written to an XML file. +- In a conflict, the Computer side wins over the User side. +- The results are combined together, and the user's final result is saved as ssmRESULTS.xml. + +The resulting files are stored in + +`\ProgramData\PolicyPak\PolicyPak Start Screen Manager\RSoP\User\:` + +- Computer side: switched.xml +- User side: user.xml +- Final/composite XML: ssmResults.xml diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/overview.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/overview.md new file mode 100644 index 0000000000..4a066b501c --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/overview.md @@ -0,0 +1,21 @@ +--- +title: "Troubleshooting" +description: "Troubleshooting" +sidebar_position: 70 +--- + +# Troubleshooting + +The most common problem with Start Screen & Taskbar Manager is getting it to work the first time. +Here are some tips when trying to troubleshoot Start Screen & Taskbar Manager: + +- Do not try to use Microsoft's method and Netwrix Endpoint Policy Manager (formerly PolicyPak)'s + method for managing the Start Screen and Taskbar on the same Windows 10 endpoints. Only one method + can be used at a time, and multiple methods are not supported. +- Do not try to use a built-in OMA-DM/MDM method and Endpoint Policy Manager's method for managing + the Start Screen and Taskbar on the same Windows 10 endpoints. Only one method can be used at a + time, and multiple methods are not supported. +- Taskbar Manager policies only take effect after the user has received a Group Policy update and + then logs on again. +- Start Screen & Taskbar Manager's policies may not work the very first time a user logs onto a + Windows 10 machine, but will take effect in the background a bit later. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/xmlfiles.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/xmlfiles.md new file mode 100644 index 0000000000..d8aaa4bf4e --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/startscreentaskbar/xmlfiles.md @@ -0,0 +1,24 @@ +--- +title: "Inspecting the XML Files" +description: "Inspecting the XML Files" +sidebar_position: 20 +--- + +# Inspecting the XML Files + +Start Screen & Taskbar Manager will dynamically write the file that Windows needs to make the Start +Screen and Taskbar. This file is called ssmResults.xml, and there will be one file per user located +in + +`%programdata%\PolicyPak\PolicyPak Start Screen Manager\RSoP\User\`, as seen in Figure 58. A +good first troubleshooting step would be to see what the file contains. + +![troubleshooting](/images/endpointpolicymanager/troubleshooting/startscreentaskbar/troubleshooting.webp) + +Figure 58. The ssmResults.xml file shows what Start Screen & Taskbar Manager has performed. + +In looking at the ssmResults.xml file, you can see which icons are to be in which groups, and also +which should be pinned to the Taskbar. If you are expecting an application to be present on the +Start Menu or Taskbar, but it is absent, start by checking this file to see if the application is +present. If the association is absent, then, most likely, the target computer didn't get the policy +to add the icon to the Start Menu or Taskbar. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/taskbar.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/taskbar.md new file mode 100644 index 0000000000..449b7033b8 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/manual/taskbar.md @@ -0,0 +1,24 @@ +--- +title: "XML Data Files from Endpoint Policy Taskbar Manager" +description: "XML Data Files from Endpoint Policy Taskbar Manager" +sidebar_position: 100 +--- + +# XML Data Files from Endpoint Policy Taskbar Manager + +Endpoint Policy Manager Taskbar Manager settings can be exported as an XML file. You can export a +single policy, a collection, or the whole node. For example, right-click +`Computer Configuration | PolicyPak | Taskbar Manager` for Windows 10 or +`User Configuration | PolicyPak | Taskbar Manager` for Windows 10, and pick the root node or +collection you wish to export, as shown in Figure 24. + +![deploying_policypak_directives_24](/images/endpointpolicymanager/mdm/xmldatafiles/deploying_endpointpolicymanager_directives_24.webp) + +Figure 24. Exporting a whole collection using Endpoint Policy Manager Taskbar Manager. + +You can also export a single Endpoint Policy Manager Taskbar Manager entry, as as shown in +Figure 25. + +![deploying_policypak_directives_25](/images/endpointpolicymanager/mdm/xmldatafiles/deploying_endpointpolicymanager_directives_25.webp) + +Figure 25. Exporting a single Endpoint Policy Manager Taskbar Manager entry. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/_category_.json new file mode 100644 index 0000000000..3b18452d1d --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/_category_.json @@ -0,0 +1,7 @@ +{ + "label": "Technical Notes", + "position": 3, + "link": { + "type": "generated-index" + } +} diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/537_1_asdfghkyhj.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/537_1_asdfghkyhj.webp new file mode 100644 index 0000000000..a1023913fb Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/537_1_asdfghkyhj.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/623_1_faq-07-img-01.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/623_1_faq-07-img-01.webp new file mode 100644 index 0000000000..315cd2538b Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/623_1_faq-07-img-01.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/623_2_faq-07-img-02.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/623_2_faq-07-img-02.webp new file mode 100644 index 0000000000..7840779875 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/623_2_faq-07-img-02.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/678_1_image-20191219082753-5.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/678_1_image-20191219082753-5.webp new file mode 100644 index 0000000000..707a7c83fb Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/678_1_image-20191219082753-5.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/678_2_image-20191219082753-6.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/678_2_image-20191219082753-6.webp new file mode 100644 index 0000000000..e23e1bfc4a Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/678_2_image-20191219082753-6.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_1_img-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_1_img-1.webp new file mode 100644 index 0000000000..452ba62c8b Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_1_img-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_2_img-2_950x669.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_2_img-2_950x669.webp new file mode 100644 index 0000000000..607a9631ea Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_2_img-2_950x669.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_3_img-3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_3_img-3.webp new file mode 100644 index 0000000000..cef7d200b4 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_3_img-3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_4_img-4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_4_img-4.webp new file mode 100644 index 0000000000..d2a34ea1b8 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/692_4_img-4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_1_img1_950x233.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_1_img1_950x233.webp new file mode 100644 index 0000000000..ce05379674 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_1_img1_950x233.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_2_img2_950x396.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_2_img2_950x396.webp new file mode 100644 index 0000000000..8deb82264a Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_2_img2_950x396.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_3_img3_950x368.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_3_img3_950x368.webp new file mode 100644 index 0000000000..79f364fc74 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/699_3_img3_950x368.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_11_image-20200723210823-6.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_11_image-20200723210823-6.webp new file mode 100644 index 0000000000..748f1b87f8 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_11_image-20200723210823-6.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_13_image-20200723210823-7.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_13_image-20200723210823-7.webp new file mode 100644 index 0000000000..1f65350dee Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_13_image-20200723210823-7.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_15_image-20200723210823-8_950x998.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_15_image-20200723210823-8_950x998.webp new file mode 100644 index 0000000000..82ac5ad1f6 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_15_image-20200723210823-8_950x998.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_1_image-20200723210823-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_1_image-20200723210823-1.webp new file mode 100644 index 0000000000..9eae3184f0 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_1_image-20200723210823-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_3_image-20200723210823-2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_3_image-20200723210823-2.webp new file mode 100644 index 0000000000..7bf57fb82d Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_3_image-20200723210823-2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_5_image-20200723210823-3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_5_image-20200723210823-3.webp new file mode 100644 index 0000000000..321fc6ea85 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_5_image-20200723210823-3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_7_image-20200723210823-4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_7_image-20200723210823-4.webp new file mode 100644 index 0000000000..1110fcc29c Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_7_image-20200723210823-4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_9_image-20200723210823-5.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_9_image-20200723210823-5.webp new file mode 100644 index 0000000000..365cabfc58 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/735_9_image-20200723210823-5.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_11_image-20200728223134-6.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_11_image-20200728223134-6.webp new file mode 100644 index 0000000000..a41436e0af Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_11_image-20200728223134-6.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_13_image-20200728223134-7.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_13_image-20200728223134-7.webp new file mode 100644 index 0000000000..c07266a52d Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_13_image-20200728223134-7.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_15_image-20200728223134-8.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_15_image-20200728223134-8.webp new file mode 100644 index 0000000000..10ccfec6a6 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_15_image-20200728223134-8.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_17_image-20200728223134-9.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_17_image-20200728223134-9.webp new file mode 100644 index 0000000000..132cc36413 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_17_image-20200728223134-9.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_19_image-20200728223134-10.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_19_image-20200728223134-10.webp new file mode 100644 index 0000000000..06648b7cc9 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_19_image-20200728223134-10.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_1_image-20200728223133-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_1_image-20200728223133-1.webp new file mode 100644 index 0000000000..c3efe37090 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_1_image-20200728223133-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_3_image-20200728223133-2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_3_image-20200728223133-2.webp new file mode 100644 index 0000000000..14175919be Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_3_image-20200728223133-2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_5_image-20200728223134-3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_5_image-20200728223134-3.webp new file mode 100644 index 0000000000..7affb82384 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_5_image-20200728223134-3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_7_image-20200728223134-4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_7_image-20200728223134-4.webp new file mode 100644 index 0000000000..de3d4f7ed6 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_7_image-20200728223134-4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_9_image-20200728223134-5_950x59.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_9_image-20200728223134-5_950x59.webp new file mode 100644 index 0000000000..ef559ba043 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/76_9_image-20200728223134-5_950x59.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/819_5_c4b607f18774d1a207d45cbd8a96b426.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/819_5_c4b607f18774d1a207d45cbd8a96b426.webp new file mode 100644 index 0000000000..acead8febb Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/819_5_c4b607f18774d1a207d45cbd8a96b426.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_1_image001_950x879.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_1_image001_950x879.webp new file mode 100644 index 0000000000..5fa1cf1225 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_1_image001_950x879.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_2_image002_950x308.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_2_image002_950x308.webp new file mode 100644 index 0000000000..5947993c65 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_2_image002_950x308.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_3_image003_950x697.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_3_image003_950x697.webp new file mode 100644 index 0000000000..424a9f20fd Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_3_image003_950x697.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_4_image004_950x690.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_4_image004_950x690.webp new file mode 100644 index 0000000000..c98d677d44 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/910_4_image004_950x690.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_1_image-20221021235430-1.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_1_image-20221021235430-1.webp new file mode 100644 index 0000000000..8c0f5b6d03 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_1_image-20221021235430-1.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_2_image-20221021235430-2.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_2_image-20221021235430-2.webp new file mode 100644 index 0000000000..2f9fe0048d Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_2_image-20221021235430-2.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_3_image-20221021235430-3.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_3_image-20221021235430-3.webp new file mode 100644 index 0000000000..4da44b780d Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_3_image-20221021235430-3.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_4_image-20221021235430-4.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_4_image-20221021235430-4.webp new file mode 100644 index 0000000000..98e39b8673 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/929_4_image-20221021235430-4.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/troubleshooting.webp b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/troubleshooting.webp new file mode 100644 index 0000000000..57b65d5e14 Binary files /dev/null and b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/assets/troubleshooting.webp differ diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/knowledgebase.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/knowledgebase.md new file mode 100644 index 0000000000..7564bc48bd --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/knowledgebase.md @@ -0,0 +1,37 @@ +--- +title: "Knowledge Base" +description: "Knowledge Base" +sidebar_position: 10 +--- + +# Knowledge Base + +See the following Knowledge Base articles for Start Screen and Task Bar Manager. + +## Troubleshooting + +- [Why aren't Taskbar manager policies working as expected on my Windows 10 machine?](./technical-notes/troubleshooting/windows10.md) +- [When does Endpoint Policy Manager Start Screen & Taskbar Manager work on Server 2019, 2016, 2012 R2?](./technical-notes/troubleshooting/windowserver.md) +- [I use Partial/Merge mode, and expected existing icons to be maintained, but instead they were wiped out. What happened?](./technical-notes/troubleshooting/existingicons.md) +- [How can I revert / rollback the Windows 10 Start Screen after I make an error (using Partial or Replace mode)?](./technical-notes/troubleshooting/rollback.md) +- [Endpoint Policy Manager Start Screen & Taskbar Manager crashes, hangs or is slow when running Group Policy update. Why?](./technical-notes/troubleshooting/crash.md) +- [Why do I see a group named ">Endpoint Policy ManagerStart Screen manager" on the left side in Endpoint Policy Manager Start Screen & Taskbar Manager ?](./technical-notes/troubleshooting/pinnedcollection.md) +- [Why do I get the error "This app can't run on your PC" ?](./technical-notes/troubleshooting/appcantrun.md) +- [Why am I seeing an Endpoint Policy Manager "advertisement" tile on my Start Screen (when I only use the TaskBar manager and NOT the Start Screen Manager?)](./technical-notes/troubleshooting/linked.md) +- [Windows default applications are not showing in Start Menu](./technical-notes/troubleshooting/windowsdefault.md) +- [Endpoint Policy Manager Task Bar Manager differences between MERGE and REPLACE modes](./technical-notes/troubleshooting/modes.md) +- [Custom icons for Endpoint Policy Manager Start Screen & Taskbar Manager aren't working as expected. What can I do?](./technical-notes/troubleshooting/customicons.md) +- [How to Disable the "How do you want to open this? Keep using this app" Notification in Windows 10](./technical-notes/troubleshooting/windows10disablenotification.md) +- [Why would it sometimes takes two logoffs and logons to see Start Screen or Taskbar changes?](./technical-notes/troubleshooting/logons.md) +- [Does Endpoint Policy Manager Start Screen Manager support pinning application icons in Windows Start Screen or Taskbar from a network location, i.e. Mapped Drives or UNC Paths?](./technical-notes/troubleshooting/mappeddrives.md) +- [Why don't I see Office 2016, Office 2019, or Office 365 icons or tiles using Start Screen Manager?](./technical-notes/troubleshooting/office365.md) + +## Tips and Tricks + +- [How do I add Explorer.exe to the taskbar using Endpoint Policy Manager Start Screen & Taskbar Manager ?](./technical-notes/tipsandtricks/explorer.md) +- [How do I add the SCCM Software Center to the Start Screen or Taskbar?](./technical-notes/tipsandtricks/sccmsoftwarecenter.md) +- [Can Microsoft App-V applications work with Endpoint Policy Manager Starts Screen and Taskbar Manager?](./technical-notes/tipsandtricks/appv.md) +- [How do I add the Least Privilege Manager Helper tools to the Left and Right side of the Start Menu?](./technical-notes/tipsandtricks/helpertools.md) +- [How-To create a folder shortcut in Windows 10 Start Menu using Endpoint Policy Manager Starts Screen Manager?](./technical-notes/tipsandtricks/foldershortcut.md) +- [How can I add a link to the Control Panel to the Start Screen or Taskbar using Endpoint Policy Manager Start Screen Manager?](./technical-notes/tipsandtricks/addlink.md) +- [How to automatically kill explorer at 1st Logon to Bypass needing to logout and back in for Start Screen Manager to apply](./technical-notes/tipsandtricks/logonworkaround.md) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/_category_.json new file mode 100644 index 0000000000..a6d7d9b805 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Tips And Tricks", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/addlink.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/addlink.md new file mode 100644 index 0000000000..b629a748b2 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/addlink.md @@ -0,0 +1,14 @@ +--- +title: "How can I add a link to the Control Panel to the Start Screen or Taskbar using Endpoint Policy Manager Start Screen Manager?" +description: "How can I add a link to the Control Panel to the Start Screen or Taskbar using Endpoint Policy Manager Start Screen Manager?" +sidebar_position: 60 +--- + +# How can I add a link to the Control Panel to the Start Screen or Taskbar using Endpoint Policy Manager Start Screen Manager? + +The answer is to make a custom application. Use the values as seen here for Target Application, then +we recommend you choose a Shortcut Icon from Shell32.DLL. + +The other fields may be left blank. + +![914_1_image001](/images/endpointpolicymanager/startscreentaskbar/914_1_image001.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/appv.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/appv.md new file mode 100644 index 0000000000..f14759c7d2 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/appv.md @@ -0,0 +1,44 @@ +--- +title: "Can Microsoft App-V applications work with Endpoint Policy Manager Starts Screen and Taskbar Manager?" +description: "Can Microsoft App-V applications work with Endpoint Policy Manager Starts Screen and Taskbar Manager?" +sidebar_position: 30 +--- + +# Can Microsoft App-V applications work with Endpoint Policy Manager Starts Screen and Taskbar Manager? + +Yes. It is tested and should work just like any other registered application. The pre-requisites are +the same and we recommend creating GPOs for Netwrix Endpoint Policy Manager (formerly PolicyPak) +Starts Screen Manager from the machine where the required App-V package is already installed. + +Steps to create App-V icon in Windows Starts Screen via GPO: + +**Step 1 –** Create a GPO and expand Endpoint Policy Manager Starts Screen Manager. + +**Step 2 –** Create Collection, create Group and then right-click and select **Add Desktop +Application Tile**. + +![808_1_image-20201121192420-1](/images/endpointpolicymanager/integration/808_1_image-20201121192420-1.webp) + +**Step 3 –** Select the **Registered Application (Recommended)** option and click **Next**. + +![808_2_image-20201121192420-2](/images/endpointpolicymanager/integration/808_2_image-20201121192420-2.webp) + +**Step 4 –** Wait for the wizard to discover all registered applications including App-V application +packages. + +**Step 5 –** Select the App-V application and verify the path by moving your cursor over the Icon. + +![808_3_image-20201121192420-3](/images/endpointpolicymanager/integration/808_3_image-20201121192420-3.webp) + +**Step 6 –** Complete the remaining steps and apply group policy updates on the target machine. + +:::note +The target application path must exist in the client machine. +::: + + +![808_4_image-20201121192420-4](/images/endpointpolicymanager/integration/808_4_image-20201121192420-4.webp) + +**Step 7 –** Log-off and log back on to see the required Starts Screen items. + +![808_5_image-20201121192420-5](/images/endpointpolicymanager/integration/808_5_image-20201121192420-5.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/explorer.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/explorer.md new file mode 100644 index 0000000000..55d10a2c19 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/explorer.md @@ -0,0 +1,9 @@ +--- +title: "How do I add Explorer.exe to the taskbar using Endpoint Policy Manager Start Screen & Taskbar Manager ?" +description: "How do I add Explorer.exe to the taskbar using Endpoint Policy Manager Start Screen & Taskbar Manager ?" +sidebar_position: 10 +--- + +# How do I add Explorer.exe to the taskbar using Endpoint Policy Manager Start Screen & Taskbar Manager ? + +![731_1_sss](/images/endpointpolicymanager/startscreentaskbar/731_1_sss.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/foldershortcut.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/foldershortcut.md new file mode 100644 index 0000000000..13bc2b5a07 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/foldershortcut.md @@ -0,0 +1,14 @@ +--- +title: "How-To create a folder shortcut in Windows 10 Start Menu using Endpoint Policy Manager Starts Screen Manager?" +description: "How-To create a folder shortcut in Windows 10 Start Menu using Endpoint Policy Manager Starts Screen Manager?" +sidebar_position: 50 +--- + +# How-To create a folder shortcut in Windows 10 Start Menu using Endpoint Policy Manager Starts Screen Manager? + +Create the Tile as shown below screenshot. The string to make the Folder shortcut work is here. +Replace the command-line argument (RED text-color) as per your requirement. + +`%systemroot%\explorer.exe "%userprofile%\Desktop\New Folder"` + +![824_1_image-20210304053215-1](/images/endpointpolicymanager/startscreentaskbar/824_1_image-20210304053215-1.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/helpertools.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/helpertools.md new file mode 100644 index 0000000000..d800e9282e --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/helpertools.md @@ -0,0 +1,176 @@ +--- +title: "How do I add the Least Privilege Manager Helper tools to the Left and Right side of the Start Menu?" +description: "How do I add the Least Privilege Manager Helper tools to the Left and Right side of the Start Menu?" +sidebar_position: 40 +--- + +# How do I add the Least Privilege Manager Helper tools to the Left and Right side of the Start Menu? + +To give your users a little more control over their computer, The LPM Helper Tools allow the +administrator to give the end-user power over printers, network connections and the ability to +uninstall applications. + +This article will explain the process of adding the helper to the Windows Start Menu – Left and/or +right side. + +For more information on the Helper Tools, click +[Overcome Network Card, Printer, and Remove Programs UAC prompts](/docs/endpointpolicymanager/knowledgebase/leastprivilegemanager/videolearningcenter/helperstoolsandtips/uacprompts.md). + +To enable the helper tools and give the power to the users, click +[Endpoint Policy Manager Least Priv Manager Tools Setup](/docs/endpointpolicymanager/knowledgebase/leastprivilegemanager/videolearningcenter/helperstoolsandtips/toolssetup.md), and +follow the directions. The helper tool must be enabled to work. + +## Adding the LPM Helper Tools to the Right Start Menu + +For this side, Start Screen Manager will be used to place the icons. + +**Step 1 –** Open the GPMC on your management station and create a new GPO where desired and edit it + +:::note +This can also be added as part of the Least Privilege Manager policy GPO used to enable +the helper tools +::: + + +**Step 2 –** Expand User or Computer Configuration -> Netwrix Endpoint Policy Manager (formerly +PolicyPak) -> Windows 10 & Server Management and click on Start Screen Manager + +(this example will use the user configuration) + +![773_1_image-20201225195625-1](/images/endpointpolicymanager/startscreentaskbar/773_1_image-20201225195625-1.webp) + +**Step 3 –** Add a new Collection + +![773_2_image-20201225195625-2](/images/endpointpolicymanager/startscreentaskbar/773_2_image-20201225195625-2.webp) + +**Step 4 –** Name the Collection and under Layout Mode, select either Full (Replacement of the +user's start menu) and Partial (Preserving the user's start menu). Partial Preserve is generally +recommended as the end users still have access to modify the rest of the start menu. + +![773_3_image-20201225195625-3](/images/endpointpolicymanager/startscreentaskbar/773_3_image-20201225195625-3.webp) + +:::note +Item Level Targeting may be used to filter who or what gets the policies within this +collection +::: + + +**Step 5 –** Open the collection and add a New Group + +![773_4_image-20201225195625-4](/images/endpointpolicymanager/startscreentaskbar/773_4_image-20201225195625-4.webp) + +**Step 6 –** Complete Group information + +- Group Name: The title of the group that will appear on the end user's start menu +- State: Enabled +- Action: choose between Create, Replace and Update + + - The default, and recommended here, is to "Update" any existing group and check "Create if not + present" + +- Update Mode: If Update is the selected action, and the group name you selected already exists, do + you want to new icons at the top or tail of the group? +- Placeholder: If an application / link is missing and the tile cannot be created, do you want a Gap + in its place, or an Edge Link (a tile that will open in the Edge Browser)? + + ![773_5_image-20201225195625-5](/images/endpointpolicymanager/startscreentaskbar/773_5_image-20201225195625-5.webp) + +:::note +ILT can also be implemented here instead of at, or in addition too, the collection level. +::: + + +**Step 7 –** Open the new group just created + +**Step 8 –** Add new Desktop Application + +![773_6_image-20201225195625-6](/images/endpointpolicymanager/startscreentaskbar/773_6_image-20201225195625-6.webp) + +**Step 9 –** Select Custom Application + +![773_7_image-20201225195625-7](/images/endpointpolicymanager/startscreentaskbar/773_7_image-20201225195625-7.webp) + +**Step 10 –** Click "Select application" and browse to "C:\Program Files\PolicyPak\Least Privilege +Manager\Tools" and select one of the three EXEs + +![773_8_image-20201225195625-8](/images/endpointpolicymanager/startscreentaskbar/773_8_image-20201225195625-8.webp) + +**Step 11 –** Complete Application data page + +- Shortcut Name: Rename to something descriptive +- Shortcut Icon: If path is not complete, click on Change icon… and browse back to EXE directory and + select the same file + +![773_9_image-20201225195625-9](/images/endpointpolicymanager/startscreentaskbar/773_9_image-20201225195625-9.webp) + +**Step 12 –** Set icon size and position as desired, if different from default + +![773_10_image-20201225195625-10](/images/endpointpolicymanager/startscreentaskbar/773_10_image-20201225195625-10.webp) + +**Step 13 –** Confirm settings and Finish + +**Step 14 –** Repeat steps 7 through 12 for each Helper Tool needed + +- Network Connections +- Printers +- Remove Programs + +The changes will be implemented on the User's computer once Group Policy has been updated (either +automatically or manually by running "GPUpdate", and the user, at minimum, logs off and back on +again. + +## Adding the LPM Helper Tools to the Left (All Applications) Menu + +If you have already created tiles on the right start menu, these, and any other tiles you created +using Start Screen Manager or Task Bar Manager, will appear in a folder named "Endpoint Policy +Manager Start Screen Manager". If this is sufficient, you can leave it as is. However, if you had +not completed the right-side option above, or would like to separate the icons into their own +folder, continue with the process below. + +**Step 1 –** Open the GPMC on your management station and create a new GPO where desired or use the +GPO for the right-side icons + +:::note +This can also be added as part of the Least Privilege Manager policy GPO used to enable +the helper tools. +::: + + +**Step 2 –** Expand User or Computer Configuration -> Preferences -> Windows Settings and click on +Shortcuts + +![773_11_image-20201225195625-11](/images/endpointpolicymanager/startscreentaskbar/773_11_image-20201225195625-11.webp) + +**Step 3 –** Right-click and create a New -> Shortcut + +![773_12_image-20201225195625-12_339x107](/images/endpointpolicymanager/startscreentaskbar/773_12_image-20201225195625-12_339x107.webp) + +**Step 4 –** Fill in the shortcut properties page as follows + +- General Tab + + - Name: Name of the shortcut, including parent folder (e.g. "Endpoint Policy Manager LPM Helper + Tools\Network Connections" – This is what will be seen in All Apps) + - Target type: File System Object + - Location: Start Menu + - Target Path: Click "…" and browse to "C:\Program Files\PolicyPak\Least Privilege + Manager\Tools" and select one of the three EXEs (e.g. C:\Program Files\PolicyPak\Least + Privilege Manager\Tools\endpointpolicymanager.Tools.NetworkConnections.exe) + + ![773_13_image-20201225195625-13](/images/endpointpolicymanager/startscreentaskbar/773_13_image-20201225195625-13.webp) + +- Common Tab + + - Check "Remove this item when it is no longer applied" + + ![773_14_image-20201225195625-14_409x165](/images/endpointpolicymanager/startscreentaskbar/773_14_image-20201225195625-14_409x165.webp) + +**Step 5 –** Click OK to close the window + +**Step 6 –** Repeat steps 3 through 5 for each Helper Tool needed + +- Network Connections +- Printers +- Remove Programs + +Changes to the Left side are immediate and do not need a log off. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/logonworkaround.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/logonworkaround.md new file mode 100644 index 0000000000..f68b2617b4 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/logonworkaround.md @@ -0,0 +1,64 @@ +--- +title: "How to automatically kill explorer at 1st Logon to Bypass needing to logout and back in for Start Screen Manager to apply" +description: "How to automatically kill explorer at 1st Logon to Bypass needing to logout and back in for Start Screen Manager to apply" +sidebar_position: 70 +--- + +# How to automatically kill explorer at 1st Logon to Bypass needing to logout and back in for Start Screen Manager to apply + +This KB assumes that you already have a working Netwrix Endpoint Policy Manager (formerly PolicyPak) +Start Screen (PPSSM) policy that works normally after logging out and back in after the PPSSM policy +applies. The purpose of this KB is to provide a possible (and unsupported) workaround for PPSSM +customers who use Non-Persistent VDIs and whose users are unable to logout and back in due to the +nature of Non-Persistent VDIs who would still like to use PPSSM. The idea is that by killing the +explorer.exe process and restarting it at first logon is that we can mimic the logout and log back +in action so that the PPSSM policy will apply successfully. + +**Step 1 –** Create a new Endpoint Policy Manager Scripts and Triggers policy on either the computer +side (in Switched mode) or on the user side. + +**Step 2 –** Next set the apply action in the policy to run the following BATCH commands. + +``` +@echo off +IF EXIST C:\Users\%UserName%\AppData\app_init.txt GOTO END +date /t >> C:\Users\%UserName%\AppData\app_init.txt +time /t >> C:\Users\%UserName%\AppData\app_init.txt +taskkill /F /IM explorer.exe & start explorer +REM Put your code here, which will be executed once +:END +``` + +Your settings should look similar to the screenshot below: + +![929_1_image-20221021235430-1](../assets/929_1_image-20221021235430-1.webp) + +**Step 3 –** For the Revert action screen, click Next and do not set a revert action as Triggers do +not support Revert actions. + +![929_2_image-20221021235430-2](../assets/929_2_image-20221021235430-2.webp) + +**Step 4 –** For the Trigger type setting choose "Logon" + +![929_3_image-20221021235430-3](../assets/929_3_image-20221021235430-3.webp) + +**Step 5 –** Optional: Set the Triger settings wait period for 1 minute after login if desired.  +Note, you can also uncheck this setting here and then programmatically in your BATCH script set a +wait period for seconds if desired, (i.e., to wait 20 seconds before running the next command you +could use "SLEEP 20"). + +![929_4_image-20221021235430-4](../assets/929_4_image-20221021235430-4.webp) + +**Step 6 –** Lastly, save and apply the policy, then test from an endpoint, the result will be that +Scripts and Triggers will look for the flag file at EVERY login… one minute after login (using the +settings from above). Then, if the flag file is ABSENT… Kill explorer and write the flag file. + +:::note +You will see a very brief flash on the end-user computer for new logins. +::: + + +:::warning +This policy should be set to apply after the PPSSM policy. + +::: diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/sccmsoftwarecenter.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/sccmsoftwarecenter.md new file mode 100644 index 0000000000..7c7eaab14d --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/tipsandtricks/sccmsoftwarecenter.md @@ -0,0 +1,40 @@ +--- +title: "How do I add the SCCM Software Center to the Start Screen or Taskbar?" +description: "How do I add the SCCM Software Center to the Start Screen or Taskbar?" +sidebar_position: 20 +--- + +# How do I add the SCCM Software Center to the Start Screen or Taskbar? + +![724_1_hf-936-img-01](/images/endpointpolicymanager/startscreentaskbar/724_1_hf-936-img-01.webp) + +The normal shortcut for the SCCM Software Center looks like this; but Netwrix Endpoint Policy +Manager (formerly PolicyPak) Start Screen & Taskbar Manager doesn't support this kind of link. + +However, you can perform the following steps instead to get the same effect. +Using Endpoint Policy Manager Start Screen or Endpoint Policy Manager Taskbar Manager, create a link +for a Custom application like this… + +![724_3_hf-936-img-02](/images/endpointpolicymanager/startscreentaskbar/724_3_hf-936-img-02.webp) + +Then, point it toward + +`%SYSTEMROOT%\CCM\SCClient.exe page=AvailableSoftware` + +Like what's seen here. + +![724_5_hf-936-img-03](/images/endpointpolicymanager/startscreentaskbar/724_5_hf-936-img-03.webp) + +:::note +If you don't like that page, you can pick a page… (NOT TESTED, but should work.) Special +keywords can be found at this link. +[https://www.prajwaldesai.com/create-shortcuts-for-configmgr-software-center/#:~:text=By%20default%20you%20will%20find,%5CCCM%5CSCClient.exe](https://www.prajwaldesai.com/create-shortcuts-for-configmgr-software-center/#httpswwwprajwaldesaicomcreate-shortcuts-for-configmgr-software-centertextby20default20you20will20find5cccm5cscclientexe). +Finally, take the defaults… and/or change the ShortCut name to suit. +::: + + +![724_7_hf-936-img-04](/images/endpointpolicymanager/startscreentaskbar/724_7_hf-936-img-04.webp) + +Final results should look like this… + +![724_9_hf-936-img-05](/images/endpointpolicymanager/startscreentaskbar/724_9_hf-936-img-05.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/_category_.json new file mode 100644 index 0000000000..51f22c0d00 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Troubleshooting", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/appcantrun.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/appcantrun.md new file mode 100644 index 0000000000..34b00114be --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/appcantrun.md @@ -0,0 +1,23 @@ +--- +title: "Why do I get the error \"This app can't run on your PC\" ?" +description: "Why do I get the error \"This app can't run on your PC\" ?" +sidebar_position: 70 +--- + +# Why do I get the error "This app can't run on your PC" ? + +There are two reasons why you might get this when using Netwrix Endpoint Policy Manager (formerly +PolicyPak) Start Screen & Taskbar Manager. + +Example of error: + +![699_1_img1_950x233](../assets/699_1_img1_950x233.webp) + +Reason 1: You are pointing toward a 64-bit executable on a 32-bit machine. + +Reason 2: You are not pointing toward the .EXE itself, but the .LNK (shortcut.) This is not +supported. + +![699_2_img2_950x396](../assets/699_2_img2_950x396.webp) + +![699_3_img3_950x368](../assets/699_3_img3_950x368.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/crash.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/crash.md new file mode 100644 index 0000000000..bd8d4f0d2a --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/crash.md @@ -0,0 +1,14 @@ +--- +title: "Endpoint Policy Manager Start Screen & Taskbar Manager crashes, hangs or is slow when running Group Policy update. Why?" +description: "Endpoint Policy Manager Start Screen & Taskbar Manager crashes, hangs or is slow when running Group Policy update. Why?" +sidebar_position: 50 +--- + +# Endpoint Policy Manager Start Screen & Taskbar Manager crashes, hangs or is slow when running Group Policy update. Why? + +The WAP Push Message Routing Service must be enabled on the machine as Manual (Trigger Start) or +Running for Netwrix Endpoint Policy Manager (formerly PolicyPak) Start Screen & Taskbar Manager to +function. +Do not disable this dmwappushservice service. + +![537_1_asdfghkyhj](../assets/537_1_asdfghkyhj.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/customicons.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/customicons.md new file mode 100644 index 0000000000..ebcc9832c4 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/customicons.md @@ -0,0 +1,76 @@ +--- +title: "Custom icons for Endpoint Policy Manager Start Screen & Taskbar Manager aren't working as expected. What can I do?" +description: "Custom icons for Endpoint Policy Manager Start Screen & Taskbar Manager aren't working as expected. What can I do?" +sidebar_position: 110 +--- + +# Custom icons for Endpoint Policy Manager Start Screen & Taskbar Manager aren't working as expected. What can I do? + +There are a few reasons that custom icons might not work in Netwrix Endpoint Policy Manager +(formerly PolicyPak) Start Screen & Taskbar Manager. Please work through this list to determine why +you are not seeing custom icons as expected. + +## Problem 1: Underlying application has a manifest file + +The most common reason is that the underlying application (Chrome, Firefox, and Microsoft Edge) have +a manifest file which overrides the ability for Endpoint Policy Manager Start Screen & Taskbar +Manager to deliver the icon as expected. + +Watch this video first: +[Endpoint Policy Manager Start Screen Manager and Special Custom Icons](./video-learning-center/troubleshooting/customicons.md). + +## Problem 2: You are attempting to use UNC paths for icons + +Do not attempt to use UNC paths (`\\server\share\app.exe` ) when pointing to an item containing your +alternate icons. + +![735_1_image-20200723210823-1](../assets/735_1_image-20200723210823-1.webp) + +The application must reside locally on the machine (`c:\temp\app1.exe`) for the icons to appear as +expected. + +## Problem 3: The application's installation placed a shortcut file in Program Files or AppData + +Endpoint Policy Manager Start Screen & Taskbar MUST and can ONLY use the shortcuts placed by the +application itself when it does so to + +``` +%programdata%\Microsoft\Windows\Start Menu and sub folders. +        %AppData%\Microsoft\Windows\Start Menu\Programs and sub folders. +``` + +For instance, you cannot use alternate icon for anything listed here…. +(`%programdata%\Microsoft\Windows\Start Menu`) + +![735_3_image-20200723210823-2](../assets/735_3_image-20200723210823-2.webp) + +Or here… + +![735_5_image-20200723210823-3](../assets/735_5_image-20200723210823-3.webp) + +Or here… (`%AppData%\Microsoft\Windows\Start Menu\Programs`) + +![735_7_image-20200723210823-4](../assets/735_7_image-20200723210823-4.webp) + +or + +![735_9_image-20200723210823-5](../assets/735_9_image-20200723210823-5.webp) + +If you attempt to make a Endpoint Policy Manager Start Screen & Taskbar item and attempt to use an +alternate shortcut… it will not work. + +![735_11_image-20200723210823-6](../assets/735_11_image-20200723210823-6.webp) + +You will only get the Chrome's default icon, because it already exists as a shortcut in +`Start menu | Programs`. + +To overcome this, you must delete (manually or using Group Policy Prefs, etc.) the file which is +being used by the application. Here's an example using Chrome. + +![735_13_image-20200723210823-7](../assets/735_13_image-20200723210823-7.webp) + +The final result AFTER you delete the shortcut within `%programdata%\Microsoft\Windows\Start` Menu +or `%AppData%\Microsoft\Windows\Start Menu\Programs` will get you the results you are seeking like +this. + +![735_15_image-20200723210823-8_950x998](../assets/735_15_image-20200723210823-8_950x998.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/existingicons.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/existingicons.md new file mode 100644 index 0000000000..7c55ed2247 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/existingicons.md @@ -0,0 +1,19 @@ +--- +title: "I use Partial/Merge mode, and expected existing icons to be maintained, but instead they were wiped out. What happened?" +description: "I use Partial/Merge mode, and expected existing icons to be maintained, but instead they were wiped out. What happened?" +sidebar_position: 30 +--- + +# I use Partial/Merge mode, and expected existing icons to be maintained, but instead they were wiped out. What happened? + +This can occur if you're doing something else to manage the Start Layout \*\*BEFORE\*\* Netwrix +Endpoint Policy Manager (formerly PolicyPak) Start Screen & Taskbar Manager is involved. + +In short, there are two categories of Start Screen items: + +- Default Windows groups and applications, or groups and applications pinned by user; +- Applications pinned by Enterprise (regardless of the method they were added: MDM, Group Policy, + import-startlayout script during OSD, etc); + +Items that fall into the second category "Applications pinned by Enterprise" are wiped out when new +layout is applied by Endpoint Policy Manager Start Screen & Taskbar Manager. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/linked.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/linked.md new file mode 100644 index 0000000000..178dcfe454 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/linked.md @@ -0,0 +1,61 @@ +--- +title: "Why am I seeing an Endpoint Policy Manager \"advertisement\" tile on my Start Screen (when I only use the TaskBar manager and NOT the Start Screen Manager?)" +description: "Why am I seeing an Endpoint Policy Manager \"advertisement\" tile on my Start Screen (when I only use the TaskBar manager and NOT the Start Screen Manager?)" +sidebar_position: 80 +--- + +# Why am I seeing an Endpoint Policy Manager "advertisement" tile on my Start Screen (when I only use the TaskBar manager and NOT the Start Screen Manager?) + +You might have noticed when you try to deliver NOTHING (aka. a blank start screen with or without +using the Taskbar Manager), you will still see a Netwrix Endpoint Policy Manager (formerly +PolicyPak) advertisement tile even you didn't put it there. + +![692_1_img-1](../assets/692_1_img-1.webp) + +The Taskbar Manager and Start Screen Manager are actually interlinked, even if you’re only using one +of them. + +The advertisement tile is required. + +You have to deliver at least ONE thing to the Start Menu, or you’ll get what you see in the previous +screenshot. + +This is working as designed; this is a limitation in the “physics” that Microsoft gives us to use to +manage the Start Screen and Taskbar. + +## First Workaround + +Use the PolicyPak Start Screen PARTIAL/MERGE function which will let you add one single tile. + +Here is an example of us setting a URL to a home page in a group called **Company Apps**. + +![692_2_img-2_950x669](../assets/692_2_img-2_950x669.webp) + +Alternatively, use the FULL/REPLACE mode to deliver a single tile of your choosing, your users will +still have no ability to change the Start Screen, and the Endpoint Policy Manager tile will go away. + +Note that the Advertisement group is still present on the LEFT side. + +![692_3_img-3](../assets/692_3_img-3.webp) + +The name of this group is changeable using Endpoint Policy Manager TaskBar manager as seen here. + +![692_4_img-4](../assets/692_4_img-4.webp) + +## Second Workaround + +:::note +Use this workaround if you no longer use the Starts Screen and Taskbar Manager policies. +::: + + +**Step 1 –** Disable the Taskbar Manager collection policies. + +**Step 2 –** Using the Scripts Manager to deliver a batch script policy. + +Rd /s /q "%APPDATA%\Microsoft\Windows\Start Menu\PolicyPak Start Screen Manager\" + +It will remove the Endpoint Policy Manager tile from the Start Menu. The example screen shot and +sample script is below. + +![819_5_c4b607f18774d1a207d45cbd8a96b426](../assets/819_5_c4b607f18774d1a207d45cbd8a96b426.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/logons.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/logons.md new file mode 100644 index 0000000000..3354f9fce0 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/logons.md @@ -0,0 +1,25 @@ +--- +title: "Why would it sometimes takes two logoffs and logons to see Start Screen or Taskbar changes?" +description: "Why would it sometimes takes two logoffs and logons to see Start Screen or Taskbar changes?" +sidebar_position: 130 +--- + +# Why would it sometimes takes two logoffs and logons to see Start Screen or Taskbar changes? + +To answer this, there are two scenarios. + +Scenario 1: + +- The user has no profile at all. +- GPOs apply SYNCHRONOUSLY but Explorer doesn't get the signal about Netwrix Endpoint Policy Manager + (formerly PolicyPak) Start Screen & Taskbar. +- This means you typically need another log off and back on to see the "now written, but not yet + seen" Start Screen & Taskbar. + +Scenario 2: + +- The user has a profile, but he is logged off. +- Then the Admin makes some change to Start Menu. +- When the User logs on, because policies are applied asynchronously, the end-user missed the chance + to apply those to Explorer. So, you see the result at the next logon because the Start Screen & + Taskbar policies are "now written, but not yet seen." diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/mappeddrives.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/mappeddrives.md new file mode 100644 index 0000000000..4fb18295a6 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/mappeddrives.md @@ -0,0 +1,16 @@ +--- +title: "Does Endpoint Policy Manager Start Screen Manager support pinning application icons in Windows Start Screen or Taskbar from a network location, i.e. Mapped Drives or UNC Paths?" +description: "Does Endpoint Policy Manager Start Screen Manager support pinning application icons in Windows Start Screen or Taskbar from a network location, i.e. Mapped Drives or UNC Paths?" +sidebar_position: 140 +--- + +# Does Endpoint Policy Manager Start Screen Manager support pinning application icons in Windows Start Screen or Taskbar from a network location, i.e. Mapped Drives or UNC Paths? + +Yes, Endpoint Policy Manager Start Screen Manager fully supports pinning applications from a network +location, however, the network location must be a UNC path. + +If you receive a text message similar to the one below when clicking on the application icon from +the Start Screen, then it means that either the Application is not present at the physical path, or +it is configured with a Mapped Drive instead of the UNC Path. + +![841_1_image-20201201090844-1](/images/endpointpolicymanager/requirements/support/startscreentaskbar/841_1_image-20201201090844-1.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/modes.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/modes.md new file mode 100644 index 0000000000..4c33337058 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/modes.md @@ -0,0 +1,93 @@ +--- +title: "Endpoint Policy Manager Task Bar Manager differences between MERGE and REPLACE modes" +description: "Endpoint Policy Manager Task Bar Manager differences between MERGE and REPLACE modes" +sidebar_position: 100 +--- + +# Endpoint Policy Manager Task Bar Manager differences between MERGE and REPLACE modes + +## Why do I see duplicate icons on the Taskbar? + +In the image below you can see that there are 3 types of items: + +![719_1_image-20200212183953-1](/images/endpointpolicymanager/startscreentaskbar/719_1_image-20200212183953-1.webp) + +1. Windows default apps to the left (blue circle). +2. Apps pinned by the user in the center (orange triangle). +3. Apps that you pin using the XML file (i.e. policy items) to the right (green square). + +"REPLACE" mode removes default pinned apps, but does not remove user pinned apps. In other words, +when using the "REPLACE" option if the user has already pinned an application and you choose to pin +the same application using Netwrix Endpoint Policy Manager (formerly PolicyPak) Taskbar Manager you +will end up with two copies of that application on the Taskbar, one pinned by the user and the other +pinned by Endpoint Policy Manager. + +![719_3_image-20200212183953-2](/images/endpointpolicymanager/startscreentaskbar/719_3_image-20200212183953-2.webp) + +More info: +[https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar) + +## Example of what happens when using "REPLACE" Mode: + +If we started with the Taskbar layout below: + +![719_5_image-20200212183953-3](/images/endpointpolicymanager/startscreentaskbar/719_5_image-20200212183953-3.webp) + +Then created a REPLACE PP TBM policy with the following settings: + +![719_7_image-20200212183953-4_834x93](/images/endpointpolicymanager/startscreentaskbar/719_7_image-20200212183953-4_834x93.webp) + +![719_9_image-20201007144149-1_619x269](/images/endpointpolicymanager/startscreentaskbar/719_9_image-20201007144149-1_619x269.webp) + +:::note +When creating a REPLACE policy you are shown the warning screen below: +::: + + +![719_10_image-20200212183953-6_756x226](/images/endpointpolicymanager/startscreentaskbar/719_10_image-20200212183953-6_756x226.webp) + +The result of applying this policy is that All Default Applications not mentioned in the policy are +removed, User pinned applications are ignored, then any remaining applications from the PP TBM +REPLACE policy are pinned. + +![719_12_image-20200212183953-7_500x38](/images/endpointpolicymanager/startscreentaskbar/719_12_image-20200212183953-7_500x38.webp) + +Now, if we edited the same policy and set the REPLACE policy as in the screenshot below: + +![719_14_image-20200212183953-8](/images/endpointpolicymanager/startscreentaskbar/719_14_image-20200212183953-8.webp) + +![719_16_image-20200212183953-9](/images/endpointpolicymanager/startscreentaskbar/719_16_image-20200212183953-9.webp) + +Then applied the policy (remember to logout out and back in after running gpupdate) the result would +be: + +![719_18_image-20200212183953-10_541x36](/images/endpointpolicymanager/startscreentaskbar/719_18_image-20200212183953-10_541x36.webp) + +Since 7-Zip was not installed on the target machine, it was ignored, since CMD was pinned by the +User it was also ignored. The remaining applications were then removed and the new applications were +pinned. + +## Example of what happens when using "MERGE" Mode: + +If we started with the Taskbar layout below: + +![719_20_image-20200212183953-11_470x38](/images/endpointpolicymanager/startscreentaskbar/719_20_image-20200212183953-11_470x38.webp) + +Then created a MERGE PP TBM policy with the following settings: + +![719_22_image-20200212183953-12_834x93](/images/endpointpolicymanager/startscreentaskbar/719_7_image-20200212183953-4_834x93.webp) + +![719_24_image-20200212183953-13_618x256](/images/endpointpolicymanager/startscreentaskbar/719_24_image-20200212183953-13_618x256.webp) + +The result of applying this policy would be that only "Chrome" gets added since the other +applications (Edge and Internet Explorer) were already present. In MERGE mode, any applications from +the PP TBM policy that are already present (pinned) are ignored and then any new applications are +pinned. + +![719_26_image-20200212183953-14_468x38](/images/endpointpolicymanager/startscreentaskbar/719_26_image-20200212183953-14_468x38.webp) + +:::note +After running gpupdate to apply policy you must logout then back in to receive the new PP +TBM policy settings. + +::: diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/office365.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/office365.md new file mode 100644 index 0000000000..9487db858f --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/office365.md @@ -0,0 +1,40 @@ +--- +title: "Why don't I see Office 2016, Office 2019, or Office 365 icons or tiles using Start Screen Manager?" +description: "Why don't I see Office 2016, Office 2019, or Office 365 icons or tiles using Start Screen Manager?" +sidebar_position: 150 +--- + +# Why don't I see Office 2016, Office 2019, or Office 365 icons or tiles using Start Screen Manager? + +If you attempt to deliver Microsoft Office tiles using Netwrix Endpoint Policy Manager (formerly +PolicyPak) Start Screen Manager, you might find blank tiles like what is experienced here. + +On LTSC machines, you won't see any tiles at all, because there is no Microsoft Edge installed. + +![910_1_image001_950x879](../assets/910_1_image001_950x879.webp) + +When you click on a tile, you should see some indication of the issue like what's seen here. + +![910_2_image002_950x308](../assets/910_2_image002_950x308.webp) + +Upon inspection of one of the tiles, you might see the target application shown like this: + +![910_3_image003_950x697](../assets/910_3_image003_950x697.webp) + +However, the correct details should be entered as follows: + +![910_4_image004_950x690](../assets/910_4_image004_950x690.webp) + +To get this to work, you should use the Endpoint Policy Manager Start Screen Helper Tool on a +machine with the version of Office 2016, 2019, or Office 365 you want to add icons for. + +Here's the video on this +tool:[Endpoint Policy Manager Start Screen and Taskbar Manager Helper Utility](./video-learning-center/gettingstarted/helperutility.md)/ + +Summary to get Office icons to appear on endpoints: + +**Step 1 –** Get the apps installed on an endpoint. + +**Step 2 –** Use the Helper tool. + +**Step 3 –** Then create the icons from the export the helper tool made. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/pinnedcollection.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/pinnedcollection.md new file mode 100644 index 0000000000..ff90f1a2fd --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/pinnedcollection.md @@ -0,0 +1,19 @@ +--- +title: "Why do I see a group named \">Endpoint Policy ManagerStart Screen manager\" on the left side in Endpoint Policy Manager Start Screen & Taskbar Manager ?" +description: "Why do I see a group named \">Endpoint Policy ManagerStart Screen manager\" on the left side in Endpoint Policy Manager Start Screen & Taskbar Manager ?" +sidebar_position: 60 +--- + +# Why do I see a group named ">Endpoint Policy ManagerStart Screen manager" on the left side in Endpoint Policy Manager Start Screen & Taskbar Manager ? + +You will see a group named Netwrix Endpoint Policy Manager (formerly PolicyPak) Start Screen & +Taskbar Manager on the left when you have icons on the right which do NOT have their own LEFT SIDE +shortcut. This is automatically created for you and is not configurable. + +Items which are delivered to the TASK BAR must also have items that exist on the LEFT SIDE. If these +items do not exist, we will create a group JUST for the Task Bar. That is configurable, and you can +see how to do it in the second screenshot. + +![623_1_faq-07-img-01](../assets/623_1_faq-07-img-01.webp) + +![623_2_faq-07-img-02](../assets/623_2_faq-07-img-02.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/rollback.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/rollback.md new file mode 100644 index 0000000000..ef3c45a8d9 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/rollback.md @@ -0,0 +1,13 @@ +--- +title: "How can I revert / rollback the Windows 10 Start Screen after I make an error (using Partial or Replace mode)?" +description: "How can I revert / rollback the Windows 10 Start Screen after I make an error (using Partial or Replace mode)?" +sidebar_position: 40 +--- + +# How can I revert / rollback the Windows 10 Start Screen after I make an error (using Partial or Replace mode)? + +Use Netwrix Endpoint Policy Manager (formerly PolicyPak) Script manager to run a simple script to +re-trigger the initial start menu layout. Note you may not get an EXACT revert; but it's pretty +close. + +[Endpoint Policy ManagerStart Screen and Endpoint Policy Manager Scripts: Specify exact Start Menu experience one time](./video-learning-center/extras/onetime.md) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windows10.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windows10.md new file mode 100644 index 0000000000..99717feb02 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windows10.md @@ -0,0 +1,13 @@ +--- +title: "Why aren't Taskbar manager policies working as expected on my Windows 10 machine?" +description: "Why aren't Taskbar manager policies working as expected on my Windows 10 machine?" +sidebar_position: 10 +--- + +# Why aren't Taskbar manager policies working as expected on my Windows 10 machine? + +Netwrix Endpoint Policy Manager (formerly PolicyPak) Start Screen & Taskbar Manager policies will +fully work with Windows 10 build 1703. +With build 1607 only Start Screen policies are expected to work. +To get both Start Screen and Taskbar Manager policies to work, you will need to have the endpoint(s) +be 1703 or later. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windows10disablenotification.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windows10disablenotification.md new file mode 100644 index 0000000000..ce3783ef16 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windows10disablenotification.md @@ -0,0 +1,99 @@ +--- +title: "How to Disable the \"How do you want to open this? Keep using this app\" Notification in Windows 10" +description: "How to Disable the \"How do you want to open this? Keep using this app\" Notification in Windows 10" +sidebar_position: 120 +--- + +# How to Disable the "How do you want to open this? Keep using this app" Notification in Windows 10 + +When you install a new app in Windows 10 you may see a notification letting you know that you have a +new app that can open an application that already has a default file association defined. Below are +some examples of how the notifications appear and also two ways to disable these "New App Installed" +notifications. + +Notification Examples: + +![76_1_image-20200728223133-1](../assets/76_1_image-20200728223133-1.webp) + +![76_3_image-20200728223133-2](../assets/76_3_image-20200728223133-2.webp) + +![76_5_image-20200728223134-3](../assets/76_5_image-20200728223134-3.webp) + +## OPTION1: Using Group Policy Preferences > Registry + +**Step 1 –** Create a new GPO for Group Policy Preferences and give it a descriptive name. + +**Step 2 –** Select Computer Configuration > Preferences > Windows Settings > Registry + +**Step 3 –** Right-click on Registry and choose New > Registry Item + +**Step 4 –** Create the Registry policy item using the values below as a guide. + +Hive: HKEY_LOCAL_MACHINE +Key Path: SOFTWARE\Policies\Microsoft\Windows\Explorer +Value name: NoNewAppAlert +Value type: REG_DWORD +Value data: 00000001 + +![76_7_image-20200728223134-4](../assets/76_7_image-20200728223134-4.webp) + +Policy should look like below when created: + +![76_9_image-20200728223134-5_950x59](../assets/76_9_image-20200728223134-5_950x59.webp) + +**Step 5 –** Lastly, apply policy to computer OU or domain where you want New App notifications to +be disabled. + +## OPTION2: Using Endpoint Policy Scripts Manager + +**Step 1 –** Create a new GPO for Netwrix Endpoint Policy Manager (formerly PolicyPak) Scripts +Manager and give it a descriptive name. + +**Step 2 –** Select Computer Configuration > PolicyPak > Scripts Manager + +**Step 3 –** Right-click on Scripts Manager and select "Add Policy…" + +![76_11_image-20200728223134-6](../assets/76_11_image-20200728223134-6.webp) + +**Step 4 –** At the "Specify policy target" screen stick with the default "Apply this policy to the +computer (default)" then click "Next". + +![76_13_image-20200728223134-7](../assets/76_13_image-20200728223134-7.webp) + +**Step 5 –** At the "On apply action" screen select "PowerShell script" from the dropdown and then +copy in the text below then click "Next". + +``` +# Disable New app Alerts    if((Test-Path -LiteralPath +                        "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer") -ne $true) +                        { New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" +                        -force -ea SilentlyContinue };    New-ItemProperty -LiteralPath +                        'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' +                        -Name 'NoNewAppAlert' -Value 1 -PropertyType DWord -Force +                -ea SilentlyContinue; +``` + +![76_15_image-20200728223134-8](../assets/76_15_image-20200728223134-8.webp) + +**Step 6 –** OPTIONAL: At the "On revert action" screen select "PowerShell script" from the dropdown +and then copy in the text below then click "Next". + +``` +#Enable new app alerts    if((Test-Path -LiteralPath "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer") -ne $true)  +{ New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -force -ea SilentlyContinue } +;    New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' +                        -Name 'NoNewAppAlert' -Value 0 -PropertyType DWord -Force -ea +                SilentlyContinue; +``` + +![76_17_image-20200728223134-9](../assets/76_17_image-20200728223134-9.webp) + +**Step 7 –** At the "Specify process mode" screen select the "Once or when forced" option then click +next. + +![76_19_image-20200728223134-10](../assets/76_19_image-20200728223134-10.webp) + +**Step 8 –** Give the policy a descriptive name and then click finish. + +**Step 9 –** Lastly, apply policy to computer OU or domain where you want New App notifications to +be disabled. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windowsdefault.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windowsdefault.md new file mode 100644 index 0000000000..98c83eac2f --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windowsdefault.md @@ -0,0 +1,33 @@ +--- +title: "Windows default applications are not showing in Start Menu" +description: "Windows default applications are not showing in Start Menu" +sidebar_position: 90 +--- + +# Windows default applications are not showing in Start Menu + +Some Windows default applications are not showing in Start Menu when setting it via Netwrix Endpoint +Policy Manager (formerly PolicyPak) Start Screens Manager GPO. + +The problem we observe is with the following two Windows Applications: + +- QuickAssist.exe +- Psr.exe + +Your start menu has missing icons of the above programs, as shown in the following screenshot. + +![678_1_image-20191219082753-5](../assets/678_1_image-20191219082753-5.webp) + +The icons should come back after you apply the following workaround. + +Workaround for One/few computers: + +- Manually remove the folders from the following location: + +`%appdata%\Microsoft\Windows\Start Menu\PolicyPak Start Screen Manager\` + +Workaround for many computers using GPPref Item: + +- Use Group Policy Preferences Item to remove those folders from the location. + +![678_2_image-20191219082753-6](../assets/678_2_image-20191219082753-6.webp) diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windowserver.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windowserver.md new file mode 100644 index 0000000000..79fb862615 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/technical-notes/troubleshooting/windowserver.md @@ -0,0 +1,17 @@ +--- +title: "When does Endpoint Policy Manager Start Screen & Taskbar Manager work on Server 2019, 2016, 2012 R2?" +description: "When does Endpoint Policy Manager Start Screen & Taskbar Manager work on Server 2019, 2016, 2012 R2?" +sidebar_position: 20 +--- + +# When does Endpoint Policy Manager Start Screen & Taskbar Manager work on Server 2019, 2016, 2012 R2? + +There are two parts of Netwrix Endpoint Policy Manager (formerly PolicyPak) Start Screen & Taskbar +Manager: + +- Endpoint Policy Manager Start Screen Manager — Works on Server 2016 with (Desktop Experience) and + later (as it does with Windows 1703 and later). +- Endpoint Policy Manager Taskbar Manager — Will not work on Server 2016; but will work on Server + 2019 and later. + +Neither component will work on Server 2012 R2 (with Desktop Experience). diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/_category_.json new file mode 100644 index 0000000000..3d6905e8a2 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/_category_.json @@ -0,0 +1,7 @@ +{ + "label": "Video Learning Center", + "position": 2, + "link": { + "type": "generated-index" + } +} diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/extras/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/extras/_category_.json new file mode 100644 index 0000000000..d401662532 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/extras/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Extras", + "position": 40, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/extras/onetime.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/extras/onetime.md new file mode 100644 index 0000000000..5e284db47f --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/extras/onetime.md @@ -0,0 +1,11 @@ +--- +title: "Endpoint Policy ManagerStart Screen and Endpoint Policy Manager Scripts: Specify exact Start Menu experience one time" +description: "Endpoint Policy ManagerStart Screen and Endpoint Policy Manager Scripts: Specify exact Start Menu experience one time" +sidebar_position: 10 +--- +# Endpoint Policy ManagerStart Screen and Endpoint Policy Manager Scripts: Specify exact Start Menu experience one time + +If your Start Menu is a little unhappy, or if you want to dictate the Start Layout ONE TIME and let +users do whatever they want, then use these scripts to get the job done. + + diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/_category_.json new file mode 100644 index 0000000000..ee7419d8c4 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Getting Started", + "position": 10, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/demotaskbar.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/demotaskbar.md new file mode 100644 index 0000000000..63b24b50ff --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/demotaskbar.md @@ -0,0 +1,68 @@ +--- +title: "Endpoint Policy Taskbar Manager: Quick Demo" +description: "Endpoint Policy Taskbar Manager: Quick Demo" +sidebar_position: 30 +--- +# Endpoint Policy Taskbar Manager: Quick Demo + +Quickly and easily manage what icons are pinned to the Windows 10 Taskbar. Use Group Policy, SCCM or +your MDM service. It couldn't be easier. + + + +### PolicyPak Taskbar Manager: Quick Demo + +In a previous demonstration, you saw me use the Netwrix Endpoint Policy Manager (formerly PolicyPak) +Start Screen Manager to manage the Windows 10 Start Screen and get rid of the other groups that a +user might have created or that come in the default and also dictate tiles inside a group called "My +Important Apps." In this demonstration, you're going to see me deliver applications icons to the +Taskbar, and they can be applications that live inside your groups or ones that are just strewn here +across the whole universe. + +How are we going to do this? We're going to go over to our "GPMC," and you can do this either on the +computer side or the user side. I'm going to do this on the user side. I already have a GPO that I +created previously. You can create a new GPO or use the same one. Here I am. For my "East Sales +Users," I have this GPO I created in my previous demonstration. + +I'm just going to go to the "Taskbar Manager for Windows 10" location. I'm going to "Add/New +Collection," and I'll just call this "Coll 1." It doesn't really matter what it's called. The point +here is that there are two choices: "Merge" or "Replace." "Merge" says keep what the user already +has and just add your two or whatever icons on top of it. "Replace" says get rid of all these icons +here on the Taskbar and put your own. I'm going to show you "Merge" first and "Replace" second. + +We'll start off with "Merge" and we'll go ahead and click "OK" here. Inside the "Taskbar Manager," +we're going to "Add" either a "New Desktop Application" or a "New Universal Application." I'll go +ahead and pick a "New Desktop Application." I'll go ahead and start with good old "Adobe Reader." I +happen to have it installed on this machine, so it makes it a little easier. I'll go ahead and click +"Next," and I'll call this "Acro Pin" and I've done it. + +If I want to add a "New Universal Application," again this machine that I'm on happens to be a +server and server doesn't have a bunch of Windows universal applications. So I'm going to "Import +from" a list I've already got from my other machine. I'm going to "Import from" and "XML file" I've +already got here called my "PPSSM-apps-export-from-Win10" from my target Windows 10 machine. Here we +go. + +If I wanted to pin "Alarms & Clock" – why not? Let's do something a little bit different. "Alarms & +Clock," so we'll go ahead and say "Alarm pin." So we have these two icons here. I'll go ahead and +run a "Command Prompt" and run GP Update ("gpupdate"). Here's the thing. This won't take effect +until the guy logs off and logs back on. So actually, GP Update really doesn't matter in this case. +I could have just logged off and logged back on, but I'll show you what it looks like. Taskbar stuff +doesn't happen until you log off and log back on, so let's go ahead and do that. I'll "Sign out" and +then I'll sign back on. + +Now remember, we said Merge mode. So it should leave in place the application icons we already have +there. And just like that, we've added our "Adobe Reader" icon and also our "Alarms & Clock." +Fantastic.If we decide we want to change our mind here and we want to get rid of the icons that are +already here on the Taskbar, we're going to just change our method on the collection. We'll "Edit +Collection" and change the method to "Replace" mode. + +Like I said, stuff doesn't happen in Taskbar land until you log off and log back on, so let's go +ahead and show that. We'll "Sign out." Let's go ahead and log back on here. Now in the last +demonstration, we showed Merge. In this demonstration, we're going to show Replace. There we go. +Those are our icons. We've gotten rid of all the items that were standardized there. + +Now we have our Start Screen Manager managed and our Taskbar managed just like that. If this doesn't +knock your socks off, I don't know what will. I hope this makes you as happy as it makes me. If +you're looking to get started soon, just join us for the webinar and you can get started right away. + +Thanks so very much, and talk to you soon. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/helperutility.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/helperutility.md new file mode 100644 index 0000000000..6c62a37ee3 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/helperutility.md @@ -0,0 +1,86 @@ +--- +title: "Endpoint Policy Manager Start Screen and Taskbar Manager Helper Utility" +description: "Endpoint Policy Manager Start Screen and Taskbar Manager Helper Utility" +sidebar_position: 10 +--- +# Endpoint Policy Manager Start Screen and Taskbar Manager Helper Utility + +If you don't have the application already installed on your management station, then use this +utility to grab application IDs. It's easy. Check it out! + + + +### PolicyPak Start Screen and Taskbar Manager Helper Utility + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Netwrix Endpoint Policy Manager +(formerly PolicyPak) Software. In this video, I'm going to show you how you can use Endpoint Policy +Manager Start Screen Manager Helper utility to take applications that are installed on one machine +and get them deployed to other machines. + +What I mean by that is on your own management station, the one where you create Group Policy from, +you might not have an application. Like I don't have FileZilla, some application I want to pin to +the Taskbar or the Start Menu. I just don't have it, and you see this machine does have it. + +What you can do is take our little sidecar utility here. This is the download that you get from +Endpoint Policy Manager. In the "Endpoint Policy Manager Extras" folder, you're looking for the +"Endpoint Policy Manager StartScreen and TaskBar Manager Helper" utility. + +What this puppy is going to do is take all the applications that you have – the Desktop/registered +applications and the universal applications – and let you export all of their IDs. Let me show you. +This is all the stuff that's on this machine. There you go. You can see I have "FileZilla" on this +machine. I don't have it on my GPMC machine. + +I'll go ahead and click "Next" here. I'll also take all the Windows universal apps. If you have +something special like some unique developer app or some unique Windows universal application, +that's great. We're going to detect it here on this machine, and you can export all things that are +some end user's machine. + +We'll go ahead and click "Next" here, and we'll go ahead and "Browse." I'm going to just store this +on the server here under "\dc2016share." I'm going to call this "Registered and UWP apps on" this +machine. We make it easy for you to just know that's this file. We'll go ahead and save it and +"Finish." + +Now that we've got that set, let's go over back to our GPMC machine. Here's our group. We're +delivering all this stuff already: "Acro Reader tile," "big calc," "Chrome icon" and "Get Help for +PP website." Let's just see that here. Yes, we sure are. We're doing all that great stuff. + +Now we want to add FileZilla. If we were to right click, "Add/New Universal Application Tile," +remember my machine doesn't have FileZilla. So when I go down, there is no F and FileZilla. But I +can "Import from" "XML file" and pick the application XML that I just exported ten seconds ago and +click "Open." What I should see is that the list changes. There it is, "FileZilla," just like +that.We'll double click that guy, click "Next" and we'll give it the size here. Click "Next," and +we'll call this "Filezilla." + +And that's it. Now "FileZilla" is here under "Recently added." We want it to jump over to "My +Important Apps." Let's go ahead and run GP Update ("gpupdate") and let's see this go ahead and take +effect. Now that that's done, we'll go ahead and close this out. Let's check out the Start Menu, and +just like that, exactly the way we would expect. + +In this way, if you don't have an application on your own management station but you do have it on +an endpoint, if it's a standard desktop app or a windows universal app, you can use our little +sidecar utility and export. + +There's actually one additional little magic trick I want to show you with this little sidecar +utility here. You can run the "Endpoint Policy Manager StartScreen and TaskBar Manager Helper" here, +and let's just take a look at the universal ones for a second. + +What you might want to do is let's say you want to get this "Code Writer" application ID. You can +simply literally "Right-click Application ID to auto-copy it to clipboard." So When you type +"Notepad" here, you see there's that ID. Why is that interesting? Because instead of going through +the entire process like I just showed you, you may want to simply right click, "Add/New Universal +Application Tile" and click on "Custom Universal Windows Platform application." + +Because you know the ID, you can just paste it in just like that. Does that make sense? You grabbed +it over here, and you go ahead and lay that custom app in there. We can pick the icon, and we'll +call this "Code Writer." So we have that guy in there. Now we don't need to export at all. We just +grabbed the ID just the way we wanted to. + +Let's take a look at the before picture. We don't have the app. Let's look at the after picture by +running GP Update ("`gpupdate`"). Give this a couple seconds to finish up. We'll go ahead and close +this out. Check it out, and "Code Writer" is there. So again, this machine has Code Writer. The +other machine didn't have Code Writer. All I did was I grabbed the ID and threw it in there just the +way I wanted to. + +That's all we have for now. I hope this helps you out. Looking forward to getting you started real +soon. +Thanks. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/itemleveltargeting.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/itemleveltargeting.md new file mode 100644 index 0000000000..0a486d97f2 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/itemleveltargeting.md @@ -0,0 +1,67 @@ +--- +title: "Endpoint Policy Manager Start Screen Manager: Using Item Level Targeting" +description: "Endpoint Policy Manager Start Screen Manager: Using Item Level Targeting" +sidebar_position: 40 +--- +# Endpoint Policy Manager Start Screen Manager: Using Item Level Targeting + +Automatically specify "who should get what" settings based upon conditions like security group, +Laptop vs. Not laptop and so on. + + + +### PolicyPak Start Screen Manager: Using Item Level Targeting + +In a previous video, you saw me use Netwrix Endpoint Policy Manager (formerly PolicyPak) Start +Screen Manager to dictate a group called My Important Apps to everybody on the machine. But what if +you wanted to have different people get different groups? That's easy enough to do, and I'll show +you how to do it with Endpoint Policy Manager. + +This is East Sales User 1 who is currently logged on, and he's getting "My Important Apps." Let's +maintain that for East Sales Users, so what we'll do is we'll go over to "Collection 1" over here. +Let's rename that. Let's "Edit Collection" and call it "East Sales Users." While we're here, we'll +change the +"[https://www.endpointpolicymanager.com/pp-blog/item-level-targeting](https://www.endpointpolicymanager.com/pp-blog/item-level-targeting)" +and specify that this stuff will only work when the "Security Group" is our "EastSalesUsers."What +we're doing is we're marrying using item-level targeting and saying do this stuff called "My +Important Apps" when the guys are "East Sales Users." + +Let's go ahead and "Add Collection" and we'll call this "West Sales Users." We'll click on "Item +Level Targeting" and we will specify the "Security Group" being "WestSalesUsers." Now we have a +collection called "West Sales Users" here. We're going to for our West Sales Users create another +group ("Add/New Group"). Let's call it "West Apps." + +We'll just add two things here. Let's go ahead and add WinZip and we'll add Firefox. We'll go ahead +and "Add/New Desktop Application Tile," "Registered application" and we'll go ahead and pick +"Mozilla Firefox" as the first one. There we go. We'll make that "Medium," and we'll go ahead and +call this "Firefox." + +We'll create another one. "Add/New Desktop Application Tile," "Registered application" and we'll +pick "WinZip." Here we go. Now that we've done that, I'll also make that "Medium" here and call that +"Winzip." That's all there is to do, so actually I'll go ahead and close this for now. + +I just want to make sure. Right, so this GPO is linked over to all of my "Sales" team. Let me go +ahead and rename that to call this "PPSSM Sales Demo." So this GPO is hitting all the "Sales" and +therefore the guys in "East Sales" and "West Sales" are going to get this Group Policy Object. + +Let's go over to our machine here. I'll run GP Update, but I don't expect any changes. If I go right +here ("Command Prompt") and type "gpupdate," the goal is that we've tied the original settings down +to East Sales Users. Then when we change user over to West Sales User, that's where we're going to +see the change. So on the same system, we'll have two different Start Menus: one for the East Sales +Users and one for the West Sales Users. + +Let's close this out, and let's check it out. We shouldn't see any change, and we don't. That's +exactly what we wanted. Let's go ahead and "Sign out." We'll go ahead and sign in this time as +"westsalesuser1." This is where we want to see the West Sales User Start Menu be different than the +East Sales User. Let's go ahead and take a look at the Start Menu here, and he just gets "West +Apps." + +So with one Group Policy Object here that we created, we have different collections. The collections +are using item-level targeting and they're doing different things based upon different Active +Directory group membership. You don't have to use Active Directory group membership. You can say +when I'm on a desktop do this, when I'm on a laptop do that. When I have this application do this, +when I have that application do that. It's incredibly flexible. + +I just wanted to give you a quick taste of how that would work. One policy to rule them all. You +don't have to be stuck with one fixed policy. Just as simple as that. I hope this helps you out. +We're looking to get you started soon with Endpoint Policy Manager Start Screen Manager. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/linksie.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/linksie.md new file mode 100644 index 0000000000..ba7fcaf1fd --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/linksie.md @@ -0,0 +1,62 @@ +--- +title: "Endpoint Policy Manager Start Screen Manager: Add IE links" +description: "Endpoint Policy Manager Start Screen Manager: Add IE links" +sidebar_position: 50 +--- +# Endpoint Policy Manager Start Screen Manager: Add IE links + +Need to add IE links to the Start Menu? Here's the quick and easy way… With Netwrix Endpoint Policy +Manager (formerly PolicyPak)! + + + +### PolicyPak Start Screen Manager – Add IE links + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Endpoint Policy Manager +Software. In this video, I'm going to show you how you can use Endpoint Policy Manager to create +Internet Explorer shortcuts in the Windows 10 start screen using Endpoint Policy Manager Start +Screen Manager. Now we have other videos that are intro videos. This is how to create a custom +shortcut. + +Here's how to do that. Let's go ahead and "Create a GPO in this domain, and link it here" called +"PPSSM Demo 2." This is for the Start Screen and Taskbar Manager. Again, we have other getting +started videos. This is a little bit more advanced. + +The request came in, how do you create Internet Explorer shortcuts? Because if you look at "Start +Screen Manager" and "Taskbar Manager" here and you were to first "Add" a "New Collection," a +collection defines the behavior. There's "Not Configured." "Not Configured" is by default "PARTIAL +(PRESERVE)" which will leave users' groups in place and then let users add their own. "FULL +(REPLACE)" says nuke what they've got and add your own. I'm going to just leave it "Not Configured" +which, again, will mean it will be "PARTIAL (PRESERVE)." + +I'm going to "Add" a "New Group" called "My IE Links." In order to do this, it's really quite +simple. You right click, "Add." There's no Internet Explorer characteristic here. You're going to +"Add" a "New Desktop Application Tile" as a "Custom application." All you have to do here is "Select +application" Internet Explorer. I just did a quick test of this, but you do "C:Program Files +(x86)Internet Explorer." + +Then when you click on "iexplore," we're going to jam that in as the "Target Application." Here's +the magic fairy dust. You have to put this part in quotes first for "Target Application" and then +put the URL you want second. So say "www.abc.com." I'll go ahead and capture that for later +actually. + +You can "Change icon" if you want to, but I'll leave it say here as Internet Explorer. I will change +the icon size and location. I'll call this "ABC Link with IE." I'll create another one. "Add" a "New +Desktop Application Tile," "Custom application." I will once again "Select application" of Internet +Explorer and then put the whole thing in quotes. Then instead of "www.abc.com" I'll do www.cbs.com. + +I'll call this "Shortcut Name" "CBS." Oh, I forgot to do that on the first one. Let me go ahead and +do that. I'll fix the first one since I'm thinking about it. This is "CBS." Let's go ahead and fix +that here. That would be "Desktop Application." The "Shortcut Name" should be the name of the +website, so "ABC.com" or whatever want to call the actual link. + +Once you've done that and you go over back to your endpoint here, just to show you it's not there, +what I'll do now is run GP Update ("gpupdate"). You can watch this happen in real time, which is +pretty nifty. What we're looking for is we're going to leave the groups in place, add our group. +There we go: "ABC.com" and "CBS." When you click on "ABC.com," it's going to launch ABC. When you +launch "CBS," it's going to launch CBS. + +Now it is going to do this in another window. We can't somehow magically merge the windows together. +But that should get you where you need to go. I hope this video helps you out and you're ready to +get started with Endpoint Policy Manager Start Screen Manager real soon. +Thanks so much. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/windows10startmenu.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/windows10startmenu.md new file mode 100644 index 0000000000..b7c95c2036 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/gettingstarted/windows10startmenu.md @@ -0,0 +1,143 @@ +--- +title: "Endpoint Policy Manager Start Screen Manager: Own the Win10 Start Menu" +description: "Endpoint Policy Manager Start Screen Manager: Own the Win10 Start Menu" +sidebar_position: 20 +--- +# Endpoint Policy Manager Start Screen Manager: Own the Win10 Start Menu + +The Windows 10 Start Menu is a beast to configure. Instead of leaving the Start Menu to users, YOU +be in charge. See this video to get the basics down in minutes ! + + + +### PolicyPak Start Screen Manager: Own the Win10 Start Menu + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Netwrix Endpoint Policy Manager +(formerly PolicyPak) Software. In this video, I'm going to show you how you can tame the dreaded +Windows 10 Start Screen. How do we do it? We're going to use our Start Screen Manager program. + +You can see, we already have three groups that are here in the +[https://www.endpointpolicymanager.com/pp-blog/windows-10-start-screen](https://www.endpointpolicymanager.com/pp-blog/windows-10-start-screen). +We're going to create our own called Our Important Apps. What are we're going to add there? We're +going to add maybe "Adobe Reader," maybe add the "Calculator" and also add and Edge tile. We'll see +how to do that. + +Over here on our "GPMC," these are our "East Sales Users." We'll go ahead and "Create a GPO in this +domain, and link it here." We'll call this "PPSSM ESU Demo." We'll right click over our "East Sales +Users" and click "Edit." Now what we're doing is on the user side. You could also do what we're +about to explain on the computer side. I'm not going to do that. + +I'm going to do this here on the user side and go to the "Start Screen Manager for Windows 10" and +right click, "Add/New Collection." Now a collection is where the groups are going to be contained. +You have to make an important decision here, and I'm going to show you both. + +"PARTIAL (PRESERVE)" will preserve what's currently there. We're going to start off with that, and +then later I'm going to show you how you can replace – "FULL (REPLACE)" – what's already on the +endpoint. Let's start off with "PARTIAL (PRESERVE)." I'll show you what this looks like here. + +Inside this collection, we're going to "Add/New Group." This is the name of the actual group that's +going to show up on the Windows 10 Start Screen Menu. We'll call this "My Important Apps." I'm not +going to worry too much about these extra options for now. I'll just go ahead and click "OK." + +Inside here, now we're going to "Add" our icons. We'll start off with a "New Desktop Application +Tile." This machine, the machine I happen to be on, is the "GPMC" running on Server 2016. It has an +application on it that you know and love, and that's "Adobe Reader." I have the same version of the +application on my endpoint that I do here. That makes it easy. I can just point and click my way to +selecting it. + +And then I can pick what tile size. Desktop applications have two tile sizes, and the Windows +universal apps have four tile sizes. I'm going to go ahead and pick "Medium." I'll call this "Acro +Reader tile." It doesn't matter what that's called. That's just the policy name. And we've created +our first entry.So we have the collection ("Collection 1"), the group ("My Important Apps") and our +entry ("Acro Reader tile"). + +Next what we'll do is we'll "Add/New Universal Application Tile." For instance, this is the big +metro-style applications, Windows universal applications. I'll click "Next." But I'm on a server +machine and a server machine doesn't have Windows universal apps on it, so we don't get a complete +list. + +But what you can do is "Import from" an "XML file" from a machine that you know and love. In fact, +I've already done this. I have my export from my Windows 10 machine. So all my custom apps and all +the built-in apps and all the Windows universal apps that are already on my machine over here, I've +already got ready to go and I can pick from them here. + +I'm going to go ahead and pick Calculator. Let me go ahead and sort by the "Name" here and find +"Calculator." There we go, there's "Calculator" and click "Next." I'll make this big calc, so I'll +go ahead and choose the "Large" and I'll call this "big calc." + +Then the last thing I'll do is I'll "Add/New Edge Tile." My Edge tile will let me give it a name. +I'll call this "Get Endpoint Policy Manager Help," and then the "URL" can be +[https://www.endpointpolicymanager.com](https://www.endpointpolicymanager.com); There we go, and click "Next" and I can make +this a "Wide" tile. + +You can also change the Desktop "Background" colors if you're so inclined and all that sort of +thing. I'm just going to leave the defaults here. So I have a "Wide" tile here. Click "Next," and +I'll call this "Get Help for PP website." That's it. I've created three entries. Let's go over to +our endpoint. + +Let me show you the before picture. I've got three built-in groups from Microsoft. Now we'll go +ahead and go to a "Command Prompt" and run GP Update ("gpupdate"). In this demonstration, you're +seeing me use Group Policy to do the work, but you don't have to. You could use SCCM. You could use +an MDM service or anything else you use to deploy policy, either on-prem or a cloud service. I just +happen to be using Group Policy in this demonstration. Let me go ahead and close out the GP Update +window here. + +Now it's time to check it out. If we click on the Start button here, here we go: "My Important +Apps." You can see the little lock icon designating that if you were to try to drag in something +over here, it's a "Locked group." + +Now we called this Partial mode. Partial lets users move things around. You can see I'm doing this. +I'm letting users do whatever they want in their playground, but they can't screw up my playground. +They can't unpin it. They can't move stuff in. It's just as simple as that. That's the first thing I +wanted to show. + +The second thing is, what if you don't want these built-in groups at all and you don't want any +users to mess with any of the groups that they have. That's called Full mode. Let's go ahead and see +what that looks like. + +Actually, you know what I didn't do? I didn't click on all these icons just to prove a point, just +to show that they are working just the way you would expect here. I'll click on that guy ("Adobe +Reader"). That guy's fine. I'll go ahead and click on "Calculator." That guy's fine. I'll go ahead +and click on "Get Endpoint Policy Manager Help," and that guy's fine. So we've deployed all three +icons right to the Start Menu just the way we would expect. + +Again, for the next trick, what we want to do is to say let's get rid of all the default stuff and +also anything that a user might have done up until this point, and that's called Full mode. We'll go +back to the "Collection 1" we created earlier here. We'll right click and we'll "Edit Collection," +and we'll change this to "FULL (REPLACE)" mode. + +"Default and User-created Groups are REMOVED. User is prevented from making changes to your defined +groups. Only groups created by Endpoint Policy Manager will remain." That's it. This is not +reversible, so we throw up a "WARNING" just to make sure you understand that this is not reversible. +"ALL GROUPS CREATED BY THE USER (or the OS Defaults) will be DELETED." + +Let's go ahead and see the result of that. Let me show you the before picture. We have all four +groups. Then we'll go to a "Command Prompt," we'll run GP Update ("gpupdate"). All this will take +effect also at next logon and also in the background. I just happen to be running GP Update to make +things go a little bit faster here. I'll go ahead and wait for this to finish. Now that that's done, +let's go ahead and close out this window here. + +We'll go over to the Start Menu, and just "My Important Apps." Users can no longer create groups, +and they can't mess with the groups you've set down. They can't drag icons in and so on. It's just +the way you would expect. + +Now what if you wanted to add something new? It couldn't be easier. You just go back to your group +here. You can right click, "Add/New Desktop Application Tile," "Registered application." I happen to +have "Google Chrome" on this machine here. I'll go ahead and find "Google Chrome" and click "Next." +I'll make it a "Medium" tile and we will call this the "Chrome icon." That's it. We have all four +guys in here. + +Let's show you the before picture. Let's go ahead and run GP Update ("gpupdate") one last time here. +We'll go ahead and see this take effect. We'll go ahead and let this finish. Close this out, and now +let's see the after picture. + +Just like that, you've added "Google Chrome" to your Start Menu. You can use your software +deployment tool to deploy it and use Endpoint Policy Manager Start Screen Manager to get the icon +right where you want to in the right group of your choice. + +Endpoint Policy Manager Start Screen Manager is a real game changer. Continue to watch the other +videos, like how to change +[Endpoint Policy Manager File Associations Manager: Manage Windows 10 & 11 File Associations](/docs/endpointpolicymanager/file-associations-manager/video-learning-center/gettingstarted/windows10) settings, +to see how you can easily open PDFs, MAILTO and MP4s with the programs you want. + +Thanks so much for watching, and talk to you soon. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/_category_.json new file mode 100644 index 0000000000..e8e8fa6286 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Methods SCCM XML MDM Cloud PDQ Citrix Etc", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/citrix.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/citrix.md new file mode 100644 index 0000000000..594d26df21 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/citrix.md @@ -0,0 +1,186 @@ +--- +title: "PP Start Screen and Taskbar manager with Citrix XenApp and XenDesktop" +description: "PP Start Screen and Taskbar manager with Citrix XenApp and XenDesktop" +sidebar_position: 40 +--- +# PP Start Screen and Taskbar manager with Citrix XenApp and XenDesktop + +Got icons from Citrix, and want to dynamically get them onto your REAL and VIRTUAL desktop Start +Menus and Taskbars? Good luck… if you don't have Netwrix Endpoint Policy Manager (formerly +PolicyPak) Start Screen and Taskbar manager. Here's the video to show you how to manage XenApp and +XenDesktop icons on the Start Menu and Taskbar. + + + +### PP Start Screen and Taskbar manager with Citrix XenApp and XenDesktop + +Hi. This is Jeremy Moskowitz, former Group Policy MVP and Founder of Endpoint Policy Manager +Software. In this video, I'm going to show you how you can use Endpoint Policy Manager Start Screen +Manager in conjunction with your Citrix world. + +You probably have this scenario, which is this is a standard desktop over here. You might even have +a little folder called "Citrix." In Windows 10, it's freaking hard to get these icons. For instance, +if you launch "Firefox," it's going over there to the Citrix machine and, as you can see, kicking +off "Firefox" right there. + +It's really hard to get the icons that are here in Citrix land over to a little group here on your +real Windows 10 start screen. I'm going to show you how to do that. Then I'm going to also show you +when you're inside a virtual desktop or a remote desktop, how to configure the icons in there. So +this is a two-part video. + +The first thing we're going to do is let's say you wanted to get "Firefox" and "Internet Explorer," +the ones that are over there on Citrix as icons over here on your real desktop. However are we going +to do that? + +What you'll do is you'll right click over and go to "Properties" here in Citrix land and you'll take +this "Target" location and "Copy" it. Then here in Endpoint Policy Manager Start Screen Manager, +this is for our "East Sales Users." So you're saying wherever the user logs on, they're going to get +these settings. + +I'm going to say "PP SSM Citrix Demo 1" here. I have some other unrelated things that are not linked +here. We'll go ahead and click "Edit" here and we'll dive down under user side "Endpoint Policy +Manager." We'll go to "Start Screen Manager for Windows 10." + +We'll "Add" a "New Collection." The collection is going to dictate the style of how we're going to +be doing this. We can either nuke everything that the user already has ["FULL (REPLACE)"], or we can +simply add more to what they already have ["PARTIAL (PRESERVE)"]. I'm going to go ahead and do that. +I'll call this "Collection 1." + +Now inside the collection is where you create that actual group name. Maybe the group name I'll +create here is called "Remote XenApp apps." We'll click "OK" here. Then we want to put our first +icon in there. Like I said, you have to right click over the icon in Citrix land and copy the +"Target" in. + +We'll go ahead and right click, "Add" a "New Desktop Application Tile." This is going to be +considered a "Custom application" because it's not registered. You're going to simply paste it in. +You can see it's taking the information that we've already got here as the "Target Application" for +the Citrix receiver. This is Firefox here. You can see it's doing the "Firefox" stuff there. + +We'll go ahead and click "Next" here, and actually the rest of it doesn't matter. It all comes from +Citrix land. You have to give it a name, but it doesn't really matter: "Firefox." We'll go ahead and +give it a "Medium" icon and click "Next." We'll call this "Firefox app." + +Once we've done this, let's go ahead and do one more here. Let's go ahead and take "Internet +Explorer" here. We'll right click, go to "Properties," and we'll "Copy" the "Target" thing. Again, +you can see it has that specially formatted Citrix idea here. + +We'll "Add" a "New Desktop Application Tile," "Custom application," and we'll paste it in. Again, +the "Shortcut Name" doesn't matter. It grabs that. We'll call this "IE." We'll go ahead and go to +"Medium" here and click "Next." We'll call this "IE from xenapp." + +All right, now that we've done that, let's see it work. We'll go over here. We can see there's +nothing up my sleeve here. I don't have those groups right now. When I go to a "Command Prompt" and +run GP Update ("gpupdate"), we can actually watch this in real time. + +We'll go ahead and watch that. We'll be adding another group or merging that group that we just +created right there. Here's our "Remote XenApp apps" right there. When we run "Firefox" now, it's +not running it locally. No, it's getting it all the way from the Citrix server and presenting it to +us through XenApp and we could do the same thing with Internet Explorer. + +That is beautiful thing number one. Beautiful thing number two is what if you click here and you +decide you want to launch. Actually, let me do that. Let me go ahead and take that "Desktop" app. +Let me grab that guy, and we'll "Copy" that in too. Why not? + +We'll copy that guy here and we'll go ahead and "Add" a "New Desktop Application Tile," "Custom +application." I'll paste this. This is a full remote desktop, a full RDP remote desktop. Give it a +name: "Remote 123." Again, the name doesn't matter. It's pulled from Citrix. We'll go ahead and pick +"Medium" tile here and we'll call this "Remote Desktop." + +All right, I meant to do that earlier. Let's go ahead and see that that takes effect. Then when we +click in it, that's where I want to show you something that's interesting. There we go. Perfect. Now +that we have our applications and our remote desktop, let's go ahead and click into there and see +what happens. + +Now we're going in remotely. When we're going in remotely, what's it going to do? It tells you if +you want to get out of that, hit "SHIFT+F2." That's totally fine. Here we are. Now we're on the +inside of the Citrix server. Now again, mine is not totally set up so you're going to see some +server stuff and my apps. + +That's great, but wouldn't it be amazing here inside the Citrix world that I could make my own +groups? The question is, how do you distinguish between inside the Citrix world and outside the +Citrix world? In fact, let me go ahead and "Disconnect" here. We actually "Sign out" here. + +Let's think about this one more time. This is my real desktop here. Then inside is my RDP desktop. +Here's what I'm going to do to correct for that. Let me rename this first collection. That might +actually make it smarter. I'll "Edit Collection" and I'll call this "Stuff for REAL desktops." Then +I'll create another collection called "Stuff for inside RDP desktops." Does that make sense? I want +to make this maybe "FULL (REPLACE)." I'll nuke whatever is out there and I'll put just the things I +want to in this particular case. + +But the question is, how do I make the distinction between "Stuff for REAL desktops" and "Stuff for +inside RDP desktops"? That's where item-level targeting comes in. Let's do the "Stuff for inside RDP +desktops" first. + +We'll go ahead and "Change Item Level Targeting" here. We will say only do the "Stuff for inside RDP +desktops" when it's a "Terminal Session." So the RDP session type is "Any." Great, so we light this +up as orange here. + +Let's go ahead and create some icons. We'll "Add" a "New Group." We'll call this "inside Apps." +Let's do something a little bit different. We'll go ahead and do Chrome and maybe Firefox this time. +We'll "Add" a "New Desktop Application Tile" here, "Registered application." + +We'll pick "Google Chrome," go ahead and pick "Medium." We'll call this "Chrome." Again, these are +the icons that we're going to see inside the remote desktop. Now we'll go ahead and do another one +here for "Mozilla Firefox." We'll call this "Firefox." + +Great, but we still haven't made the distinction for how to describe "REAL desktops" versus "RDP +desktops." Well, we did for RDP but not for real desktops. You know what a real desktop is? Anything +that's not an RDP session. + +We'll "Change Item Level Targeting" on the "Stuff for REAL desktops" by making a new check to see is +it a "Terminal Session." We don't want it to be to be yes. We want it to be whenever it "Is Not" a +Terminal Session. See what I'm doing there? + +So I have "Stuff for REAL desktops." Only when it's real desktops is it going to evaluate this and +do these icons. Then I have "Stuff for inside RDP desktops." It's only going to evaluate that when +it's an RDP desktop. + +Let's see it all work. If I go back over here, just to prove a point, if I run GP Update +("gpupdate") here, this is my real machine. My real machine shouldn't change at all. It should +maintain these three icons just the way we said. Nothing changes. Everything is great. + +But now when I go inside "Desktop1," this is going to be a full RDP session. We said nuke the +existing icons and slap in just the icon group that I want. Let's see if it works. Click in here. +Here are the "Inside Apps," and you can see we have "Google Chrome" and "Firefox." If we launch +"Google Chrome," it's getting it right here locally to the Citrix box as far as it's concerned +because it's running there on the full remote desktop. There you go. + +In this way you are autosensing. You're making a collection. The collection senses if you're on a +"REAL" desktop and it will do these things. Another thing that will sense are you in "RDP" desktop +land and, if so, do these things. + +With item-level targeting plus Start Screen Manager, you're able to manage your real machines. Let's +go back to your real machine by selecting "Sign out" here. What we're seeing is on our real machine +we're able to add items to the start menu. + +For our remote desktops when we log on we're able to manipulate and correctly solve the challenge +for the remote desktop problem. When we click into it, we're going to see, like I said, the "Inside +Apps." We said nuke all those icons and just put the things that are important to us. + +Let's do one last thing since I'm thinking about it which is the actual taskbar. Let me go ahead and +"Disconnect" here. Let's pin something to the taskbar. Maybe we could do it for all cases. So maybe +in all cases we'll have a "Collection" here. We want to say always pin Firefox and we want to do it +everywhere. + +We'll "Add" a "New Desktop Application" for the "Taskbar Manager for Windows 10." It's a "Registered +application." We'll pick "Mozilla Firefox." We want to call this "Firefox" here. This "Collection" +has no item-level targeting on it, so it should work for our "REAL desktops" and our XenApp "inside +RDP." + +In order to see this work, we have to run GP Update ("gpupdate") on the real computer. Then we're +going to log off and log back on and see it take effect. The taskbar thing only works after you get +the Group Policy and after you log on. So we're going to run GP Update ("gpupdate") first. We going +to log off, log back on, and then we'll check inside the Citrix box too and see how that shakes out. + +Let's go ahead and "Sign out" here. We'll go ahead and sign back on. There we go. This is our real +machine. We can see Firefox is there. Now if I were to go into the remote desktop here, here I am in +the remote desktop now. If we take a look, there's Firefox in the remote desktop and it launches +just like that. + +Of course, Firefox wants to be updated. That's what Firefox likes to do. But you get the gist. The +point is that we've pinned the taskbar icon in real life and also in RDP life because we didn't say +do different things for different circumstances. + +I hope this helps you out and you're ready to get started with Endpoint Policy Manager Start Screen +and Taskbar Manager in your real world and also in your Citrix world. +Thanks so much for watching. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/mdm.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/mdm.md new file mode 100644 index 0000000000..60ce284b07 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/mdm.md @@ -0,0 +1,138 @@ +--- +title: "Endpoint Policy Manager Start Screen & Taskbar Manager: Manage Windows 10 Start Screen & Taskbar with your MDM service (Basics with MDM)" +description: "Endpoint Policy Manager Start Screen & Taskbar Manager: Manage Windows 10 Start Screen & Taskbar with your MDM service (Basics with MDM)" +sidebar_position: 20 +--- +# Endpoint Policy Manager Start Screen & Taskbar Manager: Manage Windows 10 Start Screen & Taskbar with your MDM service (Basics with MDM) + +The Windows 10 Start Menu is a beast to configure, and once configured, it's not at all dynamic. +Instead of leaving the Start Menu to users, YOU be in charge. See this video to get the basics down +in minutes, then deploy your settings using the MDM service of your choice! + + + +### PolicyPak MDM: Manage the Windows 10 Start Screen Like a Boss + +Hi, this is Whitney with Netwrix Endpoint Policy Manager (formerly PolicyPak) Software. In this +video, we're going to learn how you can use Endpoint Policy Manager Start Screen Manager to manage +your users' start menus in Windows 10. We're then going to take those directives, wrap them up in an +MSI and deploy them using the MDM solution of our choice. In this video, I'll be using AirWatch, but +you can use whatever MDM solution you have, such as Intune or MobileIron. + +When you first roll out Windows 10, you'll notice on the Start Screen it has kind of a lot of junk +in here. Maybe you want it; maybe you don't. Either way, it can be really tedious to manage this +using the in-the-box Microsoft method. It involves golden images, XML, PowerShell. The problem is in +addition to being tedious, it also isn't particularly dynamic. If you want to change anything, you +have to go through that whole golden image business all over again. We're going to use the Endpoint +Policy Manager method and then deploy it using an MDM solution. + +To start off with, let's note that I am not domain joined right here. I could be and it wouldn't +change anything, but for this component that is not a necessity. We're also going to see that I am +indeed "Connected to AirWatchMDM MDM" service. Once again, I'm using AirWatch, but you can use your +solution of choice. + +Finally, I want to point out that I do have the "Endpoint Policy Manager Client-Side Extension" and +the "Endpoint Policy Manager MDM Licenses for Endpoint Policy Manager" already installed on my +machine here. This is my endpoint, and I have to have those two moving parts to be able to make any +of the future directives work. + +So we've figured out what the problem is; now let's figure out how to fix it. I'm going to go over +to my management station here, and I'm going to go ahead and open up my "Console" here, my GPMC. I'm +going to create a "New GPO." It doesn't have to be in any particular OU. I'm just going to call it +"SSM Settings." I'm going to go "Edit" this bad boy. + +This can be done on the computer side or the user side. It's up to you. Whatever is best for your +environment. I'm just going to go over to the computer side for now. I'm going to go choose the +"Start Screen Manager for Windows 10" right here. The "Start Screen Manager" you have to start with +"ADD NEW COLLECTION." Right now, I'm going to just leave it being called "Collection 1" since we're +only doing the one. + +You have some choices to make here. You can either use "PARTIAL" or "FULL." "PARTIAL" means that it +will merge your settings with the settings that already exist on the machine and users can still +create their own groups and pin their own tiles. "FULL" means that you're going to completely blow +away what is already there and the user can no longer pin their own tiles. I'm going to go ahead and +choose "PARTIAL" for this demo today. + +I'm going to go ahead and create that collection. Within that collection, I'm going to create a +group. The group is what's going to contain my pinned tiles. I'm going to "ADD NEW GROUP." I'm just +going to call this "Important Apps." I'm going to leave all of this as it is set already, and I'll +tell it "OK." + +Within that group, I can start pinning tiles. I can pin three different types of tiles. I can do a +universal app, a desktop application or an Edge tile. Let's go ahead and pin all three. I'll start +by clicking the "ADD UNIVERSAL APP" button, and we'll get a wizard that we'll just work our through. +We'll click "Next." + +Now we'll decide which application we want. I think "Calculator" is a pretty important app. We'll +click "Next." Let's go big or go home. Let's make it "Large." Universal apps get three different +tile sizes, and so we're going to choose "Large." I'm just going to call it "Big Calculator," and +we'll "Finish" that out. + +Then I'm going to "ADD NEW DESKTOP APPLICATION." Now it's recommended that when you're doing these +pinnings that you pin from a management station that has the same applications as your endpoints +will. If that's not possible, we have a helper utility that will make that work for you but we'll +have to go over that in a different video. + +We're going to choose our "Registered application" here, and I'm going to wait for it to find all +the applications on this machine that I'm working on. I'm going to pin "Adobe Acrobat Reader DC." I +know that is on my endpoint as well, so I'm going to choose to pin that one. The desktop +applications only get two tile sizes. I see no reason to be "Small," so let's go "Medium." We'll +click "Next," and we'll just call this "Acrobat" and that's that. + +Finally, an Edge tile is basically a link so that when you click on it, it opens Edge and opens the +link of your choice. So we will choose "ADD EDGE TILE." We'll give it a "Display name." I'll just go +with "Endpoint Policy Manager." The "URL" you can "Select from favorites" here if you want to, but +I'm just going to type it in here and click "Next." I can do "Small," "Medium" or "Wide." I'm going +to choose to make a "Wide" tile and click "Next." We'll give it the "Policy Name" "Endpoint Policy +Manager Link" and "Finish." + +Great. Now we've created a group, and we've pinned three different tiles. We need to be able to wrap +that in an MSI somehow and send it over to our non-domain joined MDM enrolled machine. To do that, +what we're going to do is start by going back to "Collection 1" here. I'm going to right click and +choose "Export Collection as XML." I'm just going to put it right on the "Desktop." I'll just call +it "SSM Settings." It will pop up right there on the desktop in just a moment. There it is. + +Now what we need to do is use the Endpoint Policy Manager Exporter Tool in order to wrap that XML up +in that MSI so we can deploy it to our MDM enrolled machines. Let's go to the "Endpoint Policy +Manager Exporter Tool" which installs alongside the admin console MSI. We're going to use it to +"Create a new MSI installer." We'll choose "Next." + +We're going to "Add Existing Files." We will choose our "SSM Settings." It's going to "Install For" +"Computer" with a "Target" of "All Users." We'll choose "Next." We can give it a "Product Name," +which is what's going to show up on "Uninstall or change a program" in your Control Panel. We'll +call it "PPSSM Settings." It will ask us where we want to save it. We'll just call it the same thing +and save it right on the "Desktop." It will pop up right here. There we go, and we're done. + +The next thing I need to do is go log in to my AirWatch Console and upload it so that it can then +get deployed to my endpoint. However, since that takes a little while, I'm going to go ahead and +pause the video before I upload and deploy. Then we'll come right back as soon as that's done. + +Now I do just want to point out once again that we already have deployed the "Endpoint Policy +Manager Client-Side Extension" and the "Endpoint Policy Manager MDM Licenses." We mentioned that +earlier in the video. Just pointing it out again. Those are what needs to be deployed in order to +make anything else work. We'll pause the video, and we'll come back once we have everything +deployed. + +And we're back. I'm showing you right here that we do indeed have those Start Screen Manager +settings ("PPSSM Settings") installed on our machine. Once we close that out, we can go look at our +Start Screen. There we go. We have the "Important Apps" just like we directed. + +If I click on any of these, it takes me just exactly where it's supposed to. The "Calculator" works. +"Adobe Acrobat Reader DC" opens right up. If I go to the Edge tile, then we'll go to +"www.endpointpolicymanager.com." So they all are there and they all work. + +Now notice that there are still the original groups still there and the original pins. That is +because when we created the collection, we chose the PARTIAL (PRESERVE) option. That is why we +preserved what was already there. If we had gone FULL (REPLACE), then it would have knocked +everything out of here and it would have made it so that users could not change their Start Screen +anymore. One is a little looser; one is little more strict. It's up to you to decide which one you +want. + +One other thing before we go, I just want to point out if I want to try to drag a tile over here, I +can't. This is a "Locked group." Even though I can decide that I don't want the "Xbox" anymore to be +there, I can't change the group that you dictated using Endpoint Policy Manager. + +So there we are. If that's interesting for you, then let us know. We'll be happy to get you started +with a free trial right away. + +Look forward to seeing you in the next video. Thanks. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/mdmitemleveltargeting.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/mdmitemleveltargeting.md new file mode 100644 index 0000000000..5e023238c2 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/mdmitemleveltargeting.md @@ -0,0 +1,71 @@ +--- +title: "Endpoint Policy Manager Start Screen Manager: Manage Windows 10 Start Screen & Taskbar with your MDM (Advanced scenarios with ILT)" +description: "Endpoint Policy Manager Start Screen Manager: Manage Windows 10 Start Screen & Taskbar with your MDM (Advanced scenarios with ILT)" +sidebar_position: 30 +--- +# Endpoint Policy Manager Start Screen Manager: Manage Windows 10 Start Screen & Taskbar with your MDM (Advanced scenarios with ILT) + +Making an MDM policy to manage the Start Menu and Taskbar can be a NIGHTMARE. But not with Netwrix +Endpoint Policy Manager (formerly PolicyPak) Start Screen Manager. With us you can have ONE policy +which can be used again and again. See how it's done. + + + +### PolicyPak Start Screen Manager and MDM + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can use Endpoint Policy +Manager Start Screen Manager to manage your machines out in the field with your own MDM service. + +Let me set up the scenario here. You can pretend that this machine is my traveling sales guys. My +traveling sales guys always use "Mozilla Firefox" and they of course use "WinZip." We want to get +that on the Start Menu here.This is a different computer here. My traveling marketing guys are going +to use "Google Chrome" and "WinZip." So sales guys: "Mozilla Firefox" and "WinZip." Marketing guys: +"Google Chrome" and "WinZip." + +We want to get that over to our machines out in the field with our MDM service. How do we do that? +I've already create the policy just to make things go a little bit faster here, but let me show you +what I did. I created two collections: one for "Traveling Sales" and one for "Traveling Marketing." + +We just said that the "Traveling Sales" guys only use "Firefox," so this is going to hit them only +when we see that Firefox "exists." We're using item-level targeting and saying if Firefox exists, +then do these things. + +What are these things? Create a group called "Super Traveling Sales Apps" and WinZip ("winzip") and +Firefox ("FF") to it. For marketing, we know the marketing guys only use Chrome. So with that in +mind, we're saying look and see if "chrome" "exists." If it does exist, then create a group called +"Super Traveling Marketing Apps" and then deliver "Chrome" and "winzip" to the Start Menu. + +The next step would be for you to right click over the root node here and "Export Collections as +XML." We're going to go ahead and call this "PPSSM-MDM-Demo." I've exported all that, and we now +need to wrap it up into an MSI. Endpoint Policy Manager comes with a little utility to help you with +that the "Endpoint Policy Manager Exporter Tool." + +We're going to "Create a new MSI installer" for you here, "Add Existing Files" and that's the +"PPSSM-MDM-Demo" we just created ten seconds ago. We want to do this for the entire "Computer," +which will affect every user on that computer. We're just going to say everybody blanket is going to +get this and then autosense based on the conditions we just talked about: do they have Chrome or do +they have Firefox? + +We'll go ahead and click "Next" here, and we'll call this "PPSSM-MDM-DEMO.MSI." Now that we've done +that, we can click "Finish." Now it's time to go to our MDM service. I happen to have "AirWatch" up +here, but you could use InTune, MobileIron or some other MDM service. + +At this point, you would "Add Application," you would "Upload" that MSI. I'm going to pause the +video while I do this and by the time it's over we'll see a thing called "Packaged Endpoint Policy +Manager Settings" just like we have here. Then like I said, when I come back to the video we're +going to see the results on our endpoint after they download that from the MDM service. Go ahead and +hang tight. + +Okay, and we're back. The computers have gone out to the MDM service and downloaded that MSI which +contained that Start Menu layout XML that we've created, and here we go. We might as well start on +the traveling sales guys. On the traveling sales guys, you can see they have "WinZip" and "Mozilla +Firefox." I'll go ahead and click that there. On the traveling marketing guys, you can see that they +have their own unique Start Menu with "Google Chrome" and "WinZip." + +It's just that simple. You don't have to figure out one big policy that's going to affect absolutely +everybody. With Endpoint Policy Manager you can autosense and figure out what people should get what +groups based on what conditions, upload that and use your MDM service to deliver the Endpoint Policy +Manager Start Screen Manager settings. + +I hope that helps you out. Looking forward to getting started with you soon. +Take care. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/nondomainjoined.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/nondomainjoined.md new file mode 100644 index 0000000000..4db4b83398 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/nondomainjoined.md @@ -0,0 +1,71 @@ +--- +title: "Endpoint Policy ManagerStart Screen & Taskbar Manager: Manage non-domain joined machines using Endpoint Policy Manager Cloud" +description: "Endpoint Policy ManagerStart Screen & Taskbar Manager: Manage non-domain joined machines using Endpoint Policy Manager Cloud" +sidebar_position: 10 +--- +# Endpoint Policy ManagerStart Screen & Taskbar Manager: Manage non-domain joined machines using Endpoint Policy Manager Cloud + +Got non-domain joined machines? Use Netwrix Endpoint Policy Manager (formerly PolicyPak) Cloud to +deliver Endpoint Policy Manager Start Screen and Taskbar settings to them. Couldn't be easier. +Here's how. + + + +### PolicyPak Start Screen & Taskbar Manager: Manage non-domain joined machines using PolicyPak Cloud + +In a previous video, you saw me use Endpoint Policy Manager Start Screen and Taskbar Manager to +deliver a particular group to Windows 10 and also set the configuration of the Windows 10 Start +Screen. In this video, I'm going to show you how you can export those same settings and get them +deployed to your not domain joined machines using Endpoint Policy Manager Cloud. + +To start, we're going to go back to the Group Policy Object that we used earlier, and we're simply +going to do some exports. I will right click over the "Start Screen Manager" here and "Export +Collections as XML" or you can export simply one collection if you have that. I'll call this +"PPSSM-export1." Then for my Taskbar collection, I'm going to do the same. Right click (on "Taskbar +Manager") and "Export Collections as XML." I'll call it "PPTBM-export1." + +So these puppies are just hanging out now on the Desktop ready to go. What I'm going to do next is +go into Endpoint Policy Manager Cloud, and it's as easy as can be. You can go to a particular group +of computers or you can in Endpoint Policy Manager Cloud link these over to the "All" group. + +I'm going to "Upload and link a new XML here." I will "Browse" for my file that I just exported. +Here's my Start Screen Manager export. I'll call this "Endpoint Policy Manager Start Screen 1" and +add that guy. Again, because I'm linking it over to the "All" group, every computer will be affected +by this as we'll see in the demonstration. + +I will also "Upload and link a new XML here" for the Taskbar Manager right there: "Endpoint Policy +Manager Taskbar Manager 1." Now these two XML policies are linked to the "All" group. Let's go over +to our endpoint and see it work. + +You can see here's the before picture. I've got the multiple items that are just defaulted here in +this Windows 10 machine. This machine also has a bunch of applications preinstalled on it as your +computers might. Just to prove a point, this computer is not domain joined. It's in a "Workgroup" +that I have called "NOT DOMAIN JOIN." + +What I'm going to do now is install the "Endpoint Policy Manager Cloud Client." This has to be +installed as an admin one time, and then after that we keep on rolling. So you'll see me install it +one time here. In the background, it's making contact to Endpoint Policy Manager Cloud, downloading +the client-side extension and then also performing the work for the Endpoint Policy Manager Start +Screen. Now that that's finished, you can see this computer is a member of the "All" group. We'll +just give this a second to catch up. There we go. We can see we have an icon there. + +Exactly what we saw in Group Policy land should occur here in not domain joined land where if we go +to the Start Menu, we get "My Important Apps." We have this in what's called Full/Replace mode. +We've wiped out on purpose the other groups that are there. If you wanted to preserve those, that's +possible too. + +The Taskbar Manager only kicks in the next time you log off and log back on, so let me go ahead and +"Sign out." Then we'll just give it a second, and we'll go ahead and sign back in here. Let's go +ahead and sign in as the "StandardUser" here, and let's see what happens. + +We're looking for results on the Windows 10 Start Screen and also on the Taskbar. Let's see if +that's what we get. You can see the Taskbar instantly. We've replaced what we have there, and on the +Start Menu you can see "My Important Apps." + +You can either launch an application from here right off the Start Menu and also right here off the +Taskbar if that's also something you wanted to do. Just like that, you've configured this not domain +joined machine to accept your directives with Endpoint Policy Manager Cloud. + +With that in mind, you can join us for a webinar to get started right away and try this out +yourself. +Thanks so very much. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/pdqdeploy.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/pdqdeploy.md new file mode 100644 index 0000000000..5a59263e52 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/methods/pdqdeploy.md @@ -0,0 +1,279 @@ +--- +title: "Taking Control of Your Taskbar and Start Menu with Endpoint Policy Manager and PDQ Deploy" +description: "Taking Control of Your Taskbar and Start Menu with Endpoint Policy Manager and PDQ Deploy" +sidebar_position: 50 +--- +# Taking Control of Your Taskbar and Start Menu with Endpoint Policy Manager and PDQ Deploy + +When you use PDQ Deploy to get your apps "out there", then how can you automatically and nicely +manage both the Windows 10 Start Screen and Taskbar? Easy, when you add Netwrix Endpoint Policy +Manager (formerly PolicyPak). +In this video, Kris from PDQ and Jeremy Moskowitz, former Group Policy MVP from Endpoint Policy +Manager Software show you how to get it "out there" and nicely manage that Windows 10 Start Screen +and Taskbar. + + + +### Taking Control of Your Taskbar and Start Menu with PolicyPak and PDQ Deploy + +Kris: I'm Kris from PDQ.com. + +Jeremy: And I'm Jeremy Moskowitz from Endpoint Policy Manager Software. + +Kris: We're going to show you how to take control of your Start Menu and your Taskbar utilizing +Deploy… + +Jeremy: …and Endpoint Policy Manager. + +Kris: Awesome. + +Jeremy: Let's take a look at what Windows gives you as a Start Menu. Let me ask you a question. In +support land, do you get a lot of people who like this or not many people who like this? + +Kris: "Oh, I like this!" says no one ever. + +Jeremy: Says no one ever, right. Wouldn't it be amazing if you could deploy the right software that +you wanted and then customize the Start Screen based upon what the user's experience needs to be? +Wouldn't that be amazing? So let's do that. + +I'm going to have you, if you wouldn't mind, use PDQ Deploy. Let's go ahead and get Acrobat, VLC, +Firefox and Chrome deployed. So four packages. + +Kris: Let's do that. In fact, with Deploy you can actually deploy multiple packages at the same time +to 1, 10, 100, however many computers you want to do this to. + +Jeremy: That's good. So this will be "win10computer2." + +Kris: Let's do this. + +Jeremy: All right, great. + +Kris: It's going to start with those, and it should be pretty quick. We'll have these installed, +we'll have them configured, we'll have users that have all these icons wherever they want them. + +Jeremy: That's the thing. Even when this is done – and you know this, but for the sake of our +audience – what's going to happen is that nothing magical is going to show up here (in the Start +Menu). It will be in the alphabetical list. That's fine. But that doesn't really help most of your +users. You have a nurse who wants to log on and get to their Brain Scan 12 app. You want to get it +right there, right in a group. + +Kris: In their face. + +Jeremy: Right in their face. Or all the Office stuff or all the browsers. Whatever is important to +them. You don't want to waste time having users try to figure it out. So after it's deployed, the +next thing we're going to do is make sure we can get it cleaned up for the user and ready to rock. + +Let's go ahead and let's take a look. If you don't mind, I'm going to go to "Control Panel" and see +here. We are in our Deploy. + +Kris: We're doing the trust but verify thing right here. + +Jeremy: Trust but verify. Let's go to "Uninstall a program" and let's see what's going on. All +right, nothing yet, but I expect it to show up pretty soon. + +While we're waiting for that to kick in, let me go over to my management station. On my management +station computer, I actually have the same applications ready to go just to make things go a little +bit faster. + +In order to create the policy, I'm going to go to my "WEB Engineers." I'm going to call them "Start +Screen for Engineers." You might have different Start Screens for your HR or whoever. The best part +is they can have the same applications but different categories and groups. + +Kris: Perfect. We love organizing stuff. I know I do. + +Jeremy: All right, so we'll go ahead and click on "Start Screen for Engineers" here. We can do this +on either the user side or the computer side. I'm going to do this on the user side, but you could +have it on the computer side if you wanted. + +User side, "Endpoint Policy Manager." We'll go ahead and dive down under the "Start Screen Manager +for Windows 10." We'll do Start Screen first, and we'll do Taskbar second. We're going to "Add" a +"New Collection." The collection is going to be how we're going to define this. + +Do you like the idea where we're going to leave everything that Microsoft has and then let users add +their own things plus our things, or should we just nuke everything off the map? + +Kris: I like nuking everything. I want control. + +Jeremy: All right, nuke everything off the map. But if you wanted to do it yourself, you could leave +what the user or Microsoft has in place and then let people have it. We're going to say "FULL +(REPLACE)" and that's the end of it right there. We'll give you one last shot because we're about to +go nuke it. + +Kris: We're doing it. + +Jeremy: We're really going to do this thing. So that's how we're establishing that. Then I'm going +to right click and "Add" a "New Group." I'll create two groups. The first group I'll add I'll call +"Biz Apps." Then I'll "Add" a "New Group" called "Browsers" because we deployed four things. + +Kris: Does the "Group Name" mean anything? Is it arbitrary, or is it actually going to show up? + +JeUremy: This is the name of the group they're going to get. + +Kris: Okay, awesome. + +Jeremy: We're going to click on "Biz Apps." Inside there, like I said, my machine has these. So I'm +going to point to my machine and "Add" a "New Desktop Application Tile." I'm going to go ahead and +pick the Acrobat Reader on my machine which is the same on their machine. Then I'll go ahead and +click right here. + +Kris: It's going to pull those. + +Jeremy: Yes, it's pulling all those, and we have a lot on this particular machine. There's "Adobe +Acrobat Reader DC." It's the first one. We'll pick this "Medium" tile here. This is just the "Policy +Name." We'll call it "acro reader." They don't see this part. + +Then the second thing we'll do, "Add" another "New Desktop Application Tile" for VLC Media Player, +which I also happen to have on this machine. We'll go ahead. It's probably at the bottom, so I'll +type "vlc." There we go. + +Kris: That is really handy right there. + +Jeremy: Yep. Click on this guy. While we're here, why don't I put on one of those big Windows apps +like Calculator or Weather or something like that? + +Kris: Oh, yeah, gigantic. + +Jeremy: Gigantic, yeah, exactly. That's "Add" a "New Universal (UWP) Application Tile." We're going +to pull what's on this machine as well. We'll go ahead and click "Next." It takes a second to +populate what's coming here. I'll pick on "Calculator." The thing about the big applications is that +you can pick a big tile. So I'm going to go ahead and pick one of these big old "Large" tiles right +there. I'll call this "big ol calc." + +Kris: That's right. I'm going to take up all the space. + +Jeremy: Yes. All right, great. For browsers this is simple too. We just right click and "Add" a "New +Desktop Application Tile." I said Firefox and Chrome. I'll pick this guy. I think it's under M for +Mozilla, but I can't quite remember. Oh, "Firefox," and pick the "Medium" tile. Should we make the +Chrome tile really small? + +Kris: Let's do it. + +Jeremy: All right. + +Kris: Make them work to find Chrome. + +Jeremy: Then we'll go ahead and take this guy too and pick this guy and pick "Google Chrome" as our +second guy. + +Kris: This looks like a really straightforward and easy process. + +Jeremy: We try to make it as hard as possible to get you toward your goal. Okay, so "chrome." We +didn't really talk about it, but I'm sure people saw. You can change not only the size but also the +spacing of where the icons are. + +Kris: Oh, wonderful. + +Jeremy: We also have a little thing that will best fit it for you if that's something you want to do +as well. That's it. We've created it. Let's go back to your machine. It's all done. Let's go check +it out. We'll go back. I'll hit F5 to refresh, and you are correct, sir. + +Now let's do this in real time. Let's set the stage again. You deployed all of your applications +using PDQ. You have predefined or later put on your Endpoint Policy Manager policy settings for your +Start Menu. Here we go. Here's the Start Menu. Let's go back over. We're going to run a handy dandy +GP Update. + +Kris: I'm assuming magic is at work here, like you give a little bit of an incantation. + +Jeremy: Hopefully not. That's the whole point. Hopefully no incantation needed. We're just going to +run "gpupdate /force," get the latest, greatest policy settings. If all goes well, in real time, +we're going to nuke the Start Menu and put just the two groups that we declared on and only those +guys. + +Kris: This is one of those amazing things. Oh, my goodness. There it is. + +Jeremy: Oh, "Missing Application." What's missing. Well, that's actually a feature, so we might as +well see what's missing: "firefox." + +Kris: You know what? + +Jeremy: What's that? + +Kris: I just realized my folly. I saw Mozilla and stopped reading on our PDQ Deploy. + +Jeremy: Well, this is great. I'm super happy about this. This is perfect. This is a feature that you +can only do in Endpoint Policy Manager land. We told you that we wanted to do Firefox, and this is +great. You made a mistake, but you had it on the Start Menu. + +Now let's just do this in real time. Go ahead and use PDQ, deploy Firefox, and then we'll run GP +Update and see the magic happen. + +Kris: Let's do it. + +Jeremy: You might have to log off and log back on, but let's see what happens. + +Kris: Let's see what happens. I think I grabbed Thunderbird rather than Firefox. Let's go grab that +real quick. It's a small download. + +Jeremy: Great. I love it. + +Kris: Let's go find it. I see "Thunderbird." Let's do Firefox. This should be a quick one. It looks +like we're on "Version" "59." I've done that. It is there. + +Jeremy: Okay, and get it over to that machine, right? + +Kris: Yep. That was "win10computer2." Let's do it. + +Jeremy: While we're getting there, why don't we talk about the Taskbar. Wouldn't it be interesting +to put some of your important applications also in the Taskbar to guarantee that they're right there +in the face of users? + +Kris: Yes, please. + +Jeremy: Okay, yes, please. Let's go ahead and put Chrome and Calc. + +Kris: Okay. + +Jeremy: Okay, great. Let's go back over to our GPMC machine. We're going to put it in the same GPO. +That's totally fine. We're looking for the "Taskbar Manager for Windows 10." Right click. Again, we +try to make it as hard as possible. We "Add Collection." Wait. I think last time we nuked. Why don't +this time we just let people add stuff. + +Kris: Okay. + +Jeremy: So we'll leave what's in place and we'll merge, so we'll leave "Merge" in place. "Merge" +says go ahead and leave what the user has in place and put your own stuff. + +Now we're going to go ahead and "Add" a "New Universal (UWP) Application," which we'll be Calc +first. Why not? Although it doesn't look big there, I suppose. I'll go ahead and pick "Calculator." +Then we'll say "calc on taskbar." + +Then the second thing we'll do is Chrome. So "Add" a "New Desktop Application." That's a "Registered +application." Then we'll go ahead and pick "Google Chrome" and click "Next" and type "chrome." There +we go. + +Now for this policy setting to kick in, we're going to do another GP Update ("gpupdate /force"). But +this puppy only kicks in when you log off and log back on. So you won't see any change immediately, +but you will the very next time you log on. + +Now I'm sure Firefox is done, but let's go to the Start Menu and double-check. Oh, there it is. See +that? + +Kris: Oh, my goodness! + +Jeremy: Hey, come on! + +Kris: That's amazing. + +Jeremy: That's the whole point, right? Now let's go through that again. We deployed some stuff using +PDQ, but we made a small mistake. No problem. Endpoint Policy Manager told us as the end user to +tell you, the admin, about the mistake. You then fixed the mistake with PDQ Deploy, and your Start +Menu is all rectified. That was pretty awesome. + +Kris: That was pretty awesome. + +Jeremy: Now what we'll do is we'll go ahead and log off. We're going to go ahead and "Sign out" just +to see the Taskbar for the very last mile here. We'll find "WIN10COMPUTER2." We'll go ahead and +double click and log back on. Here we are. Go ahead and watch the Taskbar. There we go. It's merging +and adds in both Calculator and Chrome just like that. + +Kris: That's wonderful. That takes a very complex process for the Taskbar and makes it really easy. + +Jeremy: Yep. + +Kris: That is fantastic. + +Jeremy: Well, thanks for having me on the video. + +Kris: Yeah. Thanks for watching. + +Jeremy: Thanks, guys. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/_category_.json b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/_category_.json new file mode 100644 index 0000000000..d0c808bf1b --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Troubleshooting", + "position": 20, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/customicons.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/customicons.md new file mode 100644 index 0000000000..1bad479d15 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/customicons.md @@ -0,0 +1,99 @@ +--- +title: "Endpoint Policy Manager Start Screen Manager and Special Custom Icons" +description: "Endpoint Policy Manager Start Screen Manager and Special Custom Icons" +sidebar_position: 10 +--- +# Endpoint Policy Manager Start Screen Manager and Special Custom Icons + +Tried to deploy custom icons and it didn't work as expected? Here's the workaround. +ADDITIONAL STEP: Remove the Chrome Shortcut from the following location: You'll need to sign-out and +back in twice to see the changes the first time. + +`C:\ProgramData\Microsoft\Windows\Start Menu\Programs` + + + +### Endpoint Policy Manager Start Screen Manager and Special Custom Icons + +Hi. This is Jeremy Moskowitz. In this video, I'm going to show you how you can use Netwrix Endpoint +Policy Manager (formerly PolicyPak) Start Screen Manager to dictate icons with the correct +iconography on the Start Menu. + +Here's the example lash-up. I used Endpoint Policy Manager Start Screen Manager to create a group +for my G Suite resources for my sales team. But, look. They all have exactly the same icon, which is +weird because when I went to create this, I created what's called a "New Desktop Application Tile." +I went to "Custom application" which is where you can give it the items you want. So here's +"chrome," the application. + +Then you can see there's the shortcut icon. In fact, let me put this toward a website like +"udel.edu," my university. If you were to "Change Icon" here to something like this guy, you would +think that should just work perfectly, right? I'll go ahead and click "Next" and click "Medium" or +whatever. I'll call this "Access Udel.edu." + +Then over in Firefox land, I'm actually going to do the same thing. I've already got one for +"Mozilla" by itself. Let me go ahead and add a "New Desktop Application Tile" for my "Custom +application." I'll pick "c:Program FilesMozilla Firefox," and here's "firefox." I'm going to pick +this, and I'll say go to "abc.com" or something like that. And I'll "Change Icon" to this sketchy +little guy, whatever that is. "OK." + +Again, you can change the shortcut icon. It doesn't have to be from this application. But here's the +thing. In both of these cases, it's not going to work. I'm showing you what's not going to work +first. I'm going to say "www.abc.com from FF." + +If I go back over here and I run GP Update ("gpupdate"), let me show you what is not happening. The +first thing that we should see after GP Update is done is that we'll have created that new group +called "Firefox Items." And then after that, we're going to see that the icons will be exactly the +same even though I said I wanted different icons. + +Okay, so we'll go ahead and click over here, and there we go. We can see I've got my G Suite items +that are all the same even though I said those have different icons, and the Firefox items are +exactly the same even though I said those should have different icons. What is going on? + +Well, it turns out that these applications are a little bit funny. Of course, they're both related +in this way, but they each share the characteristic that I found interesting. I'm going to create an +admin command prompt. Both of these applications, like if I go to "Program Files (x86)GoogleChrome" +and I look in the application folder, there's this folder called application name dot +"VisualElementsManifest.xml." + +Firefox has one too. The idea is that it tells its DNA what to look like. What we're going to do is +remove this part of the DNA and it will look a little bit different. Let me go ahead and get another +command prompt just to show you here. If I were to go to "cd Program Files (x86)Mozilla Firefox" and +look for the "xml," there it is: "firefox.VisualElementsManifest.xml." + +What we want to do is nuke these using Group Policy Preferences file delete. I'm going to show you +how to do that right now. Actually, I'm going to be logged off first because if we're logged on, it +doesn't help us much here. So I'm going to "Sign out." + +Then in the same GPO or a different GPO, I'm going to use the Group Policy "Preferences" and I'm +going to go to the "Files" item. I'm going to use the Files item to create a "New" "File" item. In +fact, I'm going to create two of them that are going to "Delete" a specific file. Then the little +magic here is that in this little white box you're going to hit the F3 key and you're going to be +able to find "ProgramFilesDir." The we're going to go to "GoogleChromeapplication." + +Actually, maybe this is even easier. If I go to c:Program Files (x86)GoogleChromeApplication," I +happen to have that application on my machine here. There we go: "chrome.VisualElementsManifest." I +want to nuke this guy right off the map. I could do it either by variable or direct, so I might as +well just do it direct. So I'm nuking that file. + +Okay, next one would be for Firefox. Let me go ahead and create a "New" "File" item here. Click on +"Delete." Then I want to find "Program Files (x86)/Mozilla Firefox," and I want to find the Firefox +visual element. I don't see it listed here, but I know it's on the target machine. So I'll just type +it in. That's going to be "firefox.VisualElementsManifest.xml." I know it's there: "C:Program Files +(x86)Mozilla Firefoxfirefox.VisualElementsManifest.xml." + +All right, that's all she wrote. So in this GPO, I now have the delete items and I have the create +the "Start Screen Manager" items. This might work right away or it might take two logons because it +might have to be deleted before the Start Screen is generated. So if this takes two logons, so be +it. But the point is that this is how to do it. So if it doesn't work the first time, we'll log off +and log back on and we'll see it run the second time. + +We have all the right resources for our sales team, and we have all the right resources for our +Firefox things, the special icons, exactly what we want. So again, it's the 1-2 combination. You +have to use the custom tile type in Endpoint Policy Manager Start Screen Manager. Then you have to +nuke those VisualElementsManifest.xmls related to programs that have it. + +So we're doing what we need to do, but there's a little trick for some of these applications that +requires you to also nuke those things. Hope this video helps you out and gets you started with +doing custom icons. + +Thanks so very much. Talk to you soon. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/revertstartmenu.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/revertstartmenu.md new file mode 100644 index 0000000000..a3125baa02 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/troubleshooting/revertstartmenu.md @@ -0,0 +1,116 @@ +--- +title: "Using PP SCRIPTS to Revert Start Menu" +description: "Using PP SCRIPTS to Revert Start Menu" +sidebar_position: 20 +--- +# Using PP SCRIPTS to Revert Start Menu + +If your Start Menu is a little unhappy, use these scripts to make it right. + + + +### Using PP SCRIPTS to Revert Start Menu + +Hi. This is Jeremy Moskowitz, Founder and CTO of PolicyPak. In this video, I'm going to show you how +you can get out of Start Screen madness. If your Start Screen has gone a little crazy, I'm going to +show you how you can get out of it and give something back to your users. There's a variety pack of +choices. In all circumstances, we're going to be using PolicyPak Scripts to get it back to normal. + +What I've done here is sort of set the stage for an irregular looking Start Screen. Your Start +Screen may look even more irregular or less, but whatever. The point is that I'm going to show you +how you can get to a specific back to normal kind of screen. + +How are you going to do this? We use PP Scripts. When you download the "PolicyPak Guidance" from the +portal, the guidance has a bunch of preconfigured XML that will help you for various situations. In +the "PolicyPak Script Manager Example Scripts," we've got "XMLs and not XMLs"). What you're going +for are the "XMLs." + +We actually have some preconfigured scripts to help you get out of some jams here. I want to go +through them and show you how they all work. Actually, they're all pretty simple to use. The first +one we want to do is "PP-SCRIPTS-USER-SIDE-RESTORE-START-SCREEN." This is going to get you to the +default of what Microsoft would be laying down new as if you were doing it today. + +Let's pretend your "East Sales Users" are flipped out. What are you going to do? You're going to +"Create a GPO in this domain, and link it here" called "PP Scripts Start Screen Helper." Then we'll +"Edit" this GPO here. We're going to be doing this on the user side. So we'll do this on the user +side, "PolicyPak" and go to Scripts Manager." + +All you're going to do is take the script that we're talking about here. We're going to do this one +first. Just drag it in there. If drag-and-drop doesn't want to work for you for some reason, just +right click and "Import from XML." + +Let's go ahead and briefly take a look at what this is going to do before we actually run it. It's +going to do a one-line "PowerShell script," which is delete our registry key and then stop Explorer. +That's all it's going to do. This script is going to be "Run as User," and we're doing it on the +user side. We also have this script running exactly "Once." You don't want to keep this running over +and over again. That would be kind of weird. We're just going to do it "Once." + +Let's go ahead and see the result of when we do this. What we're going to do is take a look at our +Start Menu right now. It's unusual on purpose. Now if we were to go to run GP Update ("gpupdate") to +get the latest policy settings, what you're going to see is PolicyPak Scripts doing its thing. That +little flash is us killing Explorer because that's part of the script, and we just deleted that +registry entry. + +When you do that, here's what the result is. You then get Microsoft's items back here. See what it +did? It just found the items that you had and didn't have. This would be what a standard screen +would look like right out of the gate new sitting today. So that's one way. + +Let me go ahead and mess it up again just so we can get a feel for another messed up screen. There +we go. So that's script number one. Script number two is actually pretty similar except it actually +deletes a little bit more content. So if that first script doesn't want to work, you can use this +second script as well ("option2b"). + +This is going to also perform a "REVERT" here. So it's a little bit bigger. It has some more steps +in it. But the basic gist is that it's going to only do it "Once." It's going to do it on the user +side, but this time this script is going to run as the System. So it's doing a little bit more +stuff, and you're welcome to paw through it. + +By the time this is done, let's go ahead and see the result of this second script here. We're going +to see another flash. That's us killing Explorer, and that will have laid down the newly rectified +Start Menu. Let's go ahead and see what we got out of that. Basically, the same results. We want you +to do it in this order. If for some reason the first one doesn't work, then go ahead and do the +second one. + +Now let's talk about the third one, which is actually my favorite one. The third one enables you to +lay down a very specific start layout. Now how do you get a specific start layout? Well, you can +either use the one that I put together, or you can make your own. If you have a very specific start +layout that you want and you love this start layout, that's totally fine. + +You can go to "powershell" and then you can do "Export-StartLayout." Then you can call it "out1.xml" +or something like that. Then if you take a look at "notepad .\out1.xml," what you're going to see +here is basically the Start Menu all laid out nicely in XML. That's cool. Keep that in your mind for +a quick second. + +What you're then going to do is take this final script that I want to show you here which is +"PP-SCRIPTS-User-side-FORCE-specific-Start-Layout." If you take a look at the actual "Apply action," +what you'll see here is right here is the my start layout, the one that I put together. You've got +to keep going, and there it ends. This is the one that I put together for you. + +Now if you want to use yours and substitute it for that, that's great. You can totally do that. +That's the point of this script. You can substitute your start layout instead of mine, and you can +get whichever one you want. If you do nothing and you just drag mine in, that's great. It will look +pretty good. But making you want yours based upon something you're already doing. + +You can see this script is going to drive in this particular layout. This script is on the user +side, but the script is being run as admin. So the script is not being run as user. And we're only +going to do it "Once." We don't want to do it "Always." We just want to do it one time. So we'll go +ahead and click "Save" here, and then we'll see what happens next. + +Let me show you the before picture. And now here is the after picture. We'll run GP Update +("gpupdate"). PolicyPak Scripts will do that magic here. Let's go ahead and see what happens. That +flash says we drove it in. + +Now it should lay it down the way you expect, and if it doesn't, a simple log off and log on should +show you the final result. Let's see what we've got here. You can see actually the Start Menu became +inactive. Now again, I've seen that, but I've also seen it work perfectly. + +Let me go ahead and "Sign out" here, and let me log back on. Now that we're logged back on, there's +the Start Menu, the one that I put together. It's all laid out and ready to go. At this point, +everything is movable. You can do whatever you want, change it around. You're all set and ready to +rock. + +I hope that these three scripts will help get you out of any jam that you could be in. With that in +mind, if you have any questions, please ask on the forums in the Start Screen and Taskbar Manager +forum. + +Thank you very much, and talk to you soon. diff --git a/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/videolearningcenter.md b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/videolearningcenter.md new file mode 100644 index 0000000000..73bc4d5769 --- /dev/null +++ b/docs/endpointpolicymanager/start-screen-and-taskbar-manager/video-learning-center/videolearningcenter.md @@ -0,0 +1,34 @@ +--- +title: "Video Learning Center" +description: "Video Learning Center" +sidebar_position: 20 +--- + +# Video Learning Center + +See the following Video topics for Start Screen and Task Bar Manager. + +## Getting Started + +- [Endpoint Policy Manager Start Screen and Taskbar Manager Helper Utility](./video-learning-center/gettingstarted/helperutility.md) +- [Endpoint Policy Manager Start Screen Manager: Own the Win10 Start Menu](./video-learning-center/gettingstarted/windows10startmenu.md) +- [Endpoint Policy Taskbar Manager: Quick Demo](./video-learning-center/gettingstarted/demotaskbar.md) +- [Endpoint Policy Manager Start Screen Manager: Using Item Level Targeting](./video-learning-center/gettingstarted/itemleveltargeting.md) +- [Endpoint Policy Manager Start Screen Manager: Add IE links](./video-learning-center/gettingstarted/linksie.md) + +## Troubleshooting + +- [Endpoint Policy Manager Start Screen Manager and Special Custom Icons](./video-learning-center/troubleshooting/customicons.md) +- [Using PP SCRIPTS to Revert Start Menu](./video-learning-center/troubleshooting/revertstartmenu.md) + +## Methods: SCCM, XML, MDM, Cloud, PDQ, Citrix, etc. + +- [Endpoint Policy ManagerStart Screen & Taskbar Manager: Manage non-domain joined machines using Endpoint Policy Manager Cloud](./video-learning-center/methods/nondomainjoined.md) +- [Endpoint Policy Manager Start Screen & Taskbar Manager: Manage Windows 10 Start Screen & Taskbar with your MDM service (Basics with MDM)](./video-learning-center/methods/mdm.md) +- [Endpoint Policy Manager Start Screen Manager: Manage Windows 10 Start Screen & Taskbar with your MDM (Advanced scenarios with ILT)](./video-learning-center/methods/mdmitemleveltargeting.md) +- [PP Start Screen and Taskbar manager with Citrix XenApp and XenDesktop](./video-learning-center/methods/citrix.md) +- [Taking Control of Your Taskbar and Start Menu with Endpoint Policy Manager and PDQ Deploy](./video-learning-center/methods/pdqdeploy.md) + +## Extras + +- [Endpoint Policy ManagerStart Screen and Endpoint Policy Manager Scripts: Specify exact Start Menu experience one time](./video-learning-center/extras/onetime.md)