Microsoft Technology Licensing, LLC

Gaurav Raghu Dhawan

David C James

Michael Joseph Healy

Peter J Kaufman

Yuhang Zhu

Shayak Lahiri

Sean Anderson Bowles

Jeffrey A Sutherland

Richard Ivan June

Brett D A Flegg

Khuzaima Iqbal

Prabagar Ramadasse

Hassen Karaa

Adeep Singh Cheema

Daniel S Dudugjian

Moiz Z Rassiwala

Jitendrakumar G Koshti

Rama Krishna Samudrala

Yordan Ivanov Rouskov

Marc Shepard

Dattatraya B Rajpure

Rajagopalan Badri Narayanan

Shafqat U Khan

Venkata Raghuram Pampana

Adrian Maziak

Aleksandr Tokarev

Ramachandra Ravitej Vennapusa

Mick Healy

Roxana Drake

Djana Milton

Kyle Smith

Bruce Wayne Copeland

Jun Wang

Nirupama Chandrasekaran

John Leo Ellis

Brad R Anderson

Brett Damon Alan Flegg

Zhengkai Kenneth Pan

Jason Robert Githens

Loretta Marie Macklem-Clements

Jeff Liu

Sobia Tariq

Peter Francis Martone

Maayan Bar-Niv

Yongcheng Huang

Ingo R A G Bringemeier

Doyle S Cronk

Daniel Nicholas Joseph Drew

Martin Napier Dey

Paul Joseph Lyman Schottland

Hang Heidi Cheng

Joshua Pointer

Richard Xia

Brett DA Flegg

Michael Healy

Ingo RAG Bringemeier

Generally discussed herein are devices, systems, and methods for binding with cryptographic key attestation. A method can include generating, by hardware of a device, a device public key and a device private key, based on the device private key, signing a first attestation resulting in a signed first attestation, the first attestation claiming the device private key originated from the hardware, based on the device public key and the signed first attestation, registering the device with a trusted authority, generating, by the hardware, a first application private key and a first application public key, and based on the device private key, signing a second attestation resulting in a signed second attestation, the second attestation claiming the first application private key originated from the hardware, and based on the first application public key and the signed second attestation, registering a first application of the device to a first server.

Binding with cryptographic key attestation

Embodiments described herein are directed to implementing compliance settings by a computing device for bringing the computing device into compliance with a configuration scenario. For instance, a computing device may receive, from a server, configuration information describing compliance settings for implementing by the computing device to bring the computing device into compliance with a configuration scenario. Moreover, the computing device may identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings and execute the state machine to configure the computing device with the compliance settings.

Implementation of compliance settings by a mobile device for compliance with a configuration scenario

Techniques are described herein that are capable of utilizing agent-based configuration co-management to selectively migrate workloads from a first configuration management authority to a second configuration management authority. The first configuration management authority has a first management client and a first management server that provides a first management service. The second configuration management authority has a second management client and a second management server that provides a second management service. An operating system that runs on a computing device enrolls the first management agent and the second management agent into the second configuration management authority. The first management agent negotiates with the second management agent to determine a first subset of the workloads that is to be handled by the first management agent and a second subset of the workloads that is to be handled by the second management agent.

Agent-based configuration co-management to selectively migrate workloads

Registering a computer system for use in an enterprise. A method includes receiving, from a device management infrastructure of the enterprise, an executable system management component (SMC), and installing the SMC at a storage device. The method also includes executing the SMC, causing the computer system to register with the device management infrastructure, including applying a device settings policy to a configuration of the computer system. Executing the SMC also causes the computer system to configure itself to periodically execute a maintenance task received from the device management infrastructure. The method also includes periodically executing the maintenance task, causing the computer system to receive updated device settings policies from the device management infrastructure and apply the updated device settings policies to the configuration of the computer system, and to receive an updated application from the device management infrastructure and install the updated application at the computer system.

Limiting enterprise applications and settings on devices

Installing apps on a device. The device is generally configured to be used in a closed market environment that only allows generally available apps of the closed market to be installed. The method includes determining that the device has been authorized to install apps outside of a set of apps generally available from the closed market and from a set of apps available only to users of a particular enterprise. The method further includes determining that an app, that is not generally available from the closed market, has been verified by a central authority. The method further includes installing the app on the device in spite of the fact that the device is generally configured to be used in a closed market environment.

Enterprise management for devices

Installing apps and setting configuration on a device. A method includes receiving user input. The user input indicates a level of control that a user is willing to give an enterprise over the device. The method further includes determining, based on the level of control indicated by the user input, a set of apps allowed to install on the device. The set of apps allowed to install on the device is limited by the level of control indicated by the user. The method further includes authorizing installation of the set of apps on the device while restricting installation of other apps that would be authorized had the user selected a different level of control that the user is willing to give the enterprise over the device.

Techniques for guaranteeing that a software program is executed on a machine only during designated periods of time are provided. Service windows define time periods during which software programs targeted to execute on a machine are allowed to execute on the machine. On the machine, the service windows work in conjunction with a client process that is executing on the machine to guarantee execution of the software programs by the client process only during available service windows.

Program execution service windows

An item grouping mechanism may be applied to files or other computer objects to allow the files or objects to be accessed according to the group definition. The group definition may be defined in a table with other group definitions and distributed across an organization so that each device using the group definition may have files or other items presented in a consistent manner. The group definition may be distributed through a different mechanism than for the files or other items. If a device determines that a file defined in the group definition is missing from a local store, the device may retrieve the file from a distribution server.

Organization system for distributed items

A client in a plurality of clients with a same network address or similar common identifier is designated a Peer Distribution Point (PDP) agent for distributing a software application divided into several packages to the plurality of clients. The plurality of clients are part of a client-server hierarchical system comprising a Central SMS site server and several Distributing servers. The Central SMS site server generates policies for the packages that are pushed to a Distribution server assigned to the plurality of clients from where the PDP agent pulls the policies. The Central SMS site server generates the packages that are pushed to the Distributing server after the PDP agent pulls the policies. The packages are pulled by the PDP agent from the Distributing server. The other clients pull the packages from the PDP agent as and when needed.

Peer distribution point feature for system management server

The disclosed arrangements and procedures replicate source files across networked resources. Specifically, a server receives a package update notification corresponding to a difference between a previous set of source files and one or more new sets of source files. Responsive to receiving the package update notification, a delta set of source files that correspond to the difference are identified. A set of source and/or distribution servers in an enterprise network that are configured for delta replication is determined. The identified delta set of source files is communicated to the determined source and/or distribution servers.

Delta replication of source files and packages across networked resources

Growing community of inventors

Seattle, WA, United States of America

Gaurav Raghu Dhawan