Cumulative update for Windows 10 Version 1511: October 11, 2016

Summary

This security update includes improvements and fixes in the functionality of Windows 10 Version 1511. It also resolves the following vulnerabilities in Windows:

3193229 MS16-125: Security update for diagnostics hub: October 11, 2016

3193227 MS16-124: Security update for Windows registry: October 11, 2016

3192892 MS16-123: Security update for kernel-mode drivers: October 11, 2016

3195360 MS16-122: Security update for Microsoft video control: October 11, 2016

3192884 MS16-120: Security update for Microsoft graphics component: October 11, 2016

3192890 MS16-119: Cumulative security update for Microsoft Edge: October 11, 2016

3192887 MS16-118: Cumulative security update for Internet Explorer: October 11, 2016

3178465 MS16-101: Security update for Windows authentication methods: August 9, 2016

Windows 10 updates are cumulative. Therefore, this package contains all previously released fixes.

If you have installed previous updates, only the new fixes that are contained in this package will be downloaded and installed to your computer. If you are installing a Windows 10 update package for the first time, the package for the x86 version is 525 MB and the package for the x64 version is 989 MB.

Known issues in this security update

Issue 1

After you install this security update, System Center Operations Manager (SCOM) Management Console crashes in State view.

To resolve this issue, install the following update:

3200068 Cumulative Update for Windows 10 Version 1511: October 18, 2016

Issue 2

After you install this security update, some DFS-N mapped network drives may be inaccessible to members of the Administrators group when UAC and EnableLinkedConnections are enabled. This occurs when the process that is attempting to access the mapped network drive, is running in a different elevation status than the process that created the mapped network drive. For example, an Explorer window, that is an unelevated process, is unable to access a mapped drive created by a logon script, that runs in an elevated context.

To resolve this issue, install the update KB4013198.

How to get this update

Method 1: Windows Update

This update will be downloaded and installed automatically.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Prerequisites

There are no prerequisites for installing this update.

Restart information

You must restart the computer after you apply this update.

Update replacement information

This update replaces the previously released updates 3185614 and 3193517.

File Information

For a list of the files that are provided in this cumulative update, download the file information for cumulative update 3192441.

More Information

This package updates the Connected User Experiences and Telemetry service to provide benefit for enterprises by using Upgrade Analytics to plan and manage the Windows upgrade process. This update includes the following:

Support to enable upload of telemetry and download of settings in an authenticated proxy environment

Support to configure a specific proxy to upload telemetry and download settings

Support for Azure Active Directory (AAD) tenant identity

The Connected User Experiences and Telemetry service collects usage and diagnostics information from Windows. You can learn more about configuring Windows telemetry in your organization here.

This update also resolves known issues that are caused by security update 3170005. For more information about the known issues, see the
Oct 2016 Update: Mitigation for known issues section in KB 3170005.

Additionally, this update uses SSL (TCP Port 443) to download manifests and upload telemetry to Microsoft that uses the following DNS endpoints:

This update contains the following two manifests that are used by the service.

Registry information

ImportantFollow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

By default on Windows 10, support for sending usage and diagnostics information through an authenticated proxy is disabled. When the setting isn’t disabled (0x0) through the following registry subkey, the Connected User Experiences and Telemetry service will impersonate a logged on user to authenticate with the proxy to send the information. If you are using Upgrade Analytics in a network environment that uses an authenticated proxy, we recommends configuring this setting to 0x0.

Locate and then select the registry subkey HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection

On the Edit menu, point to New, and then click DWORD Value.

Type DisableEnterpriseAuthProxy, and then press the Enter key.

In the Details pane, right-click DisableEnterpriseAuthProxy, and then click Modify.

In the Value data box, type 0 (not disabled) or 1 (disabled), and then click OK.

You can also configure Connected User Experiences and Telemetry to forward usage and diagnostics information to a specific proxy server by using the following registry path. You can specify the FQDN or IP address of the proxy server and optionally a port number.

Locate and then select the registry subkey HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection

On the Edit menu, point to New, and then click String Value.

Type TelemetryProxy, and then press the Enter key.

In the Details pane, right-click TelemetryProxy, and then click Modify.

In the Value data box, type server:port, and then click OK.

References

Learn about the terminology that Microsoft uses to describe software updates.

What’s new in Windows 10, versions 1507 and 1511 for IT Pros

Below is a list of some of the new and updated features included in the initial release of Windows 10 (version 1507) and the Windows 10 update to version 1511.

For release dates and servicing options for each version, see Windows 10 release information.

Deployment

Provisioning devices using Windows Imaging and Configuration Designer (ICD)

With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows Provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management (through a wizard-driven user interface) and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.

Security

AppLocker

New AppLocker features in WindowsВ 10, version 1507

• A new parameter was added to the New-AppLockerPolicy Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the ServiceEnforcement to Enabled.
• A new AppLocker configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
• You can manage WindowsВ 10 Mobile devices by using the new AppLocker CSP.

BitLocker

New BitLocker features in Windows 10, version 1511

• XTS-AES encryption algorithm. BitLocker now supports the XTS-AES encryption algorithm. XTS-AES provides additional protection from a class of attacks on encryption that rely on manipulating cipher text to cause predictable changes in plain text. BitLocker supports both 128-bit and 256-bit XTS-AES keys. It provides the following benefits:
  • The algorithm is FIPS-compliant.
  • Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization.

Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.

New BitLocker features in WindowsВ 10, version 1507

• Encrypt and recover your device with Azure Active Directory. In addition to using a Microsoft Account, automatic Device Encryption can now encrypt your devices that are joined to an Azure Active Directory domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Azure Active Directory. This will make it easier to recover your BitLocker key online.
• DMA port protection. You can use the DataProtection/AllowDirectMemoryAccess MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on.
• New Group Policy for configuring pre-boot recovery. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more info, see the Configure pre-boot recovery message and URL section in «BitLocker Group Policy settings.»

Credential Guard

New Credential Guard features in Windows 10, version 1511

• Credential Manager support. Credentials that are stored with Credential Manager, including domain credentials, are protected with Credential Guard with the following considerations:
  • Credentials that are saved by the Remote Desktop Protocol cannot be used. Employees in your organization can manually store credentials in Credential Manager as generic credentials.
  • Applications that extract derived domain credentials using undocumented APIs from Credential Manager will no longer be able to use those saved derived credentials.
  • You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won’t be able to restore those credentials.
• Enable Credential Guard without UEFI lock. You can enable Credential Guard by using the registry. This allows you to disable Credential Guard remotely. However, we recommend that Credential Guard is enabled with UEFI lock. You can configure this by using Group Policy.
• CredSSP/TsPkg credential delegation. CredSSP/TsPkg cannot delegate default credentials when Credential Guard is enabled.

Easier certificate management

For WindowsВ 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You’ll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the Certificates app to review the details of certificates on your device. Learn how to install digital certificates on Windows 10 Mobile.

Microsoft Passport

In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN.

Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports Fast ID Online (FIDO) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user’s device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services.

Security auditing

New Security auditing features in Windows 10, version 1511

• The WindowsSecurityAuditing and Reporting configuration service providers allow you to add security audit policies to mobile devices.

New features in WindowsВ 10, version 1507

In WindowsВ 10, security auditing has added some improvements:

New audit subcategories

In WindowsВ 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events:

• Audit Group Membership Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user’s logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event.
• Audit PNP Activity Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. A PnP audit event can be used to track down changes in system hardware and will be logged on the PC where the change took place. A list of hardware vendor IDs are included in the event.

More info added to existing audit events

With WindowsВ 10, version 1507, we’ve added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events:

Changed the kernel default audit policy

In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In WindowsВ 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts.

Added a default process SACL to LSASS.exe

In WindowsВ 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L»S:(AU;SAFA;0x0010;;;WD)». You can enable this under Advanced Audit Policy Configuration\Object Access\Audit Kernel Object. This can help identify attacks that steal credentials from the memory of a process.

New fields in the logon event

The logon event ID 4624 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4624:

1. MachineLogon String: yes or no If the account that logged into the PC is a computer account, this field will be yes. Otherwise, the field is no.
2. ElevatedToken String: yes or no If the account that logged into the PC is an administrative logon, this field will be yes. Otherwise, the field is no. Additionally, if this is part of a split token, the linked login ID (LSAP_LOGON_SESSION) will also be shown.
3. TargetOutboundUserName String TargetOutboundUserDomain String The username and domain of the identity that was created by the LogonUser method for outbound traffic.
4. VirtualAccount String: yes or no If the account that logged into the PC is a virtual account, this field will be yes. Otherwise, the field is no.
5. GroupMembership String A list of all of the groups in the user’s token.
6. RestrictedAdminMode String: yes or no If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes. For more information about restricted admin mode, see Restricted Admin mode for RDP.

New fields in the process creation event

The logon event ID 4688 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4688:

1. TargetUserSid String The SID of the target principal.
2. TargetUserName String The account name of the target user.
3. TargetDomainName String The domain of the target user..
4. TargetLogonId String The logon ID of the target user.
5. ParentProcessName String The name of the creator process.
6. ParentProcessId String A pointer to the actual parent process if it’s different from the creator process.

New Security Account Manager events

In WindowsВ 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited:

• SamrEnumerateGroupsInDomain
• SamrEnumerateUsersInDomain
• SamrEnumerateAliasesInDomain
• SamrGetAliasMembership
• SamrLookupNamesInDomain
• SamrLookupIdsInDomain
• SamrQueryInformationUser
• SamrQueryInformationGroup
• SamrQueryInformationUserAlias
• SamrGetMembersInGroup
• SamrGetMembersInAlias
• SamrGetUserDomainPasswordInformation

New BCD events

Event ID 4826 has been added to track the following changes to the Boot Configuration Database (BCD):

• DEP/NEX settings
• Test signing
• PCAT SB simulation
• Debug
• Boot debug
• Integrity Services
• Disable Winload debugging menu

New PNP events

Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn’t expect this type of action, such as a domain controller.

Trusted Platform Module

New TPM features in WindowsВ 10, version 1511

• Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC).

New TPM features in WindowsВ 10, version 1507

The following sections describe the new and changed functionality in the TPM for WindowsВ 10:

Device health attestation

Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device health attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. Some things that you can check on the device are:

• Is Data Execution Prevention supported and enabled?
• Is BitLocker Drive Encryption supported and enabled?
• Is SecureBoot supported and enabled?

The device must be running WindowsВ 10 and it must support at least TPM 2.0.

User Account Control

User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment.

You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Universal Windows Platform apps stop working. You must always set the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10.

In WindowsВ 10, User Account Control has added some improvements.

New User Account Control features in WindowsВ 10, version 1507

• Integration with the Antimalware Scan Interface (AMSI). The AMSI scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.

VPN profile options

Windows 10 provides a set of VPN features that both increase enterprise security and provide an improved user experience, including:

• Always-on auto connection behavior
• App=triggered VPN
• VPN traffic filters
• Lock down VPN
• Integration with Microsoft Passport for Work

Management

WindowsВ 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices.

MDM support

MDM policies for WindowsВ 10 align with the policies supported in WindowsВ 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.

MDM support in WindowsВ 10 is based on Open Mobile Alliance (OMA) Device Management (DM) protocol 1.2.1 specification.

Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. Reference for Mobile device management for Windows 10

Unenrollment

When a person leaves your organization and you unenroll the user account or device from management, the enterprise-controlled configurations and apps are removed from the device. You can unenroll the device remotely or the person can unenroll by manually removing the account from the device.

When a personal device is unenrolled, the user’s data and apps are untouched, while enterprise information such as certificates, VPN profiles, and enterprise apps are removed.

Infrastructure

Enterprises have the following identity and management choices.

Area	Choices
Identity	Active Directory; Azure AD
Grouping	Domain join; Workgroup; Azure AD join
Device management	Group Policy; Microsoft Endpoint Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI)

Note: With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see Microsoft Support Lifecycle.

Device lockdown

Do you need a computer that can only do one thing? For example:

A device in the lobby that customers can use to view your product catalog.

A portable device that drivers can use to check a route on a map.

A device that a temporary worker uses to enter data.

You can configure a persistent locked down state to create a kiosk-type device. When the locked-down account is logged on, the device displays only the app that you select.

You can also configure a lockdown state that takes effect when a given user account logs on. The lockdown restricts the user to only the apps that you specify.

Lockdown settings can also be configured for device look and feel, such as a theme or a custom layout on the Start screen.

Customized Start layout

A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Starting in Windows 10, version 1511, administrators can configure a partial Start layout, which applies specified tile groups while allowing users to create and customize their own tile groups. Learn how to customize and export Start layout.

Administrators can also use mobile device management (MDM) or Group Policy to disable the use of Windows Spotlight on the lock screen.

Microsoft Store for Business

New in Windows 10, version 1511

With the Microsoft Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps.

Updates

Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service.

By using Group Policy Objects, Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their WindowsВ 10-based devices are updated, by allowing:

Deployment and validation groups; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met).

Peer-to-peer delivery, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient.

Use with existing tools such as Microsoft Endpoint Manager and the Enterprise Mobility Suite.

Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager.

For more information about updating WindowsВ 10, see Windows 10 servicing options for updates and upgrades.

Microsoft Edge

Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana.

• Web Note. Microsoft Edge lets you annotate, highlight, and call things out directly on webpages.
• Reading view. Microsoft Edge lets you enjoy and print online articles in a distraction-free layout that’s optimized for your screen size. While in reading view, you can also save webpages or PDF files to your reading list, for later viewing.
• Cortana. Cortana is automatically enabled on Microsoft Edge. Microsoft Edge lets you highlight words for more info and gives you one-click access to things like restaurant reservations and reviews, without leaving the webpage.
• Compatibility and security. Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls.

Enterprise guidance

Microsoft Edge is the default browser experience for WindowsВ 10 and WindowsВ 10 Mobile. However, if you’re running web apps that need ActiveX controls, we recommend that you continue to use Internet ExplorerВ 11 for them. If you don’t have IE11 installed anymore, you can download it from the Microsoft Store or from the Internet Explorer 11 download page.

We also recommend that you upgrade to IE11 if you’re running any earlier versions of Internet Explorer. IE11 is supported on WindowsВ 7, WindowsВ 8.1, and WindowsВ 10. So any legacy apps that work with IE11 will continue to work even as you migrate to WindowsВ 10.