Create a Prov.xml
August 13, 2015
The provisioning XML file (Prov.xml) for Windows Embedded 8.1 Handheld contains the configuration settings and lockdown information for the enterprise devices. It can be pushed to a device by using the mobile device management (MDM) service and then restarting the device. It can also be sideloaded by using a near field communication (NFC) tag, SD card, or other data source (such as a bar code scanner), and then applying during the out-of-box experience (OOBE).
The Prov.XML contains the following:
(Required) The requested certificates.
(Required) DM client configuration.
(Required) Wireless must be provisioned.
(Optional) An enterprise application token and an enterprise app download link to allow the enrollment client to download a Company Hub app or enterprise app at the end of enrollment.
(Optional) Assigned access XML.
The following table shows how you can use configuration service providers to configure devices.
Configuration Service Provider |
Description |
|---|---|
Allows enterprise to use the MDM service to enroll devices to the MDM server in an enterprise environment, restart a device, and manage the maintenance window schedule for devices so that they can perform device updates and other management tasks. |
|
Allows the enterprise to use Windows Embedded 8.1 Handheld features to configure custom layouts on a device. For example, the administrator can lock down a device so that only apps specified in an Allow list are available. Apps not on the Allow list remain installed on the device, but are hidden from view. |
|
Allows enterprise to add, retrieve, or change files in the file system through the MDM service. For example, you can use this configuration service provider to push a provisioning XML file or a new lock screen background image file to a device through the MDM service and retrieve logs from shared storage in the enterprise environment. |
To create a Prov.xml file to configure devices
Using a text or XML editor, copy the sample XML from this topic and save it to a new XML file.
Using the examples in the Configuration service provider reference topics, change the values to the appropriate values for your organization.
Make sure that the provisioning file is encoded as UTF-8 or UTF-16LE, including the byte order mark (BOM).
(optional) Using MDM, encrypt Prov.xml. The encryption password will need to be provided during OOBE configuration. The encryption password can use only the following characters:
Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
Base 10 digits (0 through 9)
Nonalphanumeric characters: ~!@#$%^&*_-+=`|\(){}[]:;"'<>,.?/
Do one of the following:
If you will push the Prov.xml to devices by using the MDM service, save the file to your development computer, and then push it to a device.
If you will use an SD card or other data source (such as a bar code scanner), save the Prov.xml file to the root directory of the data source so that you can sideload it, and then apply it during OOBE.
If you will use an NFC tag or device, make sure that you followed the components of an NFC tag as described in Enable near field communication. Save the Prov.xml file to the NFC tag or device so that the IT administrator can sideload it, and then apply it during OOBE.
Sample OMA Client Provisioning
The following example shows a provisioning XML file (Prov.xml) that is applied to a device during OOBE and that contains settings for a Wi-Fi connection, MDM enrollment, and profile lockdown.
.gif "Important note") Important note |
|---|
Formatting in this sample file uses escaped characters, such as < in place of <, as a result of XML embedded in XML. Do not replace the escaped characters. |
<!--
Copyright (c) Microsoft Corporation. All rights reserved.
-->
<wap-provisioningdoc>
<characteristic type="WiFi">
<characteristic type="Profile">
<characteristic type="Open">
<parm name="WlanXml" datatype="string" value="<?xml version="1.0"?><WLANProfile xmlns="https://www.microsoft.com/networking/WLAN/profile/v1"><name>WIFI_OPEN</name><SSIDConfig><SSID><name>WIFI_OPEN</name></SSID></SSIDConfig><connectionType>ESS</connectionType><connectionMode>auto</connectionMode><MSM><security><authEncryption><authentication>open</authentication><encryption>none</encryption></authEncryption></security></MSM></WLANProfile>" />
</characteristic>
</characteristic>
</characteristic>
<characteristic type="EnterpriseExt">
<characteristic type="MDM">
<parm name="Server" value="https://localhost:443" />
<parm name="Username" value="name@contoso.com" />
<parm name="Password" value="password" />
<parm name="EnableDeviceEnrollment" value="false" datatype="boolean" />
</characteristic>
</characteristic>
<characteristic type="EnterpriseAssignedAccess">
<characteristic type="AssignedAccess">
<parm name="AssignedAccessXml" datatype="string" value="<?xml version="1.0" encoding="utf-8"?>
<HandheldLockdown version="1.0">
<Default>
<ActionCenter enabled="true" />
<Apps>
<!-- Phone App -->
<Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5611}">
<PinToStart>
<Size>Medium</Size>
<Location>
<LocationX>0</LocationX>
<LocationY>0</LocationY>
</Location>
</PinToStart>
</Application>
<!-- Settings -->
<Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5601}">
<PinToStart>
<Size>Medium</Size>
<Location>
<LocationX>2</LocationX>
<LocationY>0</LocationY>
</Location>
</PinToStart>
</Application>
</Apps>
<Buttons>
<ButtonLockdownList>
<!-- Lockdown all buttons except Search -->
<Button name="Search">
</Button>
<Button name="Camera">
<ButtonEvent name="Press" />
<ButtonEvent name="PressAndHold" />
</Button>
<Button name="Custom1">
<ButtonEvent name="Press" />
<ButtonEvent name="PressAndHold" />
</Button>
<Button name="Custom2">
<ButtonEvent name="Press" />
<ButtonEvent name="PressAndHold" />
</Button>
<Button name="Custom3">
<ButtonEvent name="Press" />
<ButtonEvent name="PressAndHold" />
</Button>
</ButtonLockdownList>
<ButtonRemapList>
<Button name="Search">
<ButtonEvent name="Press">
<!-- TicTapToe -->
<Application productId="{08179793-ED2E-45EA-BA12-BDE3EE9C3CE3}" parameters="" />
</ButtonEvent>
</Button>
</ButtonRemapList>
</Buttons>
<MenuItems>
<DisableMenuItems />
</MenuItems>
<Settings>
<System name="Microsoft.About" />
<System name="Microsoft.NocenterSettings" />
<System name="Microsoft.CompanyAccount" />
</Settings>
<StartScreenSize>Small</StartScreenSize>
</Default>
<RoleList>
<Role guid="{88501844-3B51-4C9F-9DA7-7CA745E7DA6B}" name="Associate">
<ActionCenter enabled="false" />
<Apps>
<!-- Settings -->
<Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5601}">
<PinToStart>
<Size>Medium</Size>
<Location>
<LocationX>0</LocationX>
<LocationY>0</LocationY>
</Location>
</PinToStart>
</Application>
</Apps>
<Buttons>
<ButtonLockdownList>
</ButtonLockdownList>
</Buttons>
<MenuItems>
<DisableMenuItems />
</MenuItems>
<Settings>
<System name="Microsoft.About" />
<System name="Microsoft.Accessibility" />
<System name="Microsoft.Accounts" />
<System name="Microsoft.AdvertisingId" />
<System name="Microsoft.AirplaneMode" />
<System name="Microsoft.BatterySaver" />
<System name="Microsoft.Bluetooth" />
<System name="Microsoft.Brightness" />
<System name="Microsoft.CellularConn" />
<System name="Microsoft.CloudStorageCpl" />
<System name="Microsoft.CompanyAccount" />
<System name="Microsoft.DateTime" />
<System name="Microsoft.DoNotDisturb" />
<System name="Microsoft.DrivingMode" />
<System name="Microsoft.Feedback" />
<System name="Microsoft.FindMyPhone" />
<System name="Microsoft.FlashAppSetting" />
<System name="Microsoft.KidZone" />
<System name="Microsoft.Language" />
<System name="Microsoft.Location" />
<System name="Microsoft.MirrorUX" />
<System name="Microsoft.NocenterSettings" />
<System name="Microsoft.PhoneLock" />
<System name="Microsoft.ProfileUpdate" />
<System name="Microsoft.Proximity" />
<System name="Microsoft.Regional" />
<System name="Microsoft.RoamingCpl" />
<System name="Microsoft.RotationLock" />
<System name="Microsoft.SoftAP" />
<System name="Microsoft.Sounds" />
<System name="Microsoft.Speech" />
<System name="Microsoft.StorageSettings" />
<System name="Microsoft.Themes" />
<System name="Microsoft.TouchKeyboard" />
<System name="Microsoft.Updates" />
<System name="Microsoft.USB" />
<System name="Microsoft.VPN" />
<Application name="Microsoft.AssistUX" />
<Application name="Microsoft.Contacts" />
<Application name="Microsoft.IE" />
<Application name="Microsoft.Maps" />
<Application name="Microsoft.Marketplace" />
<Application name="Microsoft.Messaging" />
<Application name="Microsoft.OfficeMobile" />
<Application name="Microsoft.Phone" />
<Application name="Microsoft.Photos" />
<Application name="Microsoft.Search" />
<Application name="Microsoft.Wallet" />
</Settings>
</Role>
</RoleList>
</HandheldLockdown>" />
</characteristic>
</characteristic>
</wap-provisioningdoc>
The following example shows how to install a certificate.
<?xml version="1.0" encoding="utf-8"?>
<wap-provisioningdoc version="1.1">
<characteristic type="EnterpriseExt">
<characteristic type="MDM">
<parm name="Server" value="HTTPS://PrimarySite.SCCM.CORP.MICROSOFT.COM:443/EnrollmentServer/DeviceBulkEnrollmentWebService.svc" />
<parm name="Username" value="bulkenroll" />
<parm name="Password" value="cb6d4e6d-d2e9-428b-b115-d3f9ec4bd7bb" />
<parm name="EnableDeviceEnrollment" value="true" datatype="boolean" />
</characteristic>
</characteristic>
<characteristic type="WiFi">
<characteristic type="Profile">
<characteristic type="Open-WEP">
<parm name="WlanXml" datatype="string" value="<?xml version="1.0"?>
<WLANProfile xmlns="https://www.microsoft.com/networking/WLAN/profile/v1">
	<name>Open-WEP</name>
	<SSIDConfig>
		<SSID>
			<hex>4E455753534944283229</hex>
			<name>NEWSSID(2)</name>
		</SSID>
		<nonBroadcast>false</nonBroadcast>
	</SSIDConfig>
	<connectionType>ESS</connectionType>
	<connectionMode>auto</connectionMode>
	<autoSwitch>true</autoSwitch>
	<MSM>
		<security>
			<authEncryption>
				<authentication>open</authentication>
				<encryption>WEP</encryption>
				<useOneX>false</useOneX>
			</authEncryption>
			<preAuthThrottle>3</preAuthThrottle>
		</security>
	</MSM>
</WLANProfile>
" />
<parm name="Proxy" datatype="string" value="" />
</characteristic>
</characteristic>
</characteristic>
<characteristic type="CertificateStore">
<characteristic type="Root">
<characteristic type="System">
<characteristic type="92F6A5FF349A519F26C8D863758904380FB97F97">
<parm name="EncodedCertificate" value="MIIDzz...aEk/A==" />
</characteristic>
</characteristic>
</characteristic>
</characteristic>
</wap-provisioningdoc>
Troubleshooting
A setting didn’t provision properly during OOBE. Make sure that you followed the format guidelines for each characteristic node in the Prov.xml file. An incorrect format could cause a step to be skipped during the provisioning process with no error occurring. For information about correct formatting, see the correct configuration service provider under Configuration service provider reference.