ms-settings Commands in Windows 10 Operating System

The new Settings App in Windows 10 is similar to the old Control Panel in the older versions of the Operating System. To access the different settings you can open the interface and navigate, or search the topic you want, but you can also open a specific settings interface using the respective command for that. This commands are known as URI (Uniform Resource Identifier).

Below is the complete list of URI (ms-settings) commands for the Windows 10 Settings available in the "Creators Update" version 1704.

SETTINGS	URI COMMAND
Home
Settings home page	ms-settings:
System
Display	ms-settings:display
Notifications & actions	ms-settings:notifications
Power & sleep	ms-settings:powersleep
Battery	ms-settings:batterysaver
Battery usage by app	ms-settings:batterysaver-usagedetails
Storage	ms-settings:storagesense
Tablet mode	ms-settings:tabletmode
Multitasking	ms-settings:multitasking
Projecting to this PC	ms-settings:project
Shared experiences	ms-settings:crossdevice
About	ms-settings:about
Devices
Bluetooth & other devices	ms-settings:bluetooth
Printers & scanners	ms-settings:printers
Mouse	ms-settings:mousetouchpad
Touchpad	ms-settings:devices-touchpad
Typing	ms-settings:typing
Pen & Windows Ink	ms-settings:pen
AutoPlay	ms-settings:autoplay
USB	ms-settings:usb
Network & Internet
Status	ms-settings:network-status
Cellular & SIM	ms-settings:network-cellular
Wi-Fi	ms-settings:network-wifi
Manage known networks	ms-settings:network-wifisettings
Ethernet	ms-settings:network-ethernet
Dial-up	ms-settings:network-dialup
VPN	ms-settings:network-vpn
Airplane mode	ms-settings:network-airplanemode
Mobile hotspot	ms-settings:network-mobilehotspot
Data usage	ms-settings:datausage
Proxy	ms-settings:network-proxy
Personalization
Background	ms-settings:personalization-background
Colors	ms-settings:colors
Lock screen	ms-settings:lockscreen
Themes	ms-settings:themes
Start	ms-settings:personalization-start
Taskbar	ms-settings:taskbar
Apps
Apps & features	ms-settings:appsfeatures
Manage optional features	ms-settings:optionalfeatures
Default apps	ms-settings:defaultapps
Offline maps	ms-settings:maps
Apps for websites	ms-settings:appsforwebsites
Accounts
Your info	ms-settings:yourinfo
Email & app accounts	ms-settings:emailandaccounts
Sign-in options	ms-settings:signinoptions
Access work or school	ms-settings:workplace
Family & other people	ms-settings:otherusers
Sync your settings	ms-settings:sync
Time & language
Date & time	ms-settings:dateandtime
Region & language	ms-settings:regionlanguage
Speech	ms-settings:speech
Gaming
Game bar	ms-settings:gaming-gamebar
Game DVR	ms-settings:gaming-gamedvr
Broadcasting	ms-settings:gaming-broadcasting
Game Mode	ms-settings:gaming-gamemode
Ease of Access
Narrator	ms-settings:easeofaccess-narrator
Magnifier	ms-settings:easeofaccess-magnifier
High contrast	ms-settings:easeofaccess-highcontrast
Closed captions	ms-settings:easeofaccess-closedcaptioning
Keyboard	ms-settings:easeofaccess-keyboard
Mouse	ms-settings:easeofaccess-mouse
Other options	ms-settings:easeofaccess-otheroptions
Privacy
General	ms-settings:privacy
Location	ms-settings:privacy-location
Camera	ms-settings:privacy-webcam
Microphone	ms-settings:privacy-microphone
Notifications	ms-settings:privacy-notifications
Speech, inking, & typing	ms-settings:privacy-speechtyping
Account info	ms-settings:privacy-accountinfo
Contacts	ms-settings:privacy-contacts
Calendar	ms-settings:privacy-calendar
Call history	ms-settings:privacy-callhistory
Email	ms-settings:privacy-email
Tasks	ms-settings:privacy-tasks
Messaging	ms-settings:privacy-messaging
Radios	ms-settings:privacy-radios
Other devices	ms-settings:privacy-customdevices
Feedback & diagnostics	ms-settings:privacy-feedback
Background apps	ms-settings:privacy-backgroundapps
App diagnostics	ms-settings:privacy-appdiagnostics
Update & security
Windows Update	ms-settings:windowsupdate
Check for updates	ms-settings:windowsupdate-action
Update history	ms-settings:windowsupdate-history
Restart options	ms-settings:windowsupdate-restartoptions
Advanced options	ms-settings:windowsupdate-options
Windows Defender	ms-settings:windowsdefender
Backup	ms-settings:backup
Troubleshoot	ms-settings:troubleshoot
Recovery	ms-settings:recovery
Activation	ms-settings:activation
Find My Device	ms-settings:findmydevice
For developers	ms-settings:developers
Windows Insider Program	ms-settings:windowsinsider
Mixed reality
Mixed reality	ms-settings:holographic
Audio and speech	ms-settings:holographic-audio

Windows Preinstallation Environment (WinPE OS)

WinPE startup images are lightweight versions of the Microsoft Windows OS with limited componentes and services that requires 512 MB of memory for the base version. If adding additional drivers, packages, or applicationfigus, you will need more memory. When a computer is started with WinPE, it is initialized in a RAM drive under the drive letter X:\, which allows for better performance and to temporarily write data such as log files that you can review while in the environment. Also, while WinPE is running, it supports hot-swapping devices such as USB drives.

When you start into a WinPE OS, you can perform several different tasks on the host machine, such as the following:

• Use tools to set up the hard drive before installing Windows
• Initiate an image capture or deploy an image to an attached drive
• Run plug-ins, apps, or scripts
• Modify an existing Windows installation while it is not running
• Retrieve or back up data from a drive for which there is no functional OS
• Add a custom shell or GUI for automation of tasks

The lightweight OS will run from the Windows command-line environment (CLE), and the following features are supported:

• Batch files and scripts, including support for Windows Script Host (WSH), and ActiveX Data Objects (ADO), and optional support for Windows PowerShell.
• Applications, including Win32 application programming interfaces (APIs) and optional support for HTML Applications (HTA).
• Drivers, including a generic set of drivers that can run networking, graphics, and mass storage devices.
• Image capturing and servicing, including Deployment Image Servicing and Management (DISM).
• Networking, including connecting to file servers by using TCP/IP and NetBIOS over TCP/IP via LAN.
• Storage, including NTFS, DiskPart, and BCDBoot.
• Security tools, including optional support for BitLocker and the Trusted Platform Module (TPM), Secure Boot, and other tools.
• Hyper-V, including virtual hard drive (VHD) files, mouse integration, mass storage, and network drivers that make it possible for WinPE to run in a hypervisor.

For the purposes of Configuration Manager OSD, two WinPE startup images (one x86 and one x64) are included during the installation of Configuration Manager via the preinstalled supported version of the Windows Assessment and Deployment Kit (ADK). You can also create, customize, and import startup images into Configuration Manager for use with image deployment. You can use the properties of the startup images to change the behavior at run time. For example, you can add startup-critical drivers to the image, turn on prestart commands to run custom scripts, add an image background, add optional components, and for troubleshooting turn on command-line support when the F8 key is pressed. The startup images are essentially managed as packages that are used to install the OS on target computers via a task sequence. As a prerequisite, the package must be made available on the DP before deploying an OS to a target computer, and if you make any changes, you must update the DP, as well.

To deploy Windows 10, you must use the WinPE startup images from the ADK for Windows 10. The WinPE 10 startup image version supports the deployments of Windows 7 through to Windows 10.

For specific information on the use of the ADK with Configuration Manager to deploy Windows 10, refer to http://blogs.technet.com/b/configmgrteam/archive/2015/08/05/windows-10-adk-andconfiguration-manager.aspx?pi168308=2

To customize WinPE for use in Configuration Manager, refer to https://technet.microsoft.com/library/dn387582.aspx

For a complete WinPE 10 reference, visit https://msdn.microsoft.com/library/windows/hardware/dn938389%28v=vs.85%29.aspx


Source: Deploying Windows 10 Press Book

Security Measures in Windows 10

Online security presents many challenges. With password theft being an ongoing problem, password security continues to be at the top of the list of those challenges. According to an article published by the BBC (http://www.bbc.com/news/technology-28654613), it is estimated that hackers have stolen more than 1.2 billion user names and passwords across the globe.

Enterprises continue to educate users on the need for password security and to establish and enforce password policies. Basic safeguards such as using unique passwords need to be encouraged. For example, if you use the same user name and password on all your websites, and one website is compromised, it is likely that all your websites will be compromised.

Pass the Hash (PtH) is a hacking technique by which an attacker can authenticate to a remote server or service by using the Windows NT LAN Manager (NTLM) authentication protocol or LanMan hash of a user password. A typical PtH attack starts with one end point being compromised by malware, which then manages to gain administrator-level access. With this access, the malware can steal the user’s derived credentials and impersonate the user on other devices. As the attacker moves laterally across the network and finds additional devices to which the user has access, the malware can steal the derived credentials from other users who previously signed in to those devices.

Over time, an attacker can typically gain access to more and more derived credentials that have increased levels of network access. Eventually, it is likely that domain administrator accounts can be compromised, and then the consequences can be even worse.

Here are the Microsoft features that address password and PtH attacks in Windows 10:
- Microsoft Passport
- Windows Hello
- Isolated User Mode


Microsoft Passport

The goal of Microsoft Passport is to remove the need to enter user names and passwords for all compliant websites, applications, and resources. Microsoft Passport approaches this goal by doing the following:

• Replacing passwords with a private key made available solely through a user gesture, which can be a PIN or biometric identifier.
• Streamlining two-factor authentication.
• Using credentials on familiar mobile devices for desktop sign-in.
• Supporting both local and remote components such as phones, USB dongle, and so on.

Windows Hello

Windows Hello is a new biometric identification system built in to Windows 10 that recognizes your face, fingerprint, and iris. Windows Hello uses Microsoft Passport as complementary technology for websites supporting the technology, which is based on asymmetric-key cryptography created by the Windows security team to identify a cellphone to a network. All devices incorporating the Intel F200 RealSense 3D Camera support the facial and iris unlock features of Windows Hello.

The world is moving toward small, touch-based sensors that have a high degree of accuracy. These sensors can mitigate the majority of known attacks by using fingerprint authentication. All current fingerprint-capable readers are supported. The following are three examples of supported devices:

• Fingerprint Sensor FPC1021
• Fingerprint Sensor FPC1150
• Next Biometrics NB-1010-S

The fingerprint process begins when your fingerprint is scanned by the reader, generating a template on your local device. If the device is compromised, the template does not allow the attacker to create your fingerprint, because the attacker needs to get local administrator rights to get the fingerprint templates.

The face-recognition process involves a RealSense camera, which is embedded above the display. It uses photographic analysis, heat detection, and depth detection to check who is trying to access the device.

Fingerprint, face, and iris recognition share the same design language for enrollment, usage, and recovery with Windows Hello, and the enrollment process is very simple.


Isolated User Mode

There are two pieces to the Windows OS architecture: the Kernel and the User mode. Because the Kernel can be vulnerable to attacks, it is also necessary to protect the User mode code from the Kernel.

Isolated User Mode (IUM) brings a secure Kernel, separated from the normal New Technology Operating System Kernel, or NTOS Kernel, that does not know or have access to the address space of the User mode code, which means literally no normal kernel-mode access to user-mode data.

The IUM provides a runtime environment for Trustlets, which are the processes running in IUM that are Trustlets isolated from one another. Secure Kernel runs in Secure Ring 0 and provides a hardened interface to proxy NTOS system calls.

The Local Authentication Authority (LSA) process in the OS, which serves to authenticate and log users on to the local systems, communicates with the isolated LSA by using remote procedure calls (RPC).

Data stored by using virtualization-based security is not accessible to the rest of the OS.

Credential Guard does not host any device drivers; instead, it hosts only a small subset of OS binaries that are needed for security. All of these binaries are signed with a certificate that is trusted by virtualization-based security.

Virtual TPM is a feature that allows the emulation of a TPM and provides that to guest virtual machines running on a host.


Source: Deploying Windows 10 Press Book