Microsoft Technology Licensing, LLC

Michael Joseph Healy

David C James

Jeffrey A Sutherland

Gaurav Raghu Dhawan

Rajagopalan Badri Narayanan

Brett D A Flegg

Scott Field

Edward F Reus

Deepak Kumar

Bruce Wayne Copeland

Kenneth Mark Osborne

Khuzaima Iqbal

Joseph Dadzie

Zhengkai Kenneth Pan

Hassen Karaa

Henricus Johannes Maria Meijer

John R Douceur

Gopal Parupudi

Mario C Goertzel

David E Kays

Dustin Michael Ingalls

John Leo Ellis

Jeffry B Phillips

Joseph S Calabig

Donald Y Song

Daniel N J Drew

Galen Clyde Hunt

Robert M Fries

Robert Victor Welland

Adrian Mihail Marinescu

Bassam Tabbara

Ashvinkumar J Sanghvi

Aamer Hydrie

Rene Antonio Vega

Srivatsan Parthasarathy

Raymond W McCollum

Anders Bertil Vinberg

Geoffrey Hugh Outhred

Vij Rajarajan

John M Parchem

Efstathios Papaefstathiou

Rob M Mensching

Vitaly Voloshin

David James Armour

John H Wilson

Mazhar Naveed Mohammed

Jonathan C Hardwick

Nirupama Chandrasekaran

Eric Joseph Winner

Anand Lakshminarayanan

Jeffrey A Woolsey

Shafqat U Khan

Karthik Selvaraj

Nirmal Rajesh Soy

Edwin R Lassettre

Prasanna Kumar Jayapal

Kevin D J Grealish

Christopher Samuel Green

Ingo R A G Bringemeier

Matthew Ronald Shadbolt

Nedialko K Paskov

Eric Holtz

Sucharit SenGupta

Farhan Haleem Qureshi

David Torosyan

Patanjal Digant Vyas

Chaohong Ou

Hayk Hovsepyan

Vladimir Soroka

Milind Amrutrao Pawar

Alemeshet Yismaw Alemu

Gokhan Ozhan

Shweta Jha

David Kays

A system and method for providing stringent tamper resistant protection against changes to key system security features. The tamper protection is configured such that any changes to the policy can only occur from a configuration manager console, thereby preventing local device admin users or other malicious actors from altering the setting. Thus, tamper protection locks the selected service and prevents security settings from being changed through third-party apps and methods. When a system administrator enables the feature for an enterprise's workstations, only administrators will be able to change the service settings across a company's computers. The tamper protection policy is digitally signed in the backend before being deployed to endpoints, and the endpoint verifies the validity and intent of the policy, establishing that it is a signed package that only security operations personnel with the necessary administrator rights can control.

Tamper-resistant service management for enterprise systems

The subject disclosure relates to techniques for monitoring contextual and performance information of a device for anticipatorily sending update information to the device. An interface component can receive, from the client, contextual information indicating an operating environment of the client and performance information that is associated with one or more operations being performed by the client based on the operating environment, and send, based on correlation information, update information to the client. Further, a service component can to infer a relationship between the contextual information and the performance information to obtain the correlation information. In other embodiments, a client can populate a cache with portion(s) of the contextual information to obtain cached information, and send at least a portion of the cached information to a system including one or more aspects of the service component.

Discovery and mining of performance information of a device for anticipatorily sending updates to the device

Registering a computer system for use in an enterprise. A method includes receiving, from a device management infrastructure of the enterprise, an executable system management component (SMC), and installing the SMC at a storage device. The method also includes executing the SMC, causing the computer system to register with the device management infrastructure, including applying a device settings policy to a configuration of the computer system. Executing the SMC also causes the computer system to configure itself to periodically execute a maintenance task received from the device management infrastructure. The method also includes periodically executing the maintenance task, causing the computer system to receive updated device settings policies from the device management infrastructure and apply the updated device settings policies to the configuration of the computer system, and to receive an updated application from the device management infrastructure and install the updated application at the computer system.

Limiting enterprise applications and settings on devices

Providing access to one or more resources to a user device. A method includes at a user device, registering with an identity service to obtain an identity credential. The method further includes at the user device, registering with a policy management service by presenting the identity credential. The method further includes at the user device, providing an indication of current state of the user device to the policy management service. The policy management service can then indicate to the identity service the compliance level of the user device. The method further includes the user device receiving a token from the identity service based on the policy management level of the user device as compared to a policy set.

Conditional access to services based on device claims

Installing apps on a device. The device is generally configured to be used in a closed market environment that only allows generally available apps of the closed market to be installed. The method includes determining that the device has been authorized to install apps outside of a set of apps generally available from the closed market and from a set of apps available only to users of a particular enterprise. The method further includes determining that an app, that is not generally available from the closed market, has been verified by a central authority. The method further includes installing the app on the device in spite of the fact that the device is generally configured to be used in a closed market environment.

Enterprise management for devices

Installing apps and setting configuration on a device. A method includes receiving user input. The user input indicates a level of control that a user is willing to give an enterprise over the device. The method further includes determining, based on the level of control indicated by the user input, a set of apps allowed to install on the device. The set of apps allowed to install on the device is limited by the level of control indicated by the user. The method further includes authorizing installation of the set of apps on the device while restricting installation of other apps that would be authorized had the user selected a different level of control that the user is willing to give the enterprise over the device.

A method, system, and architecture for managing computer systems is provided. A management system employs management objects (MOs) to provide administrators the ability to intuitively express the administrative intent in an information technology (IT) environment, and to act out the administrative intent based on the information gathered by the management system. Managed elements of an IT environment, such as, by way of example, hardware components, software applications, software updates, software distribution policies, configurations, settings, etc., may be expressed as MOs. Actions, such as, by way of example, detect, install/apply, remove, remediate, enumerate, etc., may be associated with the MOs. The management system manages the computer systems by deploying the appropriate MOs and their associated actions onto the computer systems, and performing the actions on the computer systems.

Object-based computer system management

Data management techniques are provided for handling information resources. A data management process can account for attributes of information resources by analyzing or interpreting the workspace location, source, channel and device associated with an information resource, and effectuating policies, based on the attributes. Rules govern the attribute determination and policies for access restriction to the information resource. The attributes and policies determined are tagged to the information resource and is dynamically updated based on the attributes related to the information resource within different workspaces, such as a corporate workspace and a personal workspace.

Protection of data in a mixed use device

Embodiments of the present invention provide the ability to accurately match a particular computing device within a networked computing environment with an identity of that computing device. According to one aspect, a method for identifying a client computing device in a networked computing environment is provided. The method receives a discovery data record that includes a hardware identification and a logical identification, and in response, queries a plurality of client records for a matching client record. If a matching client record is identified by the query it is compared with the received discovery data record to identify the client computing device.

Method, system and apparatus for managing computer identity

Aspects of the subject matter described herein relate to model based application management. In aspects, models are defined that include structural and behavioral characteristics, rules, relations, and so forth between entities of an application. An instruction regarding a management function is received. The models are used to generate actions that when executed manage the application in accordance with the instruction.

Model based distributed application management

A client in a plurality of clients with a same network address or similar common identifier is designated a Peer Distribution Point (PDP) agent for distributing a software application divided into several packages to the plurality of clients. The plurality of clients are part of a client-server hierarchical system comprising a Central SMS site server and several Distributing servers. The Central SMS site server generates policies for the packages that are pushed to a Distribution server assigned to the plurality of clients from where the PDP agent pulls the policies. The Central SMS site server generates the packages that are pushed to the Distributing server after the PDP agent pulls the policies. The packages are pulled by the PDP agent from the Distributing server. The other clients pull the packages from the PDP agent as and when needed.

Peer distribution point feature for system management server

In accordance with certain aspects of the model-based policy application, each of a plurality of policies is associated with appropriate parts of a model of a heterogeneous system. A deployment agent is invoked to apply each of the plurality of policies to components associated with the parts of the model. An identification of a change to one of the plurality of policies is received, and the deployment agent is also invoked to apply the changed policy to selected ones of the components associated with the parts of the model.

Model-based policy application

Systems and methods for automatic client management authority assignment are described. In one aspect, it is determined that a network management point has not been configured for a client. Responsive to this, a directory service is requested to automatically assign a site code to the client. The automatically assigned site code identifies the management point through which the client can obtain management service(s).

Automatic client management authority assignment

Growing community of inventors

Redmond, WA, United States of America

Michael Joseph Healy