From 326cac6a25753ebed01858acaf6c9750062508ac Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Mon, 14 Sep 2026 13:40:44 -0700 Subject: [PATCH 01/31] Initial docs for DNIM --- docs/core/additional-tools/dnim-cli-layout.md | 61 ++++++ .../dnim-cli-query-products.md | 72 +++++++ .../dnim-cli-query-releases.md | 72 +++++++ docs/core/additional-tools/dnim-cli-scan.md | 88 ++++++++ docs/core/additional-tools/dnim-cli-trace.md | 61 ++++++ .../additional-tools/dnim-cli-uninstall.md | 188 ++++++++++++++++++ docs/core/additional-tools/dnim-cli-update.md | 88 ++++++++ docs/core/additional-tools/dnim-logs.md | 77 +++++++ .../additional-tools/dnim-net-installs.md | 129 ++++++++++++ docs/core/additional-tools/dnim-overview.md | 26 +++ .../includes/dnim-cli-accept-license.md | 7 + .../dnim-cli-create-system-restore-point.md | 9 + .../additional-tools/includes/dnim-cli-cve.md | 10 + .../dnim-cli-download-updates-when-offline.md | 10 + .../dnim-cli-except-product-version.md | 10 + .../includes/dnim-cli-except-support-phase.md | 10 + .../includes/dnim-cli-ignore-dependents.md | 7 + .../dnim-cli-include-bin-deployed-installs.md | 7 + .../includes/dnim-cli-include-installers.md | 7 + .../includes/dnim-cli-include-previews.md | 7 + .../includes/dnim-cli-install-type.md | 7 + .../dnim-cli-keep-latest-product-version.md | 7 + .../dnim-cli-keep-latest-support-phase.md | 7 + .../includes/dnim-cli-latest.md | 7 + .../includes/dnim-cli-layout-directory.md | 7 + .../dnim-cli-log-extra-debug-information.md | 7 + .../includes/dnim-cli-log-file.md | 7 + .../includes/dnim-cli-no-wua.md | 10 + .../dnim-cli-offline-revocation-checks.md | 7 + .../includes/dnim-cli-offline.md | 7 + .../includes/dnim-cli-output-file.md | 7 + .../includes/dnim-cli-output-format.md | 7 + .../includes/dnim-cli-product-version.md | 10 + .../includes/dnim-cli-release-version.md | 7 + .../dnim-cli-remove-EOL-versions-from-VS.md | 10 + .../dnim-cli-remove-orphaned-installs.md | 7 + .../includes/dnim-cli-report-issues.md | 7 + .../includes/dnim-cli-restore-point-suffix.md | 7 + .../includes/dnim-cli-security.md | 7 + .../includes/dnim-cli-support-phase.md | 10 + .../includes/dnim-cli-update-EOL-versions.md | 7 + .../dnim-cli-update-discontinued-sdks.md | 7 + .../includes/dnim-cli-verbosity.md | 7 + .../includes/dnim-cli-verify-signatures.md | 7 + .../includes/dnim-cli-what-if.md | 7 + docs/core/additional-tools/index.md | 4 + .../media/dnim/dotnet-bundles.svg | 86 ++++++++ .../additional-tools/media/dnim/eventlog.png | Bin 0 -> 22172 bytes 48 files changed, 1223 insertions(+) create mode 100644 docs/core/additional-tools/dnim-cli-layout.md create mode 100644 docs/core/additional-tools/dnim-cli-query-products.md create mode 100644 docs/core/additional-tools/dnim-cli-query-releases.md create mode 100644 docs/core/additional-tools/dnim-cli-scan.md create mode 100644 docs/core/additional-tools/dnim-cli-trace.md create mode 100644 docs/core/additional-tools/dnim-cli-uninstall.md create mode 100644 docs/core/additional-tools/dnim-cli-update.md create mode 100644 docs/core/additional-tools/dnim-logs.md create mode 100644 docs/core/additional-tools/dnim-net-installs.md create mode 100644 docs/core/additional-tools/dnim-overview.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-accept-license.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-create-system-restore-point.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-cve.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-except-product-version.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-except-support-phase.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-ignore-dependents.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-include-bin-deployed-installs.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-include-installers.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-include-previews.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-install-type.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-keep-latest-product-version.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-keep-latest-support-phase.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-latest.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-layout-directory.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-log-extra-debug-information.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-log-file.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-no-wua.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-offline-revocation-checks.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-offline.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-output-file.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-output-format.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-product-version.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-release-version.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-remove-orphaned-installs.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-report-issues.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-restore-point-suffix.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-security.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-support-phase.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-update-EOL-versions.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-update-discontinued-sdks.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-verbosity.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-verify-signatures.md create mode 100644 docs/core/additional-tools/includes/dnim-cli-what-if.md create mode 100644 docs/core/additional-tools/media/dnim/dotnet-bundles.svg create mode 100644 docs/core/additional-tools/media/dnim/eventlog.png diff --git a/docs/core/additional-tools/dnim-cli-layout.md b/docs/core/additional-tools/dnim-cli-layout.md new file mode 100644 index 0000000000000..25f82ee3ab4de --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-layout.md @@ -0,0 +1,61 @@ +--- +title: dnim layout command +description: The layout command creates a cache for offline deployments. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim layout + +## Name + +`dnim-win-[x86|x64|arm64] layout` - Creates or updates a cache for offline deployments. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] layout [-a|--accept-license] + [--include-installers] + [--include-previes] + [-l|--log-file ] + [--latest] + [-v|--verbosity ] + +dnim-win-[x86|x64|arm64] layout -?|-h|--help +``` + +## Description + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [include-installers](includes/dnim-cli-include-installers.md)] + +- [!INCLUDE [include-previews](includes/dnim-cli-include-previews.md)] + +- [!INCLUDE [log-file](includes/dnim-cli-log-file.md)] + +- [!INCLUDE [latest](includes/dnim-cli-latest.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +## Results + + + +## Examples + +- Create an offline deployment in `C:\dnim\layout` that only include the release metadata (no installers). + + ```console + dnim-win-[x86|x64|arm64] layout C:\dnim\layout + ``` + +- Create an offline deployment in `C:\dnim\layout` that includes the latest installers. + + ```console + dnim-win-[x86|x64|arm64] layout C:\dnim\layout --latest + ``` + +## See also diff --git a/docs/core/additional-tools/dnim-cli-query-products.md b/docs/core/additional-tools/dnim-cli-query-products.md new file mode 100644 index 0000000000000..c16c166cb2748 --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-query-products.md @@ -0,0 +1,72 @@ +--- +title: dnim query products command +description: The scan command identifies .NET installations. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim query + +## Name + +`dnim-win-[x86|x64|arm64] query products` - Queries release information about specific .NET products. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] query products [-a|--accept-license] + [--epv|--except-product-version ] + [--esp|--except-support-phase ] + [-o|--output-file ] [--offline ] + [--output-format ] [--pv|--product-version ] + [--sp|--support-phase ] + [-v|--verbosity ] + +dnim-win-[x86|x64|arm64] query products -?|-h|--help +``` + +## Description + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] + +- [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] + +- [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] + +- [!INCLUDE [offline](includes/dnim-cli-offline.md)] + +- [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] + +- [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] + +- [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +## Results + +## Examples + +- Display release information for all products: + + ```console + dnim-win-[x86|x64|arm64] query products + ``` + +- Display release information for all products that are not end-of-life: + + ```console + dnim-win-[x86|x64|arm64] query products --esp eol + ``` + +- Display release information for .NET 7.0 and 9.0 + + ```console + dnim-win-[x86|x64|arm64] query products --pv 7.0 --pv 9.0 + ``` + +## See also diff --git a/docs/core/additional-tools/dnim-cli-query-releases.md b/docs/core/additional-tools/dnim-cli-query-releases.md new file mode 100644 index 0000000000000..c16c166cb2748 --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-query-releases.md @@ -0,0 +1,72 @@ +--- +title: dnim query products command +description: The scan command identifies .NET installations. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim query + +## Name + +`dnim-win-[x86|x64|arm64] query products` - Queries release information about specific .NET products. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] query products [-a|--accept-license] + [--epv|--except-product-version ] + [--esp|--except-support-phase ] + [-o|--output-file ] [--offline ] + [--output-format ] [--pv|--product-version ] + [--sp|--support-phase ] + [-v|--verbosity ] + +dnim-win-[x86|x64|arm64] query products -?|-h|--help +``` + +## Description + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] + +- [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] + +- [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] + +- [!INCLUDE [offline](includes/dnim-cli-offline.md)] + +- [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] + +- [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] + +- [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +## Results + +## Examples + +- Display release information for all products: + + ```console + dnim-win-[x86|x64|arm64] query products + ``` + +- Display release information for all products that are not end-of-life: + + ```console + dnim-win-[x86|x64|arm64] query products --esp eol + ``` + +- Display release information for .NET 7.0 and 9.0 + + ```console + dnim-win-[x86|x64|arm64] query products --pv 7.0 --pv 9.0 + ``` + +## See also diff --git a/docs/core/additional-tools/dnim-cli-scan.md b/docs/core/additional-tools/dnim-cli-scan.md new file mode 100644 index 0000000000000..67b173a934516 --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-scan.md @@ -0,0 +1,88 @@ +--- +title: dnim scan command +description: The scan command identifies .NET installations. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim scan + +## Name + +`dnim-win-[x86|x64|arm64] scan` - Detects, classifies, and reports .NET installations on a device. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] scan [-a|--accept-license] [-b|--include-bin-deployed-installs] + [--epv|--except-product-version ] + [--esp|--except-support-phase ] + [-l|--log-file ] [-o|--output-file ] [--offline ] + [--output-format ] [--pv|--product-version ] + [--sp|--support-phase ] + [-v|--verbosity ] + +dnim-win-[x86|x64|arm64] scan -?|-h|--help +``` + +## Description + +The `scan` command detects, classifies and reports .NET installations on Windows. MSIs and bundles are detected by default. Bin deployed (xcopy/zip) installs under `Program Files` can be detected using the `--include-bin-deployed-installs` option. + +Results can be filtered using the product version and support phase options to only include installations matching the specified criteria. Results are written to both the console and diagnostic log. Additional output formats are available and include JSON, HTML and CSV. + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [bin-deployed-installs](includes/dnim-cli-include-bin-deployed-installs.md)] + +- [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] + +- [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] + +- [!INCLUDE [log-file](includes/dnim-cli-log-file.md)] + +- [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] + +- [!INCLUDE [offline](includes/dnim-cli-offline.md)] + +- [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] + +- [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] + +- [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +## Results + +The results contain a summary of each installation, including its type (MSI, bundle, etc.), the .NET product to which it belongs and its current support phase. It may also include information about its origin. The example below contains three installations: two bundles and one MSI. The targeting pack MSI is shared between both SDK installs and multiple instances of Visual Studio: 17.14.37502 and 17.14.37110. + +| Display Name | Product | Release | Type | Support | Installed By | +| --- | --- | --- | --- | --- | --- | +| Microsoft .NET SDK 6.0.136 (x64) | 6.0 | 6.0.136 | Bundle | EOL | | +| Microsoft .NET SDK 6.0.428 (x64) | 6.0 | 6.0.428 | Bundle | EOL | | +| Microsoft Windows Desktop Targeting Pack - 6.0.36 (x64) | 6.0 | 6.0.36 | Msi | EOL | VS 17.14.37502, VS 17.14.37110, Microsoft .NET SDK 6.0.428 (x64), Microsoft .NET SDK 6.0.136 (x64) | + +## Examples + +- Scan and report all .NET installations: + + ```console + dnim-win-[x86|x64|arm64] scan + ``` + +- Scan and report .NET installations that are in active support: + + ```console + dnim-win-[x86|x64|arm64] scan --sp active + ``` + +- Scan for end-of-life (EOL) installations of .NET and write the results to an HTML file: + + ```console + dnim-win-[x86|x64|arm64] scan --sp eol -o report.html --output-format html + ``` + +## See also diff --git a/docs/core/additional-tools/dnim-cli-trace.md b/docs/core/additional-tools/dnim-cli-trace.md new file mode 100644 index 0000000000000..f9125db47fd63 --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-trace.md @@ -0,0 +1,61 @@ +--- +title: dnim trace command +description: The trace command identifies .NET processes. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim trace + +## Name + +`dnim-win-[x86|x64|arm64] trace` - Identifies .NET and .NET Core processes. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] trace [-a|--accept-license] + [-o|--output-file ] + [--output-format ] + [-v|--verbosity ] + +dnim-win-[x86|x64|arm64] trace -?|-h|--help +``` + +## Description + +The `trace` command processes kernel traces to identify running .NET and .NET Core processes. + +The command examines a number of events, including `ProcessDCStart`, `RuntimeStart`, and `ImageLoad` to identify running processes that depend on the global runtime under Program Files, including .NET SDKs. + +The command can differentiate between single file and self-contained applications. While non-FDD processes may not be impacted by shared installations of .NET, the information provides a more complete view of a device, allowing administrators to make informed decisions. + +> [!IMPORTANT] +> The command requires administrator access to process kernel traces. + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] + +- [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +## Results + +The results include information about each process (PID and start time) and the shared framework versions that were loaded. The table below contains examples of what the command reports. Note that some columns were removed for brevity. + +| Process | PID | Runtime Family | CLR | CLR Version | Frameworks and SDKs | +| --- | --- | --- | --- | --- | --- | +| dnim-win-x64 | 12016 | Net, SingleFile | dnim-win-x64.exe | 8.0.3026.36720 | | +| dotnet | 47852 | Net | coreclr.dll | 10.0.1126.37416 | Microsoft.NETCore.App (10.0.11), sdk (10.0.400-preview.0.26322.102) | +| pwsh | 37364 | Net | coreclr.dll | 10.0.1026.32716 | | + +1. DNIM is a single file application and the CLR is reported under the application host. +2. The `dotnet` process is an FDD application running on .NET 10.0.11. Note that the process also loaded modules from the .NET SDK. +3. The `pwsh` process is a self-contained application. The diagnostic log confirms this and shows a local copy of `coreclr.dll` was loaded. The version is also different from the global copy loaded by `dotnet` (second row). +`[2026-08-17 08:31:59.175]d0000: Event: RuntimeStart, timestamp: 08/17/2026 08:31:57, PID: 37364, path: C:\Program Files\PowerShell\7\coreclr.dll` + +## See also diff --git a/docs/core/additional-tools/dnim-cli-uninstall.md b/docs/core/additional-tools/dnim-cli-uninstall.md new file mode 100644 index 0000000000000..0d2a5ce787a5e --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-uninstall.md @@ -0,0 +1,188 @@ +--- +title: dnim uninstall command +description: The uninstall command removes .NET installations. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim uninstall + +## Name + +`dnim-win-[x86|x64|arm64] uninstall` - Detects, classifies, and removes .NET installations on a device. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] uninstall [-a|--accept-license] + [-b|--include-bin-deployed-installs] + [--crsp|--create-system-restore-point] + [--epv|--except-product-version ] + [--esp|--except-support-phase ] + [--ignore-dependents] + [--it|--install-type ] + [--klpv|--keep-latest-product-version ] + [--klsp|--keep-latest-support-phase ] + [-l|--log-file ] + [--log-extra-debug-information, --lx] + [--no-wua] + [-o|--output-file ] + [--offline ] + [--offline-revocation-checks] + [--output-format ] + [--pv|--product-version ] + [--remove-EOL-versions-from-VS] + [--remove-orphaned-installs] + [--ri|report-issues] + [--rv|--release-version ] + [--sp|--support-phase ] + [-v|--verbosity ] + [--verify-signatures ] + [--what-if] + +dnim-win-[x86|x64|arm64] uninstall -?|-h|--help +``` + +## Description + +The `uninstall` command attempts to remove all copies of .NET from the device. This may not be possible if installations are shared with other products like Visual Studio (see [Managed .NET installations on Windows](dnim-net-installs.md)). + +Various options can be used to target specific installations. For example, an administrator may want to remove all copies of .NET that are not in active support to comply with their organization's internal policies. + +> [!IMPORTANT] +> This command must be run with elevated privileges to make changes. Include the `--what-if` option if you want to evaluate the results without making changes. + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [bin-deployed-installs](includes/dnim-cli-include-bin-deployed-installs.md)] + +- [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] + +- [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] + +- [!INCLUDE [ignore-dependents](includes/dnim-cli-ignore-dependents.md)] + +- [!INCLUDE [install-type](includes/dnim-cli-install-type.md)] + +- [!INCLUDE [keep-latest-product-version](includes/dnim-cli-keep-latest-product-version.md)] + +- [!INCLUDE [keep-latest-support-phase](includes/dnim-cli-keep-latest-support-phase.md)] + +- [!INCLUDE [log-file](includes/dnim-cli-log-file.md)] + +- [!INCLUDE [log-extra-debug-information](includes/dnim-cli-log-extra-debug-information.md)] + +- [!INCLUDE [no-wua](includes/dnim-cli-no-wua.md)] + +- [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] + +- [!INCLUDE [offline](includes/dnim-cli-offline.md)] + +- [!INCLUDE [offline-revocation-checks](includes/dnim-cli-offline-revocation-checks.md)] + +- [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] + +- [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] + +- [!INCLUDE [remove-EOL-versions-from-VS](includes/dnim-cli-remove-EOL-versions-from-VS.md)] + +- [!INCLUDE [remove-orphaned-installs](includes/dnim-cli-remove-orphaned-installs.md)] + +- [!INCLUDE [report-issues](includes/dnim-cli-report-issues.md)] + +- [!INCLUDE [release-version](includes/dnim-cli-release-version.md)] + +- [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +- [!INCLUDE [verify-signatures](includes/dnim-cli-verify-signatures.md)] + +- [!INCLUDE [what-if](includes/dnim-cli-what-if.md)] + +## Results + +The results are similar to those produced by the [`scan`](dnim-cli-scan.md) command with the addition of an extra column indicating whether or not an installation can be removed. The excerpt below was generated from running `dnim-win-x64.exe uninstall --pv 8.0 --klsp active --klsp maintenance --what-if`. The command specifically targets removing .NET 8.0, but will retain installations if they are the latest known release and the support phase is either `active` or `maintenance`. The 3.1 and 6.0 SDKs are excluded because they are not part of .NET 8.0. The 8.0.130 SDK is also not removed because it was the latest known release version when the command was executed. + +| Display Name | Release | Type | Support | Uninstall Action | +| --- | --- | --- | --- | --- | +| Microsoft .NET Core SDK 3.1.426 (x64) | 3.1.426 | Bundle | EOL | NoneProductVersionExcluded | +| Microsoft .NET SDK 6.0.136 (x64) | 6.0.136 | Bundle | EOL | NoneProductVersionExcluded | +| Microsoft .NET SDK 8.0.130 (x64) | 8.0.130 | Bundle | Maintenance | NoneLatestReleasedVersion | + +## Policy Evaluation + +DNIM generates a set of internal policies based on the command-line options. Every installation is evaluated against the policies. Evalution stops when a policy applies to an installation. Installations are removed if none of the policies apply. + +The table below contains a general overview of the policies generated from the commandline options. + +| Policy | Description | +| --- | --- | +| Product Version | Include or exclude installations based on their product version. | +| Support Phase | Include or exclude installations based on their support phase. | +| Release Version | Include or exclude installations based on their release version. | +| Retention | Retain installations based on product version or support phase. | +| Install Type | Include or exclude installations based on their install type. | +| Orphaned Installations | Consider orphaned installations for removal. | +| Visual Studio EOL | Considers installations marked as out-of-support in Visual Studio. | +| Dependency Provider | Exclude installations if other products depend on them. | +| Signing | Exclude or include installations based on whether packages are signed. | + +### Example + +Consider the following command-line: `dnim-win-x64 uninstall --pv 6.0`. The command only considers installations +associated with .NET 6.0 for removal. When the tool evaluates a .NET 7.0 installation, the product version policies will apply and exclude it. + +## Policy Results + +Every installation is assigned an action based on the policies that were evaluated. The table belows contains +a description for the various policy actions returned by the `uninstall` command. Policy actions with a +`None` prefix indicate the installation will not be removed. + +| Action | Policy | Description | +| --- | --- | --- | +| NoneNotOutOfSupport | Support Phase | The product is still considered to be in support based on the published release information. | +| NoneLatestReleasedVersion | Retention | The installation is the latest known released version and will be retained. | +| NoneNotOutOfSupportInVisualStudio | Visual Studio EOL | The product is out of support, but not all instances of Visual Studio considers it out-of-support. This may indicate that product information in the Visual Studio catalogs are outdated or inconsistent. | +| NoneProductVersionExcluded | Product Version | The product will be retained because its version excluded it from being removed. | +| NoneProductVersionNotFound | Product Version | The installation belongs to an unknown .NET product version. This can happen when the .NET releases JSON data has not been updated or an old copy of data is being used. | +| NoneSupportPhaseExcluded | Support Phase | The installation will be retained because its support phase is excluded. | +| NoneInstallPlatformExcluded | Install Type | The installation will be retained because its platform is excluded. | +| NoneInstallTypeExcluded | Install Type | The installation will be retained because its type is excluded. For example, the user only specified MSIs to be removed. | +| NoneInstallComponentExcluded | Install Type | The installation will be retained because its component is excluded. For example, only SDK installations were selected, but the install is part of a shared framework like ASP.NET Core. | +| NoneReleaseVersionExcluded | Release Version | The installation will be retained because it does not match the specified release version. | +| NoneDependentsExist | Dependency Provider | The installation will be retained because another product still depends on it. For example, the same MSI was installed by both a standalone bundle and one or more Visual Studio instances. | +| NoneUnsigned | Signing | The installation package on disk is not signed. | +| Uninstall | N/A | The installation was successfully evaluated agaisnt all active policies and will be removed. | +| UninstallParentDependency | N/A | The installation will be removed because a parent dependency will be removed, e.g., an MSI will be removed becasue the .NET bundle to which it belongs will be removed. | +| UninstallOrphanedByVs | N/A | The installation will be removed because it was orphaned by Visual Studio. | +| NoneEolVersion | N/A | The product associated with an installation is EOL and won't be updated. | +| NoneDiscontinuedSdk | N/A | The .NET product is still supported, but the latest updates no longer include the specific feature band. | +| NoneNoComponent | N/A | The release data does not have any component data about the SDK or runtime. | +| NoneNoComponentFile | N/A | The release data includes component data, but not information about individual installation files. | + +## Examples + +- Remove all .NET installations that are end-of-life (EOL). + + ```console + dnim-win-[x86|x64|arm64] uninstall --sp eol + ``` + +- Remove all .NET installs, but retain the latest version for products that are in active support. + + ```console + dnim-win-[x86|x64|arm64] uninstall --klsp active + ``` + + Assume .NET 9 and 8 are in active support and the latest releases include 9.0.19 and 8.0.30. If a device contains .NET 9.0.17 and 8.0.30, the command will remove 9.0.17, but retain 8.0.30. + +- Remove all SDK bundles if their release version is less than 10.0.0. + + ```console + dnim-win-[x86|x64|arm64] uninstall --it sdk --it bundle --rv [,10.0.0) + ``` + +## See also diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md new file mode 100644 index 0000000000000..f962f66d01ec3 --- /dev/null +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -0,0 +1,88 @@ +--- +title: dnim scan command +description: The scan command identifies .NET installations. +author: joeloff +ms.date: 08/11/2026 +--- + +# dnim scan + +## Name + +`dnim-win-[x86|x64|arm64] scan` - Detects, classifies, and reports .NET installations on a device. + +## Synopsis + +```dotnetcli +dnim-win-[x86|x64|arm64] scan [-a|--accept-license] [-b|--include-bin-deployed-installs] + [--epv|--except-product-version ] + [--esp|--except-support-phase ] + [-l|--log-file ] [-o|--output-file ] [--offline ] + [--output-format ] [--pv|--product-version ] + [--sp|--support-phase ] + [-v|--verbosity ] + +dnim-win-[x86|x64|arm64] scan -?|-h|--help +``` + +## Description + +The `scan` command detects, classifies and reports .NET installations on Windows. MSIs and bundles are detected by default. Bin deployed (xcopy/zip) installs under `Program Files` can be detected using the `--include-bin-deployed-installs` option. + +Results can be filtered using the product version and support phase options to only include installations matching the specified criteria. Results are written to both the console and diagnostic log. Additional output formats are available and include JSON, HTML and CSV. + +## Options + +- [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] + +- [!INCLUDE [bin-deployed-installs](includes/dnim-cli-include-bin-deployed-installs.md)] + +- [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] + +- [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] + +- [!INCLUDE [log-file](includes/dnim-cli-log-file.md)] + +- [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] + +- [!INCLUDE [offline](includes/dnim-cli-offline.md)] + +- [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] + +- [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] + +- [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] + +- [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] + +## Results + +The results contain detailed information about each installation, including its type (MSI, bundle, etc.), the .NET product to which it belongs and its current support phase. It may also include information about its origin. The example below contains three installations: two bundles and one MSI. The targeting pack MSI is shared between both SDK installs and multiple instances of Visual Studio: 17.14.37502 and 17.14.37110. + +| Display Name | Product | Release | Type | Support | Installed By | +| --- | --- | --- | --- | --- | --- | +| Microsoft .NET SDK 6.0.136 (x64) | 6.0 | 6.0.136 | Bundle | EOL | | +| Microsoft .NET SDK 6.0.428 (x64) | 6.0 | 6.0.428 | Bundle | EOL | | +| Microsoft Windows Desktop Targeting Pack - 6.0.36 (x64) | 6.0 | 6.0.36 | Msi | EOL | VS 17.14.37502, VS 17.14.37110, Microsoft .NET SDK 6.0.428 (x64), Microsoft .NET SDK 6.0.136 (x64) | + +## Examples + +- Scan and report all .NET installations: + + ```console + dnim-win-[x86|x64|arm64] scan + ``` + +- Scan and report .NET installations that are in active support: + + ```console + dnim-win-[x86|x64|arm64] scan --sp active + ``` + +- Scan for end-of-life (EOL) installations of .NET and write the results to an HTML file: + + ```console + dnim-win-[x86|x64|arm64] scan --sp eol -o report.html --output-format html + ``` + +## See also diff --git a/docs/core/additional-tools/dnim-logs.md b/docs/core/additional-tools/dnim-logs.md new file mode 100644 index 0000000000000..9715157a5b319 --- /dev/null +++ b/docs/core/additional-tools/dnim-logs.md @@ -0,0 +1,77 @@ +--- +title: .NET Install Manager Logging +description: An overview of various logs provided by DNIM. +author: joeloff +ms.date: 08/11/2026 +--- + +# Logging + +DNIM provides a rich set of logs to assit with diagnosing and troubleshooting issues. + +## Console + +DNIM always generates output to the console. The default verbosity is `normal`. It is recommended to set the verbosity level to `quiet` when deploying DNIM using Configuration Manager to avoid disrupting users. + +## Diagnostic file log + +DNIM always generates a diagnostic log in the current user's `%TEMP%` directory. The default filename consists of the `dnim` prefix followed by the date and time, for example, `dnim_20260811_203922.log` indicates the log was generated on August 11, 2026 at 8:39:22 pm. + +The contents of the log varies based on the command and the state of the machine. The start of the log will include information like the version and the command that was executed. + +Each line consists of a timestamp, message type and event ID followed by a detailed message. + +```console +[2026-08-11 20:39:23.495]d1000: DNIM started, command: c:\Users\user1\Downloads\dnim-win-x64.exe scan, PID: 18800, PPID: 34220 (C:\WINDOWS\System32\cmd.exe), SID: S-1-5-21-2127521184-1604012920-1887927527-5663403. +``` + +In the preceeding example, `d1000` indicates that a diagnostic message with event ID 1000 was logged. Messages can also be prefixed with `i` (informational) or `e` (error). Only messages with non-zero event ID are sent to the Windows Event log. + +## Registry + +DNIM tracks information pertaining to it's last execution in the registry. The data is stored under `HKCU\Software\Microsoft\DNIM` or `HKLM\Software\Microsoft\DNIM` (if the command was run with elevated permissions). + +```console +D:\>reg query HKCU\Software\Microsoft\DNIM /s + +HKEY_CURRENT_USER\Software\Microsoft\DNIM + LastRunCommandLine REG_SZ c:\Users\user1\Downloads\dnim-win-x64.exe --help + LastRun REG_SZ 08/12/2026 03:40 + LastRunDate REG_SZ 08/12/2026 + LastRunTime REG_SZ 3:40:04.1996353 + +HKEY_CURRENT_USER\Software\Microsoft\DNIM\License + Accepted REG_DWORD 0x1 + Type REG_SZ prerelease +``` + +## Events + +Commands that modify a machine's state by removing or updating .NET will log events to the Windows Application log using `DNIM` as the event source. + +![DNIM Start Event](./media/dnim/eventlog.png) + +### Event IDs + +| Event ID | Remarks | +| --- | --- | +| 1000 | The application started and recorded its command and process details. | +| 1001 | An application configuration or environment problem was encountered. | +| 1002 | An installer signature was verified or signature verification failed. | +| 1003 | A general application error or exception occurred. | +| 1100 | An installation was evaluated against the configured policies. | +| 1101 | One or more installations require remediation. | +| 1200 | An uninstall operation started. | +| 1210 | An uninstall operation completed and reported its exit code. | +| 1299 | An uninstall operation threw an exception and failed. | +| 1300 | A system restore point was created. | +| 1301 | The System Restore service was not initialized. | +| 1310 | A system restore point was ended successfully. | +| 1399 | A System Restore initialization, creation, or completion operation failed. | +| 1400 | The Windows Update Agent service was started. | +| 1410 | The Windows Update Agent service was stopped or an attempt to stop it failed. | +| 1499 | The Windows Update Agent service failed to start. | +| 1500 | An update operation started. | +| 1510 | An update operation completed and reported its exit code. | +| 1550 | An update operation was skipped. This event ID is not currently used. | +| 1599 | An update could not be acquired or the update operation threw an exception. | diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md new file mode 100644 index 0000000000000..6242029e01119 --- /dev/null +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -0,0 +1,129 @@ +--- +title: Managed .NET installations on Windows +description: Provides a technical overview of .NET installations on windows, including composition and reference counting. +author: joeloff +--- + +# Managed .NET installations on Windows + +Partially removed .NET installations are a common reason why vulnerability scanning software like Micorosft Defender Vulnerability Management will report a device. Understanding how .NET installations work can assist administrators with investigating reports and taking remedial actions. + +On Windows, .NET components like the runtime and SDK consist of multiple MSIs. Individual MSIs are not directly distributed. Instead, they are chained together to create bundles. + +## Aquiring .NET on Windows + +- Standalone bundles (EXEs) can be downloaded from [.NET](https://dotnet.microsoft.com/download). +- WinGet provides packages that contain the .NET bundles. +- Servicing updates distrubute the bundles through Microsoft Update using automatic updates, WSUS and the Windows Update Catalog. +- Independent software vendors (ISVs) may redistribute .NET bundles as part of their software. +- OEMs sometimes include preinstalled copies of .NET bundles in the factory images of new devices. +- Some Azure marketplace images of Windows include preinstalled copies of the bundles. +- Third party package managers like Chocolatey also distribute the .NET bundles. +- Enterprises sometimes repackage the bundles using proprietary packages for internal distribution. +- Some .NET application hosts may also direct users to download and install missing runtime bundles. + +Visual Studio can also be used to acquire .NET and uses the same MSIs as the standalone bundles. + +> [!NOTE] +> The .NET SDK bundle shipped with Visual Studio until 16.2. Starting with .NET Core 3.0 in Visual Studio 16.3, the SDK bundles were replaced with the individual .NET MSIs. + +## Upgrades + +.NET supports upgrades between patch versions within a major/minor release. .NET 8.0.7 will upgrade previous releases like 8.0.4 or 8.0.0, including prerelease versions, but won't upgrade a previous major release like .NET 7.0. The .NET SDK supports upgrades between patches within a feature band. The 8.0.100 SDK can be upgraded to 8.0.103, but the 8.0.3xx SDK will not upgrade the 1xx or 2xx feature bands. + +The majority of upgrades are handled at the bundle level. The previous version is only removed once the new version is installed. There are two exceptions: the .NET host and ASP.NET Core Module MSIs are updated in place. + +Starting with .NET 8, users have the option to [defer](https://learn.microsoft.com/en-us/dotnet/core/install/windows#choose-when-previous-versions-are-removed) removing the version of a bundle. + +## Bundle composition and reference counting + +Bundles are composed from multiple MSIs, some of which are shared between multiple bundles. + +![.NET installer composition](media\dnim\dotnet-bundles.svg) + +- The runtime bundle contains three MSIs that also ship in the desktop runtime and SDK bundles. +- The desktop bundle includes an additioanl MSI that is shared with the SDK bundle. +- The SDK includes additional MSIs that contain the CLI, templates and targeting packs used to create and build .NET applications. + +Shared MSIs are managed using reference counting. Every .NET MSI creates a registry key called a provider key that allows a bundle to register itself as a dependent. If an MSI is already installed, the bundle only updates the registration information. Bundles are unregistered when they're removed. The shared MSIs are only removed once there are no registered dependents. + +The registry information below is an example of the .NET host MSI provider key. There are four registered dependents, including Visual Studio. + +```console +HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64 + (Default) REG_SZ {8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E} + Version REG_SZ 80.40.55332 + DisplayName REG_SZ Microsoft .NET Host - 10.0.10 (x64) + +HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\VS.{AEF703B8-D2CC-4343-915C-F54A30B90937} + +HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{609A456D-467D-4077-9BA2-B6404F1B1163} + +HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F} + +HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{FD5EA214-C690-466F-B8FB-1741881913F9} +``` + +> [!NOTE] +> Individual MSIs become orphaned when depedents remain registered after a bundle is removed, for example, when the uninstall is interrupted. + +> [!NOTE] +> Visual Studio uses a well-known value, `VS.{AEF703B8-D2CC-4343-915C-F54A30B90937}`, to register itself as a dependent. The actual reference count is determined by checking the installation manifest for each Visual Studio instance. + +## Bin deployed installations + +Bin deployed installations refer to copies of .NET that aren't associated with an MSI. This can be achieved by running the install scripts as an administrator and setting the installation directory to `Program Files\dotnet'. This can complicate remediation. Scanners will report vulnerabilities, but administrators won't find MSIs that can be uninstalled. DNIM is able to detect bin deployed installs. + +## Detection + +DNIM relies on a number of heuristics to identify bundles and MSIs associated with .NET. Accurately detecting installations is critical to successfully remediate a non-complaint devices. + +### Bundles + +Bundles are identified using their display names and file information stored in the registry. Additional checks are performed on executables to ensure they are valid installers. This informatio is also compared against the JSON data .NET publishes for each release. + +### MSI Detection + +DNIM performs an exhaustive search against the installer component data stored in the registery under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components` to identify .NET MSIs. + +The installer service tracks each component registry ey contains the component ID while its values contain MSI product codes. Both the component ID and product code is stored as packed GUIDs. The example below is of the component associated with `dotnet.exe`. + +```console +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBB993545ADD68342A9E16F83B5CA481 + 40A3E8A8CB38EDC4299598B366C6A11B REG_SZ C:\Program Files\dotnet\dotnet.exe + A75437C333A10ED46B2CF6AB78E7F1FC REG_SZ C:\Program Files (x86)\dotnet\dotnet.exe + 79D2396D1F638B04C9CDAC38562B0100 REG_SZ C:\Program Files\dotnet\dotnet.exe + EA6D9CBF69367CF4CB81005882631FD6 REG_SZ C:\Program Files (x86)\dotnet\dotnet.exe + 872D9C61B8AA60F47A4CDF137C8523A3 REG_SZ C:\Program Files (x86)\dotnet\dotnet.exe + 6235DF10DB18AED4F910D396BBDD7AE5 REG_SZ C:\Program Files\dotnet\dotnet.exe + 0370151E43A53FE48B564853D1B81FAB REG_SZ C:\Program Files\dotnet\dotnet.exe + F6D22817F79056B46B45655C7495EE9A REG_SZ C:\Program Files (x86)\dotnet\dotnet.exe + D512842CB6C6A404BAE605D564042E50 REG_SZ C:\Program Files\dotnet\dotnet.exe +``` + +### Bin deployed installs + +Because DNIM performs an exhaustive search of installer components, files under `Program Files\dotnet` not associated with an MSI are classified as bin deployed installations. + +## Classification + +Incorrect classification of installations can result in removing or retaining the wrong installation, potentially breaking applications or leaving devices in a non-compliant state. + +Once a product (e.g., NET 10) is identified, additional information like the release (e.g., 10.0.4) and support phase (e.g., active)can be determined. This enables administrators to create flexible deployments. + +Installations are further classified according to the .NET components they represent, their architecure and type of installation. + +There are also a few special cases that are worth mentioning. + +### .NET Standard 2.1 + +Ensuring consistent behavior requires installations to define their product, release and support phase. The targeting pack for .NET Standard 2.1 presents an interesting challenge. It doesn't contain executable code and only provides reference assemblies for the APIs defined by the standard. The targeting pack first shipped as part of the .NET Core 3.0.100 SDK, but was included in every subsequent SDKs until .NET 10. While DNIM will classify the release and product under .NET Core 3.0, the support phase is always reported as active since it may be included in SDKs that are in active support. + +> [!NOTE] +> The .NET Standard 2.1 targeting pack was removed from the SDK installation in .NET 10. SDKs automatically download missing targeting packs using NuGet packages when building applications. + +### .NET SDK Feature bands + +In .NET Core 1.0 and 1.1, SDKs used a versioning scheme similar to the runime. The last SDK in .NET Core 1.1 was versioned as 1.1.14 and included the 1.1.13 runtime. + +SDK features bands were introduced in the 2.1.100 SDK to differentiate between supported features in Visual Studio. The SDK shipped as part of the .NET Core 2.0.5 release. The last 2.0 SDK was versioned as 2.1.202 and included in the 2.0.9 release. The first SDK to ship in .NET Core 2.1 was versioned as 2.1.300. In later releases, SDK feature bands always start at 100, e.g., 2.2.100, 3.0.100, etc. diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md new file mode 100644 index 0000000000000..8cb363d219550 --- /dev/null +++ b/docs/core/additional-tools/dnim-overview.md @@ -0,0 +1,26 @@ +--- +title: .NET Install Manager overview +description: An overview of the .NET Install Manager. This tool is a guided command-line tool to manage .NET installations. +author: joeloff +--- + +# .NET Install Manager overview + +The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove or update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. + +DNIM ships as a trimmed, single file .NET executable, making it easy to deploy across devices using tools like [Microsoft Configuration Manager](https://learn.microsoft.com/intune/configmgr/). + +> [!IMPORTANT] +> DNIM does not enforce specific policies. Administrators can use the command-line options to create deployments that best expresses their organizations's compliance policies. + +The tool is data driven and depends on the [release information](https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json) published for .NET. While internet access is required to download the latest release information and updates, administrators can prepare offline deployments for network restricted environments. + +## Support + +> [!IMPORTANT] +> Because DNIM is a single file application, new builds are regularly published to ensure the .NET runtime remains up to date. Any changes, including security fixes are documented in the release notes. Enterprise customers should contact their [customer support representative](https://engagecenter.microsoft.com/#view/Microsoft_AzureCXP_EngageHub/EngageHubMenu.MenuView/~/helpSupport) to address concerns or report issues. + +## See also + +* [Managed .NET installations on Windows](dnim-net-installs.md) +* [Logging](dnim-logs.md) diff --git a/docs/core/additional-tools/includes/dnim-cli-accept-license.md b/docs/core/additional-tools/includes/dnim-cli-accept-license.md new file mode 100644 index 0000000000000..003a0d0b668f1 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-accept-license.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/11/2026 +ms.topic: include +--- +**`-a|--accept-license`** + +Automatically accept the license agreement. On first run, the user will be prompted to accept the license. The command will fail if the verbosity is set to `quiet` and the tool is executed for the first time. Administrators should include this option when deploying DNIM across their network. diff --git a/docs/core/additional-tools/includes/dnim-cli-create-system-restore-point.md b/docs/core/additional-tools/includes/dnim-cli-create-system-restore-point.md new file mode 100644 index 0000000000000..013be43129583 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-create-system-restore-point.md @@ -0,0 +1,9 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--csrp|--create-system-restore-point`** + +Create a system restore point before making changes to the machine. This option has no effect when System Restore isn't supported, such as on Windows Server, or when the service is disabled. + +Refer to the [System Restore](https://support.microsoft.com/Windows/Experience/Backup-Recovery/system-restore) documentation for additional information. diff --git a/docs/core/additional-tools/includes/dnim-cli-cve.md b/docs/core/additional-tools/includes/dnim-cli-cve.md new file mode 100644 index 0000000000000..b2a644142a417 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-cve.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--cve `** + +Filter releases using the Common Vulnerabilities and Exposures (CVE) identifier. Only releases that address the specified CVEs are included. Specify the option once for each CVE. + +> [!IMPORTANT] +> This option depends on the release information published by .NET. diff --git a/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md b/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md new file mode 100644 index 0000000000000..1e51593b65225 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--duwo|--download-updates-when-offline`** + +Allow missing updates to be downloaded when offline. + +> [!TIP] +> This option is useful when DNIM is deployed offline, but Administrators still want devices to update even when they are not connected to a corporate network. For example, a user might take their laptop home before DNIM is deployed. \ No newline at end of file diff --git a/docs/core/additional-tools/includes/dnim-cli-except-product-version.md b/docs/core/additional-tools/includes/dnim-cli-except-product-version.md new file mode 100644 index 0000000000000..89276394c9f2d --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-except-product-version.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--epv|--except-product-version `** + +Exclude installations that match the specified product version. Product versions contain a major and minor version, such as `2.2` or `5.0`. Specify the option once for each product version. + +> [!NOTE] +> The `--product-version` and `--except-product-version` options are mutually exclusive. diff --git a/docs/core/additional-tools/includes/dnim-cli-except-support-phase.md b/docs/core/additional-tools/includes/dnim-cli-except-support-phase.md new file mode 100644 index 0000000000000..3e17265ac68fe --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-except-support-phase.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--esp|--except-support-phase `** + +Exclude installations that match the specified support phase. Specify the option once for each support phase. + +> [!NOTE] +> The `--support-phase` and `--except-support-phase` options are mutually exclusive. diff --git a/docs/core/additional-tools/includes/dnim-cli-ignore-dependents.md b/docs/core/additional-tools/includes/dnim-cli-ignore-dependents.md new file mode 100644 index 0000000000000..6d599bee53645 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-ignore-dependents.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--ignore-dependents`** + +Ignore installation dependencies that would otherwise prevent packages from being removed. diff --git a/docs/core/additional-tools/includes/dnim-cli-include-bin-deployed-installs.md b/docs/core/additional-tools/includes/dnim-cli-include-bin-deployed-installs.md new file mode 100644 index 0000000000000..58704e0063ec3 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-include-bin-deployed-installs.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`-b|--include-bin-deployed-installs`** + +Search for bin-deployed installations under Program Files. This option will incur additional overhead to verify installations that aren't backed by an MSI. diff --git a/docs/core/additional-tools/includes/dnim-cli-include-installers.md b/docs/core/additional-tools/includes/dnim-cli-include-installers.md new file mode 100644 index 0000000000000..a293a1696d694 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-include-installers.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--include-installers`** + +Download installation packages when creating or updating a layout. diff --git a/docs/core/additional-tools/includes/dnim-cli-include-previews.md b/docs/core/additional-tools/includes/dnim-cli-include-previews.md new file mode 100644 index 0000000000000..ec619586f23f1 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-include-previews.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--include-previews`** + +Include preview versions when downloading installation packages. diff --git a/docs/core/additional-tools/includes/dnim-cli-install-type.md b/docs/core/additional-tools/includes/dnim-cli-install-type.md new file mode 100644 index 0000000000000..31cbf58c4a625 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-install-type.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--it|--install-type `** + +Target installations based on their package type, component, or architecture. You can specify this option multiple times. For example, use `--it sdk --it x64` to only target 64-bit SDK installations. diff --git a/docs/core/additional-tools/includes/dnim-cli-keep-latest-product-version.md b/docs/core/additional-tools/includes/dnim-cli-keep-latest-product-version.md new file mode 100644 index 0000000000000..db401aff93635 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-keep-latest-product-version.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--klpv|--keep-latest-product-version `** + +Keep an installation when it matches the specified product version and is the latest known version of that product. Specify the option once for each product version. diff --git a/docs/core/additional-tools/includes/dnim-cli-keep-latest-support-phase.md b/docs/core/additional-tools/includes/dnim-cli-keep-latest-support-phase.md new file mode 100644 index 0000000000000..e4c874ec08701 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-keep-latest-support-phase.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--klsp|--keep-latest-support-phase `** + +Keep an installation when it matches the specified support phase and is the latest known version. Specify the option once for each support phase. diff --git a/docs/core/additional-tools/includes/dnim-cli-latest.md b/docs/core/additional-tools/includes/dnim-cli-latest.md new file mode 100644 index 0000000000000..a8bc9d5fbbf59 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-latest.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--latest`** + +Include only the latest release of each product. diff --git a/docs/core/additional-tools/includes/dnim-cli-layout-directory.md b/docs/core/additional-tools/includes/dnim-cli-layout-directory.md new file mode 100644 index 0000000000000..374751cc879ac --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-layout-directory.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--layout-directory `** + +Specify the path to the layout directory. The path can be a local directory or a UNC path. diff --git a/docs/core/additional-tools/includes/dnim-cli-log-extra-debug-information.md b/docs/core/additional-tools/includes/dnim-cli-log-extra-debug-information.md new file mode 100644 index 0000000000000..7b4009eb83f05 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-log-extra-debug-information.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--lx|--log-extra-debug-information`** + +Enable additional debug logging when directly executing an MSI. This option doesn't set the Windows Installer logging policy and doesn't affect MSIs executed as part of a bundle. diff --git a/docs/core/additional-tools/includes/dnim-cli-log-file.md b/docs/core/additional-tools/includes/dnim-cli-log-file.md new file mode 100644 index 0000000000000..2b90546beb99e --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-log-file.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`-l|--log-file `** + +Specify the path of the log file. By default, DNIM creates a timestamped log file in the user's temporary directory. diff --git a/docs/core/additional-tools/includes/dnim-cli-no-wua.md b/docs/core/additional-tools/includes/dnim-cli-no-wua.md new file mode 100644 index 0000000000000..e6b051893b39b --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-no-wua.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--no-wua`** + +Temporarily stop the Windows Update Agent service when executing installation packages. DNIM stops the service only if it's running and restarts it only if DNIM stopped it. The option is intended to minimize the impact from other updates that may interfere with updating .NET. + +> [!CAUTION] +> DNIM will make a best effort to restart WUA. It is possible for DNIM to exit abruptly before it is able to restart WUA if the process is killed. This could leave a device in a vulnerable state. diff --git a/docs/core/additional-tools/includes/dnim-cli-offline-revocation-checks.md b/docs/core/additional-tools/includes/dnim-cli-offline-revocation-checks.md new file mode 100644 index 0000000000000..55c63e211e8db --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-offline-revocation-checks.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--offline-revocation-checks`** + +Use cached certificate revocation lists when verifying file signatures. Use this option on machines with restricted network access. diff --git a/docs/core/additional-tools/includes/dnim-cli-offline.md b/docs/core/additional-tools/includes/dnim-cli-offline.md new file mode 100644 index 0000000000000..f58ae832eb34f --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-offline.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--offline `** + +Use files from the specified layout directory instead of retrieving required files from the internet. diff --git a/docs/core/additional-tools/includes/dnim-cli-output-file.md b/docs/core/additional-tools/includes/dnim-cli-output-file.md new file mode 100644 index 0000000000000..999d1178ea21f --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-output-file.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`-o|--output-file `** + +Specify the full path of the file where DNIM writes the command results. diff --git a/docs/core/additional-tools/includes/dnim-cli-output-format.md b/docs/core/additional-tools/includes/dnim-cli-output-format.md new file mode 100644 index 0000000000000..207d6f17cb0f0 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-output-format.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--output-format `** + +Specify the output format for command results. The default format is `csv`. diff --git a/docs/core/additional-tools/includes/dnim-cli-product-version.md b/docs/core/additional-tools/includes/dnim-cli-product-version.md new file mode 100644 index 0000000000000..e2f183bdd3747 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-product-version.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--pv|--product-version `** + +Include installations that match the specified product version. Product versions contain a major and minor version, such as `2.2` or `5.0`. Specify the option once for each product version. By default, all known product versions are included. + +> [!NOTE] +> The `--product-version` and `--except-product-version` options are mutually exclusive. diff --git a/docs/core/additional-tools/includes/dnim-cli-release-version.md b/docs/core/additional-tools/includes/dnim-cli-release-version.md new file mode 100644 index 0000000000000..cfafd1f7872fc --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-release-version.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--rv|--release-version `** + +Include a specific version or range of versions using interval notation. For example, `[,7.0.3)` selects versions earlier than 7.0.3, and `[6.0.15]` selects only version 6.0.15. This option can't be combined with other installation filtering options. diff --git a/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md b/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md new file mode 100644 index 0000000000000..c05ba57a51cda --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--remove-EOL-versions-from-VS`** + +Remove end-of-life .NET installations installed by Visual Studio when every Visual Studio instance that installed them designates them as out of support. + +> [!NOTE] +> Starting with Visual Studio 15.9.27, 16.0.18, 16.4.13, 16.7.3 and 16.8 Preview 3, packages and components can be designated as out-of-support. Visual Studio will not reinstall out-of-support packages that have been manually uninstalled. diff --git a/docs/core/additional-tools/includes/dnim-cli-remove-orphaned-installs.md b/docs/core/additional-tools/includes/dnim-cli-remove-orphaned-installs.md new file mode 100644 index 0000000000000..93fc6d21a7efd --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-remove-orphaned-installs.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--remove-orphaned-installs`** + +Identify and remove orphaned installations that have dangling dependents. diff --git a/docs/core/additional-tools/includes/dnim-cli-report-issues.md b/docs/core/additional-tools/includes/dnim-cli-report-issues.md new file mode 100644 index 0000000000000..f30a52dde0c1a --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-report-issues.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--ri|--report-issues`** + +Return a nonzero exit code when the command succeeds but detects installations that require action. This option applies only when combined with `--what-if` and can be used by Intune detection scripts to trigger remediation. diff --git a/docs/core/additional-tools/includes/dnim-cli-restore-point-suffix.md b/docs/core/additional-tools/includes/dnim-cli-restore-point-suffix.md new file mode 100644 index 0000000000000..2ed8468a2fdc3 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-restore-point-suffix.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--rps|--restore-point-suffix `** + +Append a string of up to 128 characters to the system restore point description. diff --git a/docs/core/additional-tools/includes/dnim-cli-security.md b/docs/core/additional-tools/includes/dnim-cli-security.md new file mode 100644 index 0000000000000..d75670f442b9b --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-security.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--security`** + +Only include releases that contain security updates. diff --git a/docs/core/additional-tools/includes/dnim-cli-support-phase.md b/docs/core/additional-tools/includes/dnim-cli-support-phase.md new file mode 100644 index 0000000000000..6509e45987ae7 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-support-phase.md @@ -0,0 +1,10 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--sp|--support-phase `** + +Include only products, releases, or installations that match the specified support phase. Specify the option once for each support phase. By default, all support phases are included. + +> [!NOTE] +> The `--support-phase` and `--except-support-phase` options are mutually exclusive. diff --git a/docs/core/additional-tools/includes/dnim-cli-update-EOL-versions.md b/docs/core/additional-tools/includes/dnim-cli-update-EOL-versions.md new file mode 100644 index 0000000000000..d6747b25ebf35 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-update-EOL-versions.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--update-EOL-versions`** + +Update end-of-life installations to the latest available version. diff --git a/docs/core/additional-tools/includes/dnim-cli-update-discontinued-sdks.md b/docs/core/additional-tools/includes/dnim-cli-update-discontinued-sdks.md new file mode 100644 index 0000000000000..68292a8b17bdf --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-update-discontinued-sdks.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--update-discontinued-sdks`** + +Allow SDK updates when an installed feature band has been discontinued. DNIM selects the highest applicable feature band and patch. diff --git a/docs/core/additional-tools/includes/dnim-cli-verbosity.md b/docs/core/additional-tools/includes/dnim-cli-verbosity.md new file mode 100644 index 0000000000000..1db3e6d222631 --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-verbosity.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`-v|--verbosity `** + +Set the console output verbosity. Log files always contain diagnostic output. The default value is `normal`. diff --git a/docs/core/additional-tools/includes/dnim-cli-verify-signatures.md b/docs/core/additional-tools/includes/dnim-cli-verify-signatures.md new file mode 100644 index 0000000000000..792bb2bec722e --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-verify-signatures.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--verify-signatures `** + +Control signature verification before DNIM executes a bundle. Daily .NET builds are unsigned and aren't removed by default. The default value is `always`. diff --git a/docs/core/additional-tools/includes/dnim-cli-what-if.md b/docs/core/additional-tools/includes/dnim-cli-what-if.md new file mode 100644 index 0000000000000..3f362037f861b --- /dev/null +++ b/docs/core/additional-tools/includes/dnim-cli-what-if.md @@ -0,0 +1,7 @@ +--- +ms.date: 08/12/2026 +ms.topic: include +--- +**`--what-if`** + +Display the actions the command would take without making changes to the system. diff --git a/docs/core/additional-tools/index.md b/docs/core/additional-tools/index.md index f93ceb29dfe7f..285c544a0d55f 100644 --- a/docs/core/additional-tools/index.md +++ b/docs/core/additional-tools/index.md @@ -54,3 +54,7 @@ You can use [dotnet dev-certs](self-signed-certificates-guide.md) to create self ## .NET code coverage tool You can use [dotnet-coverage](dotnet-coverage.md) to collect [code coverage](../testing/unit-testing-code-coverage.md) from any .NET process. + +## .NET Install Manager + +Use the [.NET Install Manager](dnim-overview.md) to detect, uninstall or update .NET installations on Windows to remediate devices flagged by software vulnerability scanners. diff --git a/docs/core/additional-tools/media/dnim/dotnet-bundles.svg b/docs/core/additional-tools/media/dnim/dotnet-bundles.svg new file mode 100644 index 0000000000000..851205cfc128e --- /dev/null +++ b/docs/core/additional-tools/media/dnim/dotnet-bundles.svg @@ -0,0 +1,86 @@ + + + + + Windows x64 installer composition — .NET 10.0.11 / SDK 10.0.111 + + + Three shipping .exe bundles and the .msi packages they carry + + + + + + + + + + dotnet-runtime- + 10.0.11-win-x64.exe + + windowsdesktop-runtime- + 10.0.11-win-x64.exe + + dotnet-sdk-10.0.111-win-x64.exe + + + + + + Shared by all three + + + dotnet-host-10.0.11-win-x64.msi + dotnet-hostfxr-10.0.11-win-x64.msi + dotnet-runtime-10.0.11-win-x64.msi + + + + + + Desktop + SDK + + + windowsdesktop- + runtime-10.0.11- + win-x64.msi + + + + + + SDK only + + + dotnet-100templates-10.0.111-servicing.26373.116-win-x64.msi + dotnet-sdk-internal-10.0.111-servicing.26373.116-win-x64.msi + dotnet-apphost-pack-10.0.11-win-x64.msi + dotnet-targeting-pack-10.0.11-win-x64.msi + + + + + + Runtime bundle + + + Desktop runtime bundle + + + SDK bundle + + + + A package sits in the region formed by every bundle rectangle that overlaps it + + \ No newline at end of file diff --git a/docs/core/additional-tools/media/dnim/eventlog.png b/docs/core/additional-tools/media/dnim/eventlog.png new file mode 100644 index 0000000000000000000000000000000000000000..d1d7f34f33ea07454a59867481b995b467cafe18 GIT binary patch literal 22172 zcmeEtWmH?;_hx_sr4%Tolol;gC@t>pQi{8~yE_3|iWMuR#oZl>OMv1UEI=p@0fH0_ z5Hw8szP~kV{PPvP|d0;E4EC~SoOu)Z2$41}dxxLr-1ONzo|9&tA zT}!P103A*R8A&ZalY?b~AWB^z`)wCP7eAD!uviN@+1Y`xG!lU05yO<^V7!4WGaN|*z^`$-3Zs^?=&-bR=-*iX?yXXF z%vbvwb{Wq_X|YfV7_h=O8w1EMerdn}NWh{)<(8Iop?#6O4h7FQ7)zTfvgKIYWh5s( z6kv|idtD8?PWHcpmda8ch1_?X6+5O}SQJ?=QU2MUYAcC*eJj3A4-~wZCs7A9DLsJeM23y?d*2`p9iC0}d`o5ZjBtA13R1A4h;( zCyF2T2a5b=BPWT!$1GW_-R1@!(?HYAve>h8{Uio3=*mp$alwG4EuY|F|U zbh2JE_1jZ*WPOhRHlN&3oRSB4w{NPuTE6V5I<<^)MQyuYKB@=zh3D%7JWbrv`Ff8~ zhexgc$7D#LPTcu}jDQ}@Bo0cR<6mc|+rKb+nZ!=;1eg1;Lw;Uzmfx=BD-{qv6-ZsP z9D!ZkGCx~k7_5hOUCi?E>wbd}QVOiO@IR`_fJ689cZaoEZC&W&#jgv*zYoszt={j| zeAuG^0Gyr^PgV|N!WV5j6`NPCg@k-=RSd4T;XCDy;}BJ^RjHfcTbs5kCZDMU5jcV? zSMd0B`RtRZsv7*AUe$9-8WvJkDmF2rM`}lfxcjQN` z=$}NvdO%ON^)3+T4^FGN?>>dq*Ixpct+06EO*n-sDADA+JoB-~NC>idW@<|E_x)wg zRzuGHRZfXG3MQVM1KT)vSL^Mr@`1&@G?gG7G+e#ryZ!?V$?Fun6i&bego0<^etCOB zgv|5j18#GND7bdsEq}lIsXMjB6#QA`4yJ#76LResaJebaaeT#|dz5|0$BNoV?hZ5M z6f$+)m7GnMxe7QcMCFWt_kgI%ik+)^m*;EgWO3pd5HARELde+^={0)uaMY!*vV6}$ zg5bjw0iw6;P@LmjsH;mDb~DXVGW7&6vC$4!HOA!rQHY~taUx^{am-WA%muaNOE|HO zYpxnZaG7_9D;&AbgKV-LLBYnbU-mO$D>N%))LsFXrUN%U-55k7A+>XKW8!x(>ADD6 zm_!&BzVT>Y*z*gB_#Na7>>8|zQ*f&f^A}J};%Y9s8)=W&{fJBLhHQRr$kFfr3x)wO z^BfM17zKrh-w1S|&TC4dEep=#21m|fF9w-!Lhen^@(ocW-r{hd>%FCkXNZqhpR$^3 zGI$7S#8?KoSEwh%&*fzWiAsKSby@B}XDA6*Cg9@tSBKXx;kXGQh>X=g@vHZmHD4k5 z^PgU*M2g{nRH{kWfs@MKAa0h7^dv<+GWfd04N;@yD?Mfcc=R@zw06NlzC)MxcXD#L7jnFNAw1-0PY` zbuvfv68pNlEa_}*5WYi$g8J@++#kHWj$Dr1+5Byq8%cemswLFQpsRsT7T+cj+>LMY z3g6l|_4HScKczTO{P>q?EB4VrGuaLz=N@E$KXo%GPItfM?PivX4>M?SeE_B03GHWb zYvtIsAz}MYNa^>3-E1v%58w3i)AhD<&aQnXj~ny(1TC#GVNXe*mwg8*y)F8Gs@o60<%HZchZyo@U;ut?dpg+lg{)qggqz$fK&Nwp zEWVA4T*wA=H$o>VOfm}`JN;;=T8iRKR{iPE?Jz1Jmi3HHm1CL5(~*1EA- zLblhUv7Xlp%9O-7mYrRAhkQ4<865RkA8k|<;+W~CJW5arqb671KP^CmR$a6_M3Tfc z24Z%&zj_N^9a@Xez`v>=K)Btf7oN2_-}HZchntw$`D)yqI|v5r{YZ@a&BzcE6@&>0 zT`*`}YY*DuLQB7}+nIK=Q{@`Wba(6-{HgP#>S!9?$sxabbrX^gH=S2bxi*!B8krP$ z5@qJ90uN(6Qm^*e%Vrr$@HMHuXe%A*zikvJm_Z~pj8Z)hzFv{3bs>bi=plt^R1&Ro zktMsBO3>ULv*G7zZeR_)5Tfb>ztx)+I1aO<(U3S3b4|D(iOxvraWffo4%lcoy~-8l#6qv9> zX_4(cZocj&ie5BuqJC%TyuEA-cAt@qtemROaLI>uoic4rBJ0`JE23@qOn18I)_bzB zi0d`q;F21B-PtBt{`~YA%P+wfYnWezTlX-|qc}NIal?iy+Z30={kTbB!e6l3AAN@IJ;1~Xa6}{=(!!{iqp4JqHNjf1 zGiY@v?wa73HD*ciEO~-YgdO@uwu%UCxGS~-;n_xph8h`6ip_P%&fpPOH^&7t`sFlAP7NK-8(KL0+tS+|Ag#J{mrGcYHi@$N*9*aG^^7V#M||8(X{|0PC3)e zvg6zH)6C~6MLI&ema^C?UsFDEvj>RREu99CJb&K9SX{t7$|?ymt1BLt9k54d9I(gi z(6RT{VHxcZOtbliZ5ZT?aB!NT;{X+b1d!yO4$cDx|G;GsJr`ktNr>sYe%=^ZcQeQul!jCuB0J z0quzW+SaHMbBp>a@c?@-CO;;C4Z*K*I7qgZ#>+$LAkZC)P~gIR!nOyU z32}GQc6;L6-o{t*JB$TALR85t8KxWU1ctJnBn`dUq$Kt|1=BB%u$WTX4@=HJ*V-Ja z&=d=hZu-vmdQ0V310$-#Lm##8^GYLEahZm!PcvV) ze9o?Vq*`0ELUrII|3G`sl(21+=dLEtL0FsqlOK*HE3JL>)5iB^2igvdt_5eDKQNi~ z2Rr$y%45CcQX3m}9Uh~9;Kc7Df#@Sqoh0C2lBlX$teCd(_Wm)R zEvg7L@{A)#TYA7^9K~d&cu4lepWpQIF8sFRnd&*|G!EagOPen-z|;4IyQhXb zjp|b|HG+E&m)YgZZStb&UASl8jq&A2S;tfQhYKH~=mV%ZDc!dhTJFwP*s}^e;eIVC zF8&jWJ8j*9ysS!NYlX0bvsTZXf@a^+BlOsl9K-3Eb?gkrg7rMz-8i@}+K6HvN{wxo zs*>DwQnY-xzjUn8hOJ6%t&1OHrbJm&2d|4-fHbkZc2d*j$Ig-yP{CN&;IqlTloiFB zqpQk?`shJlDSyM}v99SFTj|ElT9X2n6hY27aM^COSV#87-r7JtZSDW)YR``6LBCj2 z7ehqK2Dq+tDVzQ=(qqRuE4) zRc5!x2m-)5CIqT_%Hv$icOP6)>7-KVSF35>hT0r~&n&2-J_q0f4d(Jo*Yz@2csY~T zZOWjD=||7vtYf7F(WpErBCK!IZ-B%y+bC;oE8o+}X5vU&zH@>R{AzQ5+GkvJf)ie0~s$-o3TGuN^$Tft7L? z1G1d1-P1#;soUl6W+AjfJ|E;n9MWGn_^iaWj^&vaagrAUMeZ(YreY|xrR#&lmjh3q zw+$Z*1qv@$IB0B|Rj8onxA-26d>wEU%qtfAhb1T;^>rnJkqNzKa6Ik}jaN|8B3{E%1EL?5(T^*P1)6RX!n+-3)B$*^A&Yd&8Wj-(&e?78Ca2kkJEE8E zE@&OU3+~EuuI*lI%9uoU-2>Y$793~!L$C4MX#s#j*<;!9hj!^tF#jSm`cP^BFbH@S z_V&uJ9{?sn-)0!;bM2)b+T~7tQsn~xz|}f#VWGu%w7KZTtHsCRyUlXU@>P=f2NR@g zlheA6qW-~}X{O4wXh*BD-0eTV>(?>B;rL`TOn`Y8pM!-WF$_Q<2`&#h1je-^DS=fh zou|nGC`_wvwRdz(l8lS8_PJ)qMvo|wzPpBlL4ck?At5f8Q0jUJ@!wM~;m|5caQ)A> z1-DndKs&!RmG06!v_PRV(*HIo*G;sK?)T?aT=1gU z{aV)V=J4HIIb88;D3D*O^Dwt@_RhSc?Ew#R**6ERJM_6ZP<9O<5k+0X_6+a-taN0I zX9{X|g>L6XQfsWD+W{i-3DiY!F=Xp5o}HY${46>&0ssuQdcw)6Cv(v%LCZ+}Kg#$u zfZ(Cs2cDS~m4kt=!cFu&!cIpKG5PVzTmSdBrXfw>BR#=nlEukUUJB0~pDzqI zAgMu*f!1%rj034-h+kHVas{Ug*%8xf!dI#aqZf+Od!Q}*f#5IQA;hf#1xw z)q~)g&sVh2f|8ers{tmmw2R{I8wwwlm;Ub}YAqW?KW|B^_4!*ZthFZTVKp;NSo#xc z)tDypYa`1T>zN08MA$8|=`(UAd3kPj$FCk~zZFq}bQUasq*xAK2zg8M=1KnXt*<^; zr3{I@YWakFB|j_!9_mbSn!jHR@!dhlJRXcbL}rl)?y)|z=ezKqet5yN8Gx_FBVR2d zRkFhXUOLKRc$biwf5-1z>e^V1C%HLnT=Gb(HfulAbeVewUR@vsxlw`CrBkxHp={#S z$~5xnU!EHy;#B>{<%@u$X*W;3Rr&?w%GCESXRj6>373!;NiM?7wyQJXvw}~ILZ(k` zVw~Q%P8-iTOC@Q>55SKK@A~xLM0-`J){P%TC^DAEqnI|WrCR*YM(jDgic@?kf0 zI?s`rkEjbKy*L*;``){b?Q`ud#WhYeorP~n&!1DaiCQiMT(E{7NvfbYJv%T z*#Dq5VVhyX%OVL^82+pF>1zAO%k6zWL^+*d14LyW(gf!br?`Tp)Xg_`^{$l|MH65N$aR1RaCBHIuwD;<|Q#Hg_L4U{xowcI6r7c!gK zHrLZt{l(8fiOryz5Y{B3bVW&2N7ye~`XC}C2PIc}<8@Q#oW%ucg z(S}E4NemE7qMS10KlY_$$L7ZbtC7%O(VrZd_;lXdypv)6~)CRELC={-~5Qn}~ zmE!L>ZGWp*^Z+5ZIhYkNIA)!HA;_;nim)*kdO3AZ-;z1M(pg@Dde~%1<1@xUFWxgw zp-8?&Q4>_xu28JY!sgnELUEge9DD5R1Pd<&rH!W6+u34oM<|&E`N__Kn#Y{Jjyaj- z{=hMM2z9_entbXJztAUEGQ;`hgYJCi%rit=rTgK)0=xz8J#)^|4~Dhe*pwBmHI#2J zP5)uuYnO&z%ksh^3P%m_d$tJGO_pGGLX%F0ExpcjTl*OZ|E+m*;!5g-!=$GHu~JQ> z{z|Y9ZY)lS@GKI^JZmY$@61p+lVjT1qgKf_ZWmnhyEEMl!l)Hl+t?w7!ENLDntJidb* zo4ipR$g5HcSA_@c*xJ*>j42SL{E{E(D(|`%pU7~Q+E!daR$D6~kMI>2f3zrmyZ%q| zD|IqKauDKs(3j252PI2@V!4Hk)MG* zHU>;RbF|i7j8pU$94$yBjodr#-dGr@2Fo0H)`I8z2dBy+E{tU?XcA6*M?Fx4u_~Su zQ@tx9MwY%@lYKDZ3-dvi&j+BgJsDv!=)gd3yYwU%cJCA{%9XE1=fl zj7TvQrP5cw^!mp7dcUim>MHlCc_}5!0injg1iys1rDuhdtUAJoqGp}x#)3XGqZaQg{dGFnXRaekw?xM$8LqE^b zm$W}@L?A8$&gc6Kjxe5k6?490vpQ+{tgcFLu%Qzkm>Tgt(XdbwBToItTyTn0QtV?f z*+M@fD?1jWf_ibe^J+uo0oB->ncJm7$)Y$#4U?2NU)%gUdrRz1?Ve(eMjzdhJ+b)Q zPT&i2VBdC+ly!&eK;=je>#}AIQ#6N!7X^yuX4w`Ep@`3k5`S(vWdC?RbJ5{Ks=6fg zK~mGH`@$opK63K2JyOon;oMY>&WIHomWuDVOU2ep(Z;l2v-B-hwVDn_lqF7(o~UYb z5CDGg9*KsE)rAWFbmZzgF#TB>2}az!ApNauTj+N#I59ngBR|$*QL(0LdEAoAyPAq zv0752t>BL-nl4WdnZ*_j>1)I6HY|okx!%7<*nobg(-IikEoKc0-}<$EB~rsxM@EAE z1YcvOD|c%r)z7q7^BILQb|36UM#o2bpW%d3v9x9OE;cpCQO41yew^8Gxb`VYlfB=1 z1PGm&OYuZI&AB*-^gUU0{3j&`7=Wiz|Ap|@U|(>l zeQ=x;q0L&ba5d|JIM$ZU(RlIBVL=WlXt64F(H(Rj;Y^|JPyDLnhHq0< z`n+yCI6#03W!a5LyP`i9J62lSz1 z$SwD}D``k?jFTsUtH-w^Ou?6aQ`tWd($c)9&yVQN99n8m5?i@S1@ zyYa5J9n@tSLa|c8M2D==)O!{F6_|81>8`3}Nh4$C)+ZWR5%Rq2Ej#Az(Ka!EZ}0f% zUQie7+G0fS^=QRFp#F=Rz?}IeBqBxq$kv{4s_V_7l2rA_uLxSv8*Ti1fPSoRPg+;N z2n*b;F%@c;?_HrX2Sam7)+Xed{$~>;UK3eUJUMc7C-4z2^Egp+_)7ivwSas$(J0yI znjr*>Kfin2J{rwkbYj%+(hER@juVj$DNV|U3pHVW_GZD_y#WvHiZ@3B&V(%a& z?VCSNi^jUg>9yO5PabAgU6vfE?(x52dIBdmK5BC`$dgy`?=o`|ozwZaA8ZWrmRVu% z=ZprGM0rkKH7=1mR1Gq*m~L$9#(_?j>&Lhl2ijnN9EYx@5dyon#V!6_$~+>uiAR_x zcRaUp(Is)PjpLD|FZ+w2ayjI-(4r$~M{((uW9PMKYw2D2z1SjBIs4b)JD8wesf*lO zg58`I8~4*5kDnQ;*@>A<*7us95ZSbFA(H*)DcgCE#jQ(ISmki+Hnz=yqMdJywgP=J z-_F7|ERZYi8#&uN9ReR?YOZ3~y-vOtL*C{TUv8_Ne*k7X{H`g#@}mwxkas=L{pI>O z;XFN9h5tUYlRF_*X(iA^Ml1>!3iALVGky(Ih$ND0Ik$LSGjnULT^qn#xeS$7#(_EWIB0b;L23;9_t9RtQUl%=bwWCC`xuOMD)2n(y@PRSfWt8C>*(fkcHVRZib;Gh0};` zIx@bev41)jNi3hhWo|Jomm4>crQ)Vi9~^wvHbE!w^{DF65{MoVl|h`p^1ixEN&%-$ z0W)C%TI#)Q&ijFn7w(--VFe%;avgGSD(e+;Skb%;;##>Q^_h5NthyOxK&L{1dg_?nb`h<4Zaorj$z36~`aBz+hv1!ZcBMz7M>;A<0IH|J- zKcn!0Imjjx1?;D<69=(L?T1n(vN~7s8Ti5sy+^y{XsAX`e2FVhIKT4Bi>S`OJIA`Q z&PrJPsXAB zZ??kpHXb>|Exx>p{!;Pr9OD_5?;)fnI7Jn_0y*oOQfARJKDqea>AF|Jn7qZ$GFoEs zyU$!^TSLaARFJZp$@pZZY~^zAU6gD?NNktkw9)KuEu5$F%G+Fi=8SVawwO0y&Ro zY#8l&o|gWe+tt{;NKc!i{Uh=-n}~WfxD4PUy&EMY7Bs$}UN8yNQC40mwn8;pXi*Ov z9w`0oq6+Zc^@*Jp1<38Yj~oXPdHA_uOJ}#ykx8PVG4+m zfD^1#@yByrG;SyqR_MEqKx)bsWTho^Eyy4Jxc<^=YL19T?8O6R-=_1c?t@f*G>VW} z748%o#=60)?%=l=v~UG5qT3hL^851*uHWwa^w=GkW!*vj!^a+N31OPBAHFq%Q6d{% zTpHlCJgD0tqtJm#;BtPbCNlo*ek*&wv9HDeFB?|H@y)_Ob)fu?P|smXqEn;IMW9Yg z?N#q-znGZ%3Yr2W4$^gZMpTKjBqWWqzpnhb#CY6v06;0G)NCS)d#~gV9|{- zi$!ei%DG^7?S?7?(C?y4zaJ4Tax&1Ub#k2fGBs%|H8LZ`SC8hBmIRk7uhB)6Gn0VA zi0h=~;y`b7&U-xczXVcEEHTMp6Ix*LxR@YdyAk8@emLzu=PHfmO~16@@@+l%>p2Iz z@?JA%5R4Ahpo*ug*vF@@O^%M5nk|z*nf(5zM#xm*+9A+{NV|hPOSVg8^-9)=>>kf! zC_un%J*V4euHahib1`H*JNdXl81rwIGL)b!M1nr#r{;ZVIs#^X3Qgn2Gj%=+v^PJV z-C6HS9`5=;esqp_eN~+W>!!}k+kI@QplG#F0eOfHpHiTE$)UzN4rcd@7rHEly8hUq zmKu;NU!rtdY8d?PKtbvo_UV&g*}3f;gWZOb*CGc}-*_<5A!Zf=JCBi>pjm(BImg}J z9q|MLK6oWV&>cukShVwSzB~0h&?Y+ zh{^DrJHNjAgzTgW4l6@$YbXl&cX>I-pU>`_81$fr7efnKskn@lUW@J~`DyF?fHnxs zBUSryP^$(yAuKgL%#NukX)sd(^!d|HjTO zB>s!rLG*8&{eKEp|0lusqWVF}{ZowE~%%k8^kY24>{cG*{Bw&kkmJpu4h zrun;S5afNFenu}24EP2RAE53Q>AyFf{tN0#{5Z&_kz#r1|BPa0Xr<8bW-(tVWh zmflBKJ7pE`W@KJR$lIGceLK!Ip?Sw-BU4N`ZALRShPU|^J#V5od^@WoN#VwdZrxD} zrTw(bSQn|i7rE=z#Ct?(l6*Nk2Q3upsyDA)g+=VG>jtx$2aR&rtE4UL^LS(qL>F1V z8qmI+pd3@%&W*K;y{j1KW>3g3PQz?uu{cN)6*BGc%)L%M@$i4EktWv$b{}YynqcBx zEfg?uNEdZRr{l7C-{ca9Do%9z5eY%!&m;lxMNk zrHJV02G$E9NYLPO^#1rV@POx?V#BL1B__sf);M-8YQ_E5Cut?t^7d-VqmLiQ2s#pD zuXvHgDd~M-u2x7?-M;G#=$SW8C|>uL5alK%wG0Aa-ec3EvKC){J_JhQGEKo`4QtnnPE`LhSPiJ zfk&*Yr3u>k#j|S7mgt&_HG3tAq~D6h8@~f}QoiRup?Fu$4|q%O&{yh&hXk zhofJaU_kTkl`E^irz1iB9 zM!G}@ON)YHW&2xGsOMPzI6CDF$Rosvn=+!uDUr5`AFvijlcWpvmt>YN`Dp}!27U(O z=jsQHOs}~mG`HzRp$n4_y%BuZWMz)Vsy8YI{VFXtYF(>#_S8kc>8zKx8RIgt>a@J* z!&$spFDfhtfI4TKmg*2E8Gz6rFb5R$<2QN0n8%Ev8eBsgC7<>8e9N$IC;;Qc|9jO( z9X=UbsVc#M@{{El9wSMN#>UH<@PSg#m5W7obqKmc)A)Z-!f-XRn1^$NR}%dYP}%$Z z0S{`GahMFBrvr>i|7)lDpmY3!f9*=8CWPmoFHXlCVQmU2SoiSg7l{cS3DR^M%lFxn$$wj$Q}q zE1wY3C$nRYVX3}Oc@o(BKw{*m+@hXDJ!mK7rxlkv zk>@8f&n9POc|7SjeC?CJV7seV)Bw~>(OCChhWzd2(A1jUnvjv8B)4(z-ofQd@>G)W z6Tg~FtHE#wGJ=d62tRbaz1dgIRtNYU8sO?J)U&Ot!#F5&-G3(!MB*#B#(4|z)j7p` z1Z0nyJZfyT*jJ2* z!2LX=-UIP=rux{Pga z8}HTU75WF31{0fw_u0gr={3XM&12ulnVlekIAoQ^9WHn#8E>@6f*QHi_w|bVJ;)A7 zKaP(~V_FL@%Nr2mda3)n>jNR6tJm%<*JP3Qx4GAyYy(0hG`%lIuQ3~2blwke<8p7z zy`@htKi>%ctw-@knm+sV9b$$b!s`00Gq))4b6aui7nR3#*K95~W@*obO8Put76+7L zUJ#{KP(3wg>?n6ER9qU^c4d`r$6|x=xN&R1QLEy5v$Walf$Xi8JdmNS6WGfVwXIL{B%SfoYMpN{qc?I)ohnQz z>3=_K3RZxaeKD9j(B)ZFBrT~eON8PeRtAY;HVnOA6C9?*HJqq)w|!Av`KqN>UnhgF zb<7qK>$k`Lz3i=9^GE>MbDBRM-KGR1o7bZ}(^c7hr?T*}SNtkJS}_voqSzG&u#)L8 zXLs4i(23R-d*uu`!#kh_B%V`>YR%Wle8n=}AH3Ln5Vi zbvxbJCYcHsgSx7) zu#ds{Wnb7+@%T9XmDQTAvc_wyQI-z~3ESjLji~bu=fScUJbg)S`ow)o6h!M6AU^C1 z<;TlQQ~ZOFUL=6ug5qp&u36$P~2Ppy)v%Eugd-PgWc+s6u9y=>%N(kT|yR5f&@!Y~;fUFI3+Ei1QDLMU99u4mI;(AMC~89FO6l&nV9B+nUGa!b-To%?u^hv@wZZ-YekiHZBFb9_=p z6@32l20U0ri?1l1Y5BtTx5n^8u@5|k4KpSg{>~d7vB>_Vt`U(qoSQcvT1@#yaD=gs zie!yD7FSqRQte6aghC{HmDN-j#t#^q9Ow6Cly<@^1z3P&;B>}7cB_V_Kd(_>^*(;*?rXmvo$S871B{IC! zdisON*B#)dIJ1tV9Y&QwMSISKgtkNfu~>i8EUhQ(H6FZORrYiauVGOUwYFZEJ*?ZF{BP}>>YuXg`h^05c|VHjj?tq0d!gP5 zCp!0UP^QEyE3PZL$o6symv6V2^Co+0(n&>A{zpG{6J1?RQW(fe)1IFvyMV$C)%kDA zn=@i=xA=$J{O4*;h0r59w7MS!u)KhlAaqbd8!1{%zL1UDmFySAQ7SSfD0}wX`tQa= zuBXxr5{QKXWfej49GW60cb%oCP*ZDh4knjVbT*(}15IJ_bUVrf#Ly$N z(tkQf5$~lFim0KPUhW~09=OQW@B8zCCQs#O5<%!frp$D}swNh{`p%x|6+=-)ICz`x zq>$&O)5zM%zYN!Twu0A+P{Xw8eLW~O4acpDg;lMoUK&WE-_#s45;Gb-h{dq(_{F2f zF(gU-d}|zuq~*%Kxnj{FjyG_bJ**G{j(2^@y*v(dwkws7J<7|j zz1fgERHnk>S>lztGoMxBoz?+PX!o3Apx&aqU$<$upH2NF066a#4PQ{Wd`wAk+yXFmnA#ZJFc)zi<%<_3(! z!0C~@CYAEz49BMy<3(*o()!;>AGNxdk2&9>|2*lv=EDLvcv@7DRM!t`>^)Wr;Rm0A zBau_@*fp#~^PB@E&5=yhIoe1LT5gU%=h8`|FB+xOFv!`y4_7pdX{<_mL-E?#T`pG` zKGpw)`QuNondKHLkxN52JQ4^8H5&3m!=JATu73=38te$$8C7D>=4lbcReC3CPZ>9m zsVkM5B_+COd=R33#pg2aCY(G0vD1ko!#>P>!7qDP_v$=de#BxZf~?#IQl~tBQAzF} z@}-U4Ma|`_-2Q^3AIT8};5}Wd(w!Ct-1zD6iP5IbPVZh;+J@ab8eRY{>ztXbDxZ4@ zwEMHE`4c%Kz$rCOVm*BVaA#%L(B~%}jwBSE`|&chz@ONgrA50ze=j4wz`hQ;67@RM z<}fHX;mboS#;d@%gVvryRgq2+sW!~dVZ_bJ@~ki%O^Xc6{$rHL3UI2$WzWO)sXv;} ze~=^4>S<`@I~OBR6Zbxpw)A3wl`y)iKWjfT?c;#6C-h++-ZlzfZaI;#@ z2(Ctn)34fGmieW>VMoN$Si;{AW;O8nCkj=x6&0JOB= zRRktRc;|F~zGSbq2|TIAR%37XJu2q59p|YY#sioMzg3R)Q`S>(uTMC9j3%n#=&<0c zZ}&*|(|$~4CR7DOBcaPhT92tACJ$zMCK?4_HBN5+t$|#``G?2bIk2*_?vYF_ETmI5 z%;_+FN0)t~TmPpz&Hr_@fbZF4WtFIe^a1YfyoTjQzFbX+Eps%8Qp0t)TC$6w_T`Go z_z~Fth!%9oUv&xMPRP0LUn&mzZO&0;zjjY*d6ZrS>s%xM{9U3DfUzN$%C2GFCiSCF z{K$mpBL!#Ia{DL#09Uf2JaidWM#-a0MBBW(X z^veO6uW}w}|7dyvn!~gem6jH@5aG8iJ5L5(`J1o}-7dPLJrZvr z!(&rOODKJ#(g4lpw=mBK9-EZc@Y?*A-*1sHF@$5x2N2-dwH%GEjUE;(stC>I!cksi zz%`frJl~FJF`=8#^cXvr3(K=)-;OXBhQ-^2^445VnaSGueJxE@vQiN)S{Fk>@){-0 zk7(D&R9$s?!)ES41aHJ2{uk|5mPQ&T1z#7(#S~>7(Ob%BI&}0037?aw@;AeV;wrpP z`C=?BvQP)Q{E9Owisxe8b0mY-h3~`H%}5w&CSLBrELjs?PR%n+{i+pkwdtVOP4`Zw z+Tk5Yv9YIBGdW(0h;gi1Uh=1t4XioEk%lVMQz^#m^q2d=>y~G}CAvEv6OOxaA*c5GH$9RQ zrfev}jt-`vV91X!n*5Qwquf}e5bpdFVxGt4!s^w!4~X#_HYYp=N4}+6h~U}$C)#mt zTv>9ItFIJ&u2S|%u^O66y%c{K#Nude5tW#%ck>`ai85u^%#3yjR^|Y^6d58b8^cXX zFm~6$E_j`8{NlC0p0E&edo6?G`w#W_GyF?~=!i_G6y?Maf@Sz>1YtAV7C!c?R!?Ky znG}IC=v=yde*O+$-Gsrn+2N_WmHay_Se`FW(%egeSz9&JPb&WGtD5 zrKo3RytA99?= z7JyuI{SM3DhE7J>#8_Qur1%wkx@K-{3+TkI`p`J|Cyum@7>S(^|C}QK@qC`L)jgf; z;|CL@wEAEYR!Z)eWHm4?7ta{65&K%O%@kMg7WmPI>A626=^2B7yx+>{L*-I`LBB_H z&unnEWzy>#erW^2=!D;&DyQ^O+)so*yOOqjbzlaFg8~Z*rZR~UpD{qwLIhTNV^ic( zF&(wZU820T@>nDdc~MN)m4-1RwC7$l2bMwD-BEeEjGs(%*ei9S9t2 zEi0{f-(PLMnu9+oA^&VhXlVTizaN`^N5LaL%3oWYJ-a#Q8pO!d99^8%Cf}A`A03|Y zYYe!Rm$PH$X50H$%X3Sv#P7k%nknvMYB5;g{34CAA)y2Wd;*d!8o2r1XT1me91Zx0 z6VvUni+l((;IgVpP??vNRi$dE5o)5CAbOz(`&)cpNx@ILJN^p*;Cz*f5z3e!4Evn% z<;-*x;}_xP5eEgFD0Au`3!p5A%cJt9_a18buSM8htI6f;#9@5#Z(bltqmlFUe(K*F z1YS+-&wneLlvzxy{{7cdx?Uy@)4!aWoHcKq;9rBHQrBqDs#8Gn@7-GzfKiPJGQEMq ziL;l+052?H@yrB&jc4_*_!$>wqxN*LX!*29o_bYUn|)#{Wd?hD%XeRko#;vAHMZHg zRPVOGad%Kx)#qY{0ffF%el_1>N0eoMnJcWP?nb7XfZeG(v*Tu!lT{S_$ z^v3_KlBu`rj_nygc~3TNF&`b1c!79A|NPCHb&<_IwX}w#sKLC z>6#!Tlzc9|@8^Hc|D5N|^Zt6V-*t9=nVmIwMLtnE08d$fZN;xXwIVDvW~_Ukb?*fG ze?rh<4d0LVfIp$r*M()4*V!#q+j=B*#RL(D3CnBm@`@9f`>j!SE8WP*{c*V0UU?lpbC z5z}2-tgKYsaX=Y|>N1Hhf&)C;m-1AoF9js}^qVrn4hK@2szEGNnOgIlW0cDyvbEm9 z5#aqse_z=)%$bVPN8U`u0N(E#d~Sq~Z$bdMy{UPsL8QPlzoJA1n`Qa^`9)GnV2T_r zZ~%5u=Yf7@0k3r5CV{OQ(KrhJ5e0md+0yeRt+FoeBW=H}rk7y4Wci@l;~7x$g2c8A zDT>$OWDC|``yAHwbu!ceuYa<~R;c~zrGKWEM!gVZIE*o4^>xV6%x0K)dGVHU$m%Dl zWoR>M`gTyH(bD-Z>CUnHN*xv)qr0~YgMQlKx5RZ&G|4|+OJPOH?A1Wbe_e56VnUFw z$fCpTC=>iM_gwz!GGLp?c=x*)?{;es(^#_p0lAh@b0T|*Dr8S_&NCCpmE6%uEc@Fl z^)ADbdz`oV-27fa7{hDdqlZGpNh*N3W)UZreXLw43VUi6av zq75+zu1EWJqfbXH4#JvPQV8X>@@iJwavCYS^ALI8CkYWJ*!UUDb@BD$ZkE9q6|MBO z2QJ6xJ)-+|vVWho8O#bap&6LqnQw5E4ts1KIZHO4{|OY3K5H}!SPoD(Wcs~v=}VPC zZ$a>KiZfpfkJ^(ip^`UJ@=I=r$KRVN0U6I_Z@RJKKH(AWBp1>OiFK_iD$wjA*)lv8 z!7F^WbF$VpZ>h>!JG$D!f}xE(o^V&#TgRnif`Fnuf#wyI0CVs}cr*R{2By<9m*v?X zc56&nB*j#>Y?(xoFBEXs$=9*6w6{m)52munWstA@?%YFkG(O~te{y&0VGXtf$CuLv z3C)zJJm1s_?(f(i_~OcVezou8^NVOwF;`~cJj6w!T+0au^mF?(P$ljVI7E1(%+(s@H>PMrf}slQkyHztLHkaZRJ zJm^dj8@IpW))%)jZc64&Q~&XC;}u_r(CBMpv$+NsUF9<4dBZss?O>}cuH$HrezV$) z_jUp4Jo-;Qu64nRo9@77md$1+lqD!%CkshFxYofgOhHoqMQVcos^UCZu<5RG)O-2> zN8Gds&e`F*yOE!4_&%tKegA2&Z`i(1prW9kG~_z}+w&YE6z03`oky;VM-OnLH z!w3_PX1H!*H|g7)4kcQ|jKxvL?xJ46#TkXP_n#1QX|ciG3Zyo0W(fr`-Q{%bd~Nay zla_D)*n@cM@fEky=z>*^fUgjO?*TK&!wNARITLtlulZ))m8cq;DC)dKsljM;0lU?n zfJgt^GYdZ=@d2*;!TtD|q<8w&SsB;ShrW7_oaBD?SG_GWrxv!?xAATPl<;SlsI*=iBV z;ZY#+{VpN*-Rh~P$p@oiJ2_VGg?M6SyE%8v?$g^1<_VSx4k!I*dTsEr1}b2jRwi5_ z$8JmYD8 zJqbx4e0JFsJAZz}sGf6c=s$GG^mOr>Pw=E2J0|nNy=qK`3o%@Uk*X;I2%)l*WJ7OD z4#uEn!mqo`y0&I+WXX+nLWa`0XU+t5@s)PPu9a3FUY;U04xcNhq_3TVtP8c2jj-4l ztX3lZw|wy$h&6w#FGfKYL%f-F#0n<9mF8&}=#5GsoGWM5w~GzEBUj0e zj~5lh=NrDIGqC+~2L(`EZQqwUpr2GjW7#IOXAig()@q>W4<59$9AsRo>)7(H z^+IU3c6s4alQHOsP~viH(wu$o3th2@U;@cJ9&iZ$uB`lx)(n@6JsY@?3nJ#JlB;i0 z88^`^ck{8Iey{~(841RjT&V8SXCuyj9dBGC8d+K2Thfc9R&l`3F=9` z(V@mb#q-q#x{Wb;m&mGV?->(D0};ba z2S+(vN;~RjGdS2kn!=FXw;)5gH&E4eEFQsI*wSQ_xlC8_}%4$5Z<7 zQ6e(&Wwr_42zd7>M}Thf38V3Oj1j^eZd7d@DR7zd4ZhkMFC0$wV0+gpUs3K<9@7uQ z<7}3y9{9qIV@a(fRD>_`OcGGJomICl!+B%urMENv(iOOFE{VH1ui}5y+zseZ#H?QI zI3KhYgEzHHCWp2j*U&b$pw);4<658>5C6z(pMT&~FI8imUrh2dC6v8)^Io=)NBE;2 zYqs)4AW>C3vVD%5WbFp3%g&;a~vlsrmExK!Y4IIrak*j7`6fG##+ zI18D2m!1~J=ObO1syxoO68BW}Y4)ttNz}*A`(M)#+cfZcC7n7}uC3p@s$#M6Bw}e1 zqX@xaw~8B2e_O9jPUYf0CfWHUhxdW91@Dm91n-88IieSMx?;|)BAQ$ES_cW=8cvbS z56RoPtO#dQOLKs3T+lP^Z14oP1ZG)v_i;k@kNYjR*f|!dmU~{gJOSeL>>J|l_C62$ zi;Gsf!}08A>%Bh>R_t;TexLB|oQj)j4P`pi}2ARj`jHo_-RwIO?H44rjKs zJi-oP;{XkmmCgoUUaR>IR2wF+ubfAqBAp{A#e=RskFZ}g>+7Khb{2(2w!lvvVlw4R zd3A=${BK?4ocmMQ5lFa$69Vtw0v`KJivM@3_a(#cRpL;==zr>Ro}fP_7!kv@KNl`k zxC0XD|Jm=6pdZ?Mfo!)r`}kl=6_1yv4%~bev{#3#4+JmPyTN2o-yk#mZ%0Qe4fOrV?)W|I-go8qeE@SNrj#-agbhNqR@9Gs+5q_ zDstOYlzS|Z&Btq`PK1TTFJTC(&vv9vWy2K0Tg@uDghYeN;2D6w|gumBCvr70>m z=5gnuA4{WGu`E&H1WPNS3 zJhVu{3F0|XA)SljFsWL4Rn=Lwd}LA}Vcf;^Q7!9RjI$Pne3eUR&w8<@J;Ubsa^&Qu z-nJl|Kxl>8sED{ zHx~(u*JL)R6?tn(NH8F8UoNLQo#Q?-d(G0QJ-{62DI0b`KN7%Q?pMd$ADL3(R1g>& z5Frjt(-}p$=W|Jim^4Q8n-(x&O$d(6E@j~ST)Q=O3n5#gP{WcDv${kP3 zk)M?8?^*+%fq;3IK>Vv`xG&%%&P}h@#Me}i;zL>jepFX(ZZ?5KvTXdzjDU}5ddO)C z#t%IW_<@B1`fbr>US-3d_qg~50@}b@fkG5kc@%UxbH=gD*+{RIA47!+CWA{{;up!9 z924Q@cTUeECq2hX#e=nQX5^mho9v3CeruW3zif!9yKDab(ZY+U?6qWj5oOLOC{&U- z?mKa(?xEqu`+m9O{rQVVi=tJ&$_u}bm`P1Uq6%GGtAF1M#mvdgsnKX*=VVoLF<<}Tl z4j5*xdT96Wk>(OPx6_uC3`7XmiLA*=%#>7tSqB#N%@NbGCC~L}s}3eXrq%*op^);i zlcj=Oxni+DsfKQfj+oRmpDT$GcX>fntB%HyuhtGq|F531XH#}n&RWE_ZCkWc)V10# zBxy-Bii|HfEfTL|XaO7xWiAcA63=@=8r|f?si-pQU(tBP3Mk-Sw^ZN@{aS<;DTcdB zihfW{_T{W>)?9Tf92sqccz9oYc5QKX)?{G-uVwKnIc7jXq9tN-6&Q`OSH6}s!)N+n z7g@_-b3uU5Pwv%JX(Eu_R}d|<55>`|xC87)iBVYWWNFLf%~rrh)^FI|7G( zS?qZug)#4|n=*A|UC$y@JXV1nb64vq>Fc>+cskrUZzc^vX0(3eSv(l_*2;T(>SDe=VAYgc&TB{R!Z;3h zpYgA&eq+3BA981mse7bATF<-SFm5*+0&U>2yL{VhDtT;>z1iaoC3AXKpK(?h+myjS zT3aN;gAG=fNd%f@WvSZvRoyHDnTonEj&_nbrv6+v5z5^eLOD98(b0H0nBYxAS!)GB z6MhCU0U_;+V-FeF8pTy4Iwo_+=JcC_B=Cog2MwiXU$O|#tB=vca3{b-C(=@fs+Fl& GhyM=*AZ76Y literal 0 HcmV?d00001 From 3af615c66e70da7698cd1f3f96cd340b42b55a85 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Mon, 14 Sep 2026 14:14:00 -0700 Subject: [PATCH 02/31] Fix typo in dnim-cli-layout.md for previews option Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/core/additional-tools/dnim-cli-layout.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-cli-layout.md b/docs/core/additional-tools/dnim-cli-layout.md index 25f82ee3ab4de..2a7afda0685d3 100644 --- a/docs/core/additional-tools/dnim-cli-layout.md +++ b/docs/core/additional-tools/dnim-cli-layout.md @@ -16,7 +16,7 @@ ms.date: 08/11/2026 ```dotnetcli dnim-win-[x86|x64|arm64] layout [-a|--accept-license] [--include-installers] - [--include-previes] + [--include-previews] [-l|--log-file ] [--latest] [-v|--verbosity ] From 9af3df2dfce977e57410a2c3126831f0f7ef5193 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Mon, 14 Sep 2026 14:33:32 -0700 Subject: [PATCH 03/31] Add FAQ --- docs/core/additional-tools/dnim-faq.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 docs/core/additional-tools/dnim-faq.yml diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml new file mode 100644 index 0000000000000..fbb1a3505cd9a --- /dev/null +++ b/docs/core/additional-tools/dnim-faq.yml @@ -0,0 +1,18 @@ +### YamlMime:FAQ +metadata: + title: .NET Install Manager FAQ + description: "This article answers frequently asked questions about the .NET Install Manager." + titleSuffix: "" + ms.topic: faq + ms.date: 09/14/2026 + +title: .NET Install Manager FAQ +summary: | + The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove or update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. + +sections: + - name: Troubleshooting + questions: + - question: Can DNIM be used with application monitoring and profiling tools like Datadog? + answer: | + No. DNIM is a trimmed .NET application and will fail to launch. You can exclude DNIM from profiling by setting an environment variable before launching it: `DD_PROFILER_EXCLUDE_PROCESS="dnim-win-x64.exe"`. From 285aad5674b945157f055ba1409127f3ea0833c2 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Mon, 14 Sep 2026 14:49:25 -0700 Subject: [PATCH 04/31] Fix environment variable typo --- docs/core/additional-tools/dnim-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index fbb1a3505cd9a..6bc6c64d00e6a 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -15,4 +15,4 @@ sections: questions: - question: Can DNIM be used with application monitoring and profiling tools like Datadog? answer: | - No. DNIM is a trimmed .NET application and will fail to launch. You can exclude DNIM from profiling by setting an environment variable before launching it: `DD_PROFILER_EXCLUDE_PROCESS="dnim-win-x64.exe"`. + No. DNIM is a trimmed .NET application and will fail to launch. You can exclude DNIM from profiling by setting an environment variable before launching it: `DD_PROFILER_EXCLUDE_PROCESSES="dnim-win-x64.exe"`. From 2afb3b7ed71cc23237b1b1761855cc59bf82df13 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Mon, 14 Sep 2026 15:45:04 -0700 Subject: [PATCH 05/31] Update FAQ --- docs/core/additional-tools/dnim-faq.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index 6bc6c64d00e6a..46afb86558462 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -11,6 +11,18 @@ summary: | The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove or update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. sections: + - name: General + questions: + - question: Does DNIM require internet access? + answer: | + It depends. The [`layout`](dnim-cli-layout.md) command needs to download release information and installer executables. Other commands like [`scan`](dnim-cli-scan.md) supports offline execution. + - name: Best Practices + questions: + - question: What is the recommended approach to remove end-of-life versions of .NET? + answer: | + - Start with a small pilot to gather information and understand the state of devices. + - Consider using [Visual Studio](https://learn.microsoft.com/visualstudio/install/update-visual-studio?view=visualstudio#remove-out-of-support-components) to remove old .NET components it installed. + - Deploy DNIM using `--sp eol` and remove any installs that were left behind or orphaned using `--remove-orphaned-installs` and `--remove-EOL-versions-from-VS`. - name: Troubleshooting questions: - question: Can DNIM be used with application monitoring and profiling tools like Datadog? From 96ebfc93e0566075774c7f5f518ed8c23221f9bd Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Mon, 14 Sep 2026 23:31:06 -0700 Subject: [PATCH 06/31] PR feedback, edits --- docs/core/additional-tools/dnim-cli-layout.md | 4 ++-- .../dnim-cli-query-products.md | 3 ++- .../dnim-cli-query-releases.md | 2 +- docs/core/additional-tools/dnim-cli-trace.md | 10 ++++---- .../additional-tools/dnim-cli-uninstall.md | 12 +++++----- docs/core/additional-tools/dnim-cli-update.md | 10 ++++---- docs/core/additional-tools/dnim-faq.yml | 16 +++++++++++++ docs/core/additional-tools/dnim-logs.md | 12 +++++----- .../additional-tools/dnim-net-installs.md | 24 ++++++++++--------- docs/core/additional-tools/dnim-overview.md | 4 +++- .../includes/dnim-cli-output-format.md | 2 +- docs/navigate/tools-diagnostics/toc.yml | 21 ++++++++++++++++ 12 files changed, 82 insertions(+), 38 deletions(-) diff --git a/docs/core/additional-tools/dnim-cli-layout.md b/docs/core/additional-tools/dnim-cli-layout.md index 2a7afda0685d3..e1cccd6c89762 100644 --- a/docs/core/additional-tools/dnim-cli-layout.md +++ b/docs/core/additional-tools/dnim-cli-layout.md @@ -26,6 +26,8 @@ dnim-win-[x86|x64|arm64] layout -?|-h|--help ## Description +The command create or updates a cache used for offline deployments inside network restricted environments. + ## Options - [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] @@ -42,8 +44,6 @@ dnim-win-[x86|x64|arm64] layout -?|-h|--help ## Results - - ## Examples - Create an offline deployment in `C:\dnim\layout` that only include the release metadata (no installers). diff --git a/docs/core/additional-tools/dnim-cli-query-products.md b/docs/core/additional-tools/dnim-cli-query-products.md index c16c166cb2748..2abf349e716f8 100644 --- a/docs/core/additional-tools/dnim-cli-query-products.md +++ b/docs/core/additional-tools/dnim-cli-query-products.md @@ -1,8 +1,9 @@ --- title: dnim query products command -description: The scan command identifies .NET installations. +description: The query releases command provides information about specific .NET products. author: joeloff ms.date: 08/11/2026 +ai-usage: ai-assisted --- # dnim query diff --git a/docs/core/additional-tools/dnim-cli-query-releases.md b/docs/core/additional-tools/dnim-cli-query-releases.md index c16c166cb2748..48822f598f791 100644 --- a/docs/core/additional-tools/dnim-cli-query-releases.md +++ b/docs/core/additional-tools/dnim-cli-query-releases.md @@ -1,6 +1,6 @@ --- title: dnim query products command -description: The scan command identifies .NET installations. +description: The query releases command provides information about specific .NET releases. author: joeloff ms.date: 08/11/2026 --- diff --git a/docs/core/additional-tools/dnim-cli-trace.md b/docs/core/additional-tools/dnim-cli-trace.md index f9125db47fd63..3a7ed82a4b07c 100644 --- a/docs/core/additional-tools/dnim-cli-trace.md +++ b/docs/core/additional-tools/dnim-cli-trace.md @@ -9,7 +9,7 @@ ms.date: 08/11/2026 ## Name -`dnim-win-[x86|x64|arm64] trace` - Identifies .NET and .NET Core processes. +`dnim-win-[x86|x64|arm64] trace` - Identifies running .NET and .NET Core processes and the runtimes and SDK being used. ## Synopsis @@ -28,7 +28,9 @@ The `trace` command processes kernel traces to identify running .NET and .NET Co The command examines a number of events, including `ProcessDCStart`, `RuntimeStart`, and `ImageLoad` to identify running processes that depend on the global runtime under Program Files, including .NET SDKs. -The command can differentiate between single file and self-contained applications. While non-FDD processes may not be impacted by shared installations of .NET, the information provides a more complete view of a device, allowing administrators to make informed decisions. +The command differentiates between single file and self-contained applications. While non-FDD processes may not be impacted by shared installations of .NET, the information provides a more complete view of a device, allowing administrators to make informed decisions. + +The command is useful to identify applications using end-of-life runtimes and how removing older versions of .NET could impact a device. > [!IMPORTANT] > The command requires administrator access to process kernel traces. @@ -54,8 +56,8 @@ The results include information about each process (PID and start time) and the | pwsh | 37364 | Net | coreclr.dll | 10.0.1026.32716 | | 1. DNIM is a single file application and the CLR is reported under the application host. -2. The `dotnet` process is an FDD application running on .NET 10.0.11. Note that the process also loaded modules from the .NET SDK. -3. The `pwsh` process is a self-contained application. The diagnostic log confirms this and shows a local copy of `coreclr.dll` was loaded. The version is also different from the global copy loaded by `dotnet` (second row). +1. The `dotnet` process is an FDD application running on .NET 10.0.11. Note that the process also loaded modules from the .NET SDK. +1. The `pwsh` process is a self-contained application. The diagnostic log confirms this and shows a local copy of `coreclr.dll` was loaded. The version is also different from the global copy loaded by `dotnet` (second row). `[2026-08-17 08:31:59.175]d0000: Event: RuntimeStart, timestamp: 08/17/2026 08:31:57, PID: 37364, path: C:\Program Files\PowerShell\7\coreclr.dll` ## See also diff --git a/docs/core/additional-tools/dnim-cli-uninstall.md b/docs/core/additional-tools/dnim-cli-uninstall.md index 0d2a5ce787a5e..fedc21421db8f 100644 --- a/docs/core/additional-tools/dnim-cli-uninstall.md +++ b/docs/core/additional-tools/dnim-cli-uninstall.md @@ -16,7 +16,7 @@ ms.date: 08/11/2026 ```dotnetcli dnim-win-[x86|x64|arm64] uninstall [-a|--accept-license] [-b|--include-bin-deployed-installs] - [--crsp|--create-system-restore-point] + [--csrp|--create-system-restore-point] [--epv|--except-product-version ] [--esp|--except-support-phase ] [--ignore-dependents] @@ -114,9 +114,9 @@ The results are similar to those produced by the [`scan`](dnim-cli-scan.md) comm ## Policy Evaluation -DNIM generates a set of internal policies based on the command-line options. Every installation is evaluated against the policies. Evalution stops when a policy applies to an installation. Installations are removed if none of the policies apply. +DNIM generates a set of internal policy rules based on the command-line options. Every installation is evaluated against the policies. Evaluation stops when a policy applies. If no policies apply, the .NET installation can be removed. -The table below contains a general overview of the policies generated from the commandline options. +The table below contains an overview of the policies created from the command-line options. | Policy | Description | | --- | --- | @@ -137,15 +137,15 @@ associated with .NET 6.0 for removal. When the tool evaluates a .NET 7.0 install ## Policy Results -Every installation is assigned an action based on the policies that were evaluated. The table belows contains +Every installation is assigned an action based on the evaluated policies. The table belows contains a description for the various policy actions returned by the `uninstall` command. Policy actions with a -`None` prefix indicate the installation will not be removed. +`None` prefix indicate the installation won't be removed. | Action | Policy | Description | | --- | --- | --- | | NoneNotOutOfSupport | Support Phase | The product is still considered to be in support based on the published release information. | | NoneLatestReleasedVersion | Retention | The installation is the latest known released version and will be retained. | -| NoneNotOutOfSupportInVisualStudio | Visual Studio EOL | The product is out of support, but not all instances of Visual Studio considers it out-of-support. This may indicate that product information in the Visual Studio catalogs are outdated or inconsistent. | +| NoneNotOutOfSupportInVisualStudio | Visual Studio EOL | The product is out of support, but not all instances of Visual Studio considers it out-of-support. This indicates that product information in one or more Visual Studio catalog is outdated or incorrect. | | NoneProductVersionExcluded | Product Version | The product will be retained because its version excluded it from being removed. | | NoneProductVersionNotFound | Product Version | The installation belongs to an unknown .NET product version. This can happen when the .NET releases JSON data has not been updated or an old copy of data is being used. | | NoneSupportPhaseExcluded | Support Phase | The installation will be retained because its support phase is excluded. | diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md index f962f66d01ec3..ac9946d5f42a3 100644 --- a/docs/core/additional-tools/dnim-cli-update.md +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -1,6 +1,6 @@ --- -title: dnim scan command -description: The scan command identifies .NET installations. +title: dnim update command +description: The update command updates existing .NET installations. author: joeloff ms.date: 08/11/2026 --- @@ -9,12 +9,12 @@ ms.date: 08/11/2026 ## Name -`dnim-win-[x86|x64|arm64] scan` - Detects, classifies, and reports .NET installations on a device. +`dnim-win-[x86|x64|arm64] update` - Detects, classifies, removes and updates .NET installations on a device. ## Synopsis ```dotnetcli -dnim-win-[x86|x64|arm64] scan [-a|--accept-license] [-b|--include-bin-deployed-installs] +dnim-win-[x86|x64|arm64] update [-a|--accept-license] [-b|--include-bin-deployed-installs] [--epv|--except-product-version ] [--esp|--except-support-phase ] [-l|--log-file ] [-o|--output-file ] [--offline ] @@ -27,7 +27,7 @@ dnim-win-[x86|x64|arm64] scan -?|-h|--help ## Description -The `scan` command detects, classifies and reports .NET installations on Windows. MSIs and bundles are detected by default. Bin deployed (xcopy/zip) installs under `Program Files` can be detected using the `--include-bin-deployed-installs` option. +The `update` command detects, classifies, removes and updates .NET installations on Windows. MSIs and bundles are detected by default. Bin deployed (xcopy/zip) installs under `Program Files` can be detected using the `--include-bin-deployed-installs` option. Results can be filtered using the product version and support phase options to only include installations matching the specified criteria. Results are written to both the console and diagnostic log. Additional output formats are available and include JSON, HTML and CSV. diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index 46afb86558462..76b24f80f1eab 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -16,6 +16,12 @@ sections: - question: Does DNIM require internet access? answer: | It depends. The [`layout`](dnim-cli-layout.md) command needs to download release information and installer executables. Other commands like [`scan`](dnim-cli-scan.md) supports offline execution. + + - question: .NET x.y is EOL. Why doesn't Visual Studio designate it as out-of-support? + answer: | + - The out-of-support metadata is unsupported by the version of Visual Studio that installed .NET. The metadata was first introduced in Visual Studio 15.9.27, 16.0.18, 16.4.13, 16.7.3 and 16.8 Preview 3. + - .NET was in support when Visual Studio shipped before going out of support. As a result, the metadata couldn't be updated. + - name: Best Practices questions: - question: What is the recommended approach to remove end-of-life versions of .NET? @@ -23,8 +29,18 @@ sections: - Start with a small pilot to gather information and understand the state of devices. - Consider using [Visual Studio](https://learn.microsoft.com/visualstudio/install/update-visual-studio?view=visualstudio#remove-out-of-support-components) to remove old .NET components it installed. - Deploy DNIM using `--sp eol` and remove any installs that were left behind or orphaned using `--remove-orphaned-installs` and `--remove-EOL-versions-from-VS`. + - name: Troubleshooting questions: - question: Can DNIM be used with application monitoring and profiling tools like Datadog? answer: | No. DNIM is a trimmed .NET application and will fail to launch. You can exclude DNIM from profiling by setting an environment variable before launching it: `DD_PROFILER_EXCLUDE_PROCESSES="dnim-win-x64.exe"`. + + - question: Why is DNIM unable to uninstall the version of .NET that my vulnerability scanning tool is reporting? + answer: | + - Use the `-b` option to check for bin-deployed installs. + - Check whether the uninstall command reported any dependents. + + - question: Why did Visual Studio reinstall an out-of-support .NET component? + answer: | + - If you manually removed the installation and VS considers it to be in support, actions like repairing Visual Studio may result in reinstalling the setup package. diff --git a/docs/core/additional-tools/dnim-logs.md b/docs/core/additional-tools/dnim-logs.md index 9715157a5b319..5174f452e920a 100644 --- a/docs/core/additional-tools/dnim-logs.md +++ b/docs/core/additional-tools/dnim-logs.md @@ -7,7 +7,7 @@ ms.date: 08/11/2026 # Logging -DNIM provides a rich set of logs to assit with diagnosing and troubleshooting issues. +DNIM provides a rich set of logs to diagnose and troubleshoot issues. ## Console @@ -15,9 +15,9 @@ DNIM always generates output to the console. The default verbosity is `normal`. ## Diagnostic file log -DNIM always generates a diagnostic log in the current user's `%TEMP%` directory. The default filename consists of the `dnim` prefix followed by the date and time, for example, `dnim_20260811_203922.log` indicates the log was generated on August 11, 2026 at 8:39:22 pm. +DNIM always generates a diagnostic log in the current user's `%TEMP%` directory. The default filename starts with the `dnim` prefix followed by the file creation date and time, for example, `dnim_20260811_203922.log` indicates the log was generated on August 11, 2026 at 8:39:22 pm. -The contents of the log varies based on the command and the state of the machine. The start of the log will include information like the version and the command that was executed. +The contents of the log varies based on the command and device state. The start of the log includes information like the version of DNIM and the command that was executed. Each line consists of a timestamp, message type and event ID followed by a detailed message. @@ -25,11 +25,11 @@ Each line consists of a timestamp, message type and event ID followed by a detai [2026-08-11 20:39:23.495]d1000: DNIM started, command: c:\Users\user1\Downloads\dnim-win-x64.exe scan, PID: 18800, PPID: 34220 (C:\WINDOWS\System32\cmd.exe), SID: S-1-5-21-2127521184-1604012920-1887927527-5663403. ``` -In the preceeding example, `d1000` indicates that a diagnostic message with event ID 1000 was logged. Messages can also be prefixed with `i` (informational) or `e` (error). Only messages with non-zero event ID are sent to the Windows Event log. +In the previous example, `d1000` indicates a diagnostic message with event ID 1000 was logged. Messages can also be prefixed with `i` (informational) or `e` (error). Only messages with non-zero event ID are sent to the Windows Event log. ## Registry -DNIM tracks information pertaining to it's last execution in the registry. The data is stored under `HKCU\Software\Microsoft\DNIM` or `HKLM\Software\Microsoft\DNIM` (if the command was run with elevated permissions). +DNIM stores information about it's last execution in the registry. The data is stored under `HKCU\Software\Microsoft\DNIM` or `HKLM\Software\Microsoft\DNIM`. The latter key is used if the command was executed with administrator premissions. ```console D:\>reg query HKCU\Software\Microsoft\DNIM /s @@ -47,7 +47,7 @@ HKEY_CURRENT_USER\Software\Microsoft\DNIM\License ## Events -Commands that modify a machine's state by removing or updating .NET will log events to the Windows Application log using `DNIM` as the event source. +Commands that modify the state of a device may create one or more entry in the Windows Application log. The event source will be designated `DNIM`. ![DNIM Start Event](./media/dnim/eventlog.png) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index 6242029e01119..dae36242a82de 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -2,19 +2,21 @@ title: Managed .NET installations on Windows description: Provides a technical overview of .NET installations on windows, including composition and reference counting. author: joeloff +ms.date: 09/14/2026 +ai-usage: ai-assisted --- # Managed .NET installations on Windows -Partially removed .NET installations are a common reason why vulnerability scanning software like Micorosft Defender Vulnerability Management will report a device. Understanding how .NET installations work can assist administrators with investigating reports and taking remedial actions. +Partially removed .NET installations are a common reason why vulnerability scanning software like Microsoft Defender Vulnerability Management will report a device. Understanding how .NET installations work can assist administrators with investigating reports and taking remedial actions. On Windows, .NET components like the runtime and SDK consist of multiple MSIs. Individual MSIs are not directly distributed. Instead, they are chained together to create bundles. -## Aquiring .NET on Windows +## Acquiring .NET on Windows - Standalone bundles (EXEs) can be downloaded from [.NET](https://dotnet.microsoft.com/download). - WinGet provides packages that contain the .NET bundles. -- Servicing updates distrubute the bundles through Microsoft Update using automatic updates, WSUS and the Windows Update Catalog. +- Servicing updates distribute the bundles through Microsoft Update using automatic updates, WSUS and the Windows Update Catalog. - Independent software vendors (ISVs) may redistribute .NET bundles as part of their software. - OEMs sometimes include preinstalled copies of .NET bundles in the factory images of new devices. - Some Azure marketplace images of Windows include preinstalled copies of the bundles. @@ -39,10 +41,10 @@ Starting with .NET 8, users have the option to [defer](https://learn.microsoft.c Bundles are composed from multiple MSIs, some of which are shared between multiple bundles. -![.NET installer composition](media\dnim\dotnet-bundles.svg) +![.NET installer composition](media/dnim/dotnet-bundles.svg) - The runtime bundle contains three MSIs that also ship in the desktop runtime and SDK bundles. -- The desktop bundle includes an additioanl MSI that is shared with the SDK bundle. +- The desktop bundle includes an additional MSI that is shared with the SDK bundle. - The SDK includes additional MSIs that contain the CLI, templates and targeting packs used to create and build .NET applications. Shared MSIs are managed using reference counting. Every .NET MSI creates a registry key called a provider key that allows a bundle to register itself as a dependent. If an MSI is already installed, the bundle only updates the registration information. Bundles are unregistered when they're removed. The shared MSIs are only removed once there are no registered dependents. @@ -65,14 +67,14 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost ``` > [!NOTE] -> Individual MSIs become orphaned when depedents remain registered after a bundle is removed, for example, when the uninstall is interrupted. +> Individual MSIs become orphaned when dependents remain registered after a bundle is removed, for example, when the uninstall is interrupted. > [!NOTE] > Visual Studio uses a well-known value, `VS.{AEF703B8-D2CC-4343-915C-F54A30B90937}`, to register itself as a dependent. The actual reference count is determined by checking the installation manifest for each Visual Studio instance. ## Bin deployed installations -Bin deployed installations refer to copies of .NET that aren't associated with an MSI. This can be achieved by running the install scripts as an administrator and setting the installation directory to `Program Files\dotnet'. This can complicate remediation. Scanners will report vulnerabilities, but administrators won't find MSIs that can be uninstalled. DNIM is able to detect bin deployed installs. +Bin deployed installations refer to copies of .NET that aren't associated with an MSI. This can be achieved by running the install scripts as an administrator and setting the installation directory to `Program Files\dotnet'. This can complicate remediation. Scanners will report vulnerabilities, but administrators won't find MSIs to uninstall. DNIM is able to detect bin deployed installs. ## Detection @@ -103,17 +105,17 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\ ### Bin deployed installs -Because DNIM performs an exhaustive search of installer components, files under `Program Files\dotnet` not associated with an MSI are classified as bin deployed installations. +Because DNIM performs an exhaustive search of installer components, any files under `Program Files\dotnet` not associated with an MSI are classified as bin deployed installations. ## Classification Incorrect classification of installations can result in removing or retaining the wrong installation, potentially breaking applications or leaving devices in a non-compliant state. -Once a product (e.g., NET 10) is identified, additional information like the release (e.g., 10.0.4) and support phase (e.g., active)can be determined. This enables administrators to create flexible deployments. +Once a product (e.g., NET 10) is identified, additional information like its release (e.g., 10.0.4) and support phase (e.g., active) can be determined. This allows administrators to create flexible deploymentss. -Installations are further classified according to the .NET components they represent, their architecure and type of installation. +Installations are further classified according to their .NET component (ASP.NET Core, SDK, etc.), architecure and type of installation (bundle, MSI, or bin deployed). -There are also a few special cases that are worth mentioning. +There are some special cases worth mentioning. ### .NET Standard 2.1 diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md index 8cb363d219550..9d021ac7c9712 100644 --- a/docs/core/additional-tools/dnim-overview.md +++ b/docs/core/additional-tools/dnim-overview.md @@ -2,6 +2,8 @@ title: .NET Install Manager overview description: An overview of the .NET Install Manager. This tool is a guided command-line tool to manage .NET installations. author: joeloff +ms.date: 09/14/2026 +ai-usage: ai-assisted --- # .NET Install Manager overview @@ -11,7 +13,7 @@ The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remov DNIM ships as a trimmed, single file .NET executable, making it easy to deploy across devices using tools like [Microsoft Configuration Manager](https://learn.microsoft.com/intune/configmgr/). > [!IMPORTANT] -> DNIM does not enforce specific policies. Administrators can use the command-line options to create deployments that best expresses their organizations's compliance policies. +> DNIM does not enforce specific policies. Administrators can use the command-line options to create deployments that best express their organization's compliance policies. The tool is data driven and depends on the [release information](https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json) published for .NET. While internet access is required to download the latest release information and updates, administrators can prepare offline deployments for network restricted environments. diff --git a/docs/core/additional-tools/includes/dnim-cli-output-format.md b/docs/core/additional-tools/includes/dnim-cli-output-format.md index 207d6f17cb0f0..798ef8d1fa333 100644 --- a/docs/core/additional-tools/includes/dnim-cli-output-format.md +++ b/docs/core/additional-tools/includes/dnim-cli-output-format.md @@ -2,6 +2,6 @@ ms.date: 08/12/2026 ms.topic: include --- -**`--output-format `** +**`--output-format `** Specify the output format for command results. The default format is `csv`. diff --git a/docs/navigate/tools-diagnostics/toc.yml b/docs/navigate/tools-diagnostics/toc.yml index 747c01c7edf78..bfbe39811c2cf 100644 --- a/docs/navigate/tools-diagnostics/toc.yml +++ b/docs/navigate/tools-diagnostics/toc.yml @@ -372,6 +372,27 @@ items: href: ../../core/additional-tools/uninstall-tool-cli-dry-run.md - name: dotnet-core-uninstall remove href: ../../core/additional-tools/uninstall-tool-cli-remove.md + - name: .NET Install Manager + items: + - name: Overview + href: ../../core/additional-tools/dnim-overview.md + - name: Command reference + expanded: true + items: + - name: dnim layout + href: ../../core/additional-tools/dnim-cli-layout.md + - name: dnim query products + href: ../../core/additional-tools/dnim-cli-query-products.md + - name: dnim query releases + href: ../../core/additional-tools/dnim-cli-query=releases.md + - name: dnim scan + href: ../../core/additional-tools/dnim-cli-scan.md + - name: dnim trace + href: ../../core/additional-tools/dnim-cli-trace.md + - name: dnim uninstall + href: ../../core/additional-tools/dnim-cli-uninstall.md + - name: dnim update + href: ../../core/additional-tools/dnim-cli-update.md - name: .NET install tool for extension authors href: ../../core/additional-tools/vscode-dotnet-runtime.md - name: Generate self-signed certificates From 2af5c31ff58d444d37938a78fb0ac6113c8ffe22 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Tue, 15 Sep 2026 07:59:35 -0700 Subject: [PATCH 07/31] Build warnings and minor edits --- .../dnim-cli-query-products.md | 2 +- .../dnim-cli-query-releases.md | 24 +++++++------------ docs/core/additional-tools/dnim-cli-update.md | 4 ++-- docs/core/additional-tools/dnim-faq.yml | 14 +++++++---- docs/core/additional-tools/dnim-overview.md | 2 +- .../dnim-cli-download-updates-when-offline.md | 4 ++-- docs/navigate/tools-diagnostics/toc.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/docs/core/additional-tools/dnim-cli-query-products.md b/docs/core/additional-tools/dnim-cli-query-products.md index 2abf349e716f8..b0ec950540889 100644 --- a/docs/core/additional-tools/dnim-cli-query-products.md +++ b/docs/core/additional-tools/dnim-cli-query-products.md @@ -6,7 +6,7 @@ ms.date: 08/11/2026 ai-usage: ai-assisted --- -# dnim query +# dnim query products ## Name diff --git a/docs/core/additional-tools/dnim-cli-query-releases.md b/docs/core/additional-tools/dnim-cli-query-releases.md index 48822f598f791..aea32fa7172c5 100644 --- a/docs/core/additional-tools/dnim-cli-query-releases.md +++ b/docs/core/additional-tools/dnim-cli-query-releases.md @@ -1,20 +1,20 @@ --- -title: dnim query products command +title: dnim query prreleases command description: The query releases command provides information about specific .NET releases. author: joeloff ms.date: 08/11/2026 --- -# dnim query +# dnim query releases ## Name -`dnim-win-[x86|x64|arm64] query products` - Queries release information about specific .NET products. +`dnim-win-[x86|x64|arm64] query releases` - Queries release information about specific .NET products. ## Synopsis ```dotnetcli -dnim-win-[x86|x64|arm64] query products [-a|--accept-license] +dnim-win-[x86|x64|arm64] query releases [-a|--accept-license] [--epv|--except-product-version ] [--esp|--except-support-phase ] [-o|--output-file ] [--offline ] @@ -22,7 +22,7 @@ dnim-win-[x86|x64|arm64] query products [-a|--accept-license] [--sp|--support-phase ] [-v|--verbosity ] -dnim-win-[x86|x64|arm64] query products -?|-h|--help +dnim-win-[x86|x64|arm64] query releases -?|-h|--help ``` ## Description @@ -51,22 +51,16 @@ dnim-win-[x86|x64|arm64] query products -?|-h|--help ## Examples -- Display release information for all products: +- Display all releases include a specific CVE: ```console - dnim-win-[x86|x64|arm64] query products + dnim-win-[x86|x64|arm64] query releases --cve CVE-2026-71328 ``` -- Display release information for all products that are not end-of-life: +- Display the latest releases that are not end-of-life ```console - dnim-win-[x86|x64|arm64] query products --esp eol - ``` - -- Display release information for .NET 7.0 and 9.0 - - ```console - dnim-win-[x86|x64|arm64] query products --pv 7.0 --pv 9.0 + dnim-win-[x86|x64|arm64] query products --esp eol --latest ``` ## See also diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md index ac9946d5f42a3..f2ca1a7e11276 100644 --- a/docs/core/additional-tools/dnim-cli-update.md +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -5,7 +5,7 @@ author: joeloff ms.date: 08/11/2026 --- -# dnim scan +# dnim update ## Name @@ -22,7 +22,7 @@ dnim-win-[x86|x64|arm64] update [-a|--accept-license] [-b|--include-bin-deployed [--sp|--support-phase ] [-v|--verbosity ] -dnim-win-[x86|x64|arm64] scan -?|-h|--help +dnim-win-[x86|x64|arm64] update -?|-h|--help ``` ## Description diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index 76b24f80f1eab..aaba41c2042fb 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -13,14 +13,20 @@ summary: | sections: - name: General questions: + - question: What is the difference between DNIM and the .NET Uninstall tool? + answer: | + - The uninstall tool supports other operating systems like macOS. DNIM is specifically designed for Windows. + - The uninstall tool doesn't support MSI detection or detailed analysis of Visual Studio. + - The uninstall tool doesn't support updating installations. + - question: Does DNIM require internet access? answer: | - It depends. The [`layout`](dnim-cli-layout.md) command needs to download release information and installer executables. Other commands like [`scan`](dnim-cli-scan.md) supports offline execution. + It depends. The [`layout`](dnim-cli-layout.md) command requires internet access to download release information and installer executables. Other commands like [`scan`](dnim-cli-scan.md) supports offline execution. - - question: .NET x.y is EOL. Why doesn't Visual Studio designate it as out-of-support? + - question: .NET x.y is EOL. Why isn't Visual Studio listing it as out-of-support? answer: | - - The out-of-support metadata is unsupported by the version of Visual Studio that installed .NET. The metadata was first introduced in Visual Studio 15.9.27, 16.0.18, 16.4.13, 16.7.3 and 16.8 Preview 3. - - .NET was in support when Visual Studio shipped before going out of support. As a result, the metadata couldn't be updated. + - The out-of-support metadata is unsupported by Visual Studio. The metadata was first introduced in Visual Studio 15.9.27, 16.0.18, 16.4.13, 16.7.3 and 16.8 Preview 3. + - .NET was in support when Visual Studio, but no additional updates of Visual Studio were shipped and the metadata couldn't be updated. - name: Best Practices questions: diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md index 9d021ac7c9712..0f02531c12896 100644 --- a/docs/core/additional-tools/dnim-overview.md +++ b/docs/core/additional-tools/dnim-overview.md @@ -13,7 +13,7 @@ The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remov DNIM ships as a trimmed, single file .NET executable, making it easy to deploy across devices using tools like [Microsoft Configuration Manager](https://learn.microsoft.com/intune/configmgr/). > [!IMPORTANT] -> DNIM does not enforce specific policies. Administrators can use the command-line options to create deployments that best express their organization's compliance policies. +> DNIM doesn't enforce any policies by default. Administrators should use the CLI to create deployments that best express their organization's compliance policies. The tool is data driven and depends on the [release information](https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json) published for .NET. While internet access is required to download the latest release information and updates, administrators can prepare offline deployments for network restricted environments. diff --git a/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md b/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md index 1e51593b65225..a93e016a98c38 100644 --- a/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md +++ b/docs/core/additional-tools/includes/dnim-cli-download-updates-when-offline.md @@ -4,7 +4,7 @@ ms.topic: include --- **`--duwo|--download-updates-when-offline`** -Allow missing updates to be downloaded when offline. +Allow missing updates to be downloaded when offline. > [!TIP] -> This option is useful when DNIM is deployed offline, but Administrators still want devices to update even when they are not connected to a corporate network. For example, a user might take their laptop home before DNIM is deployed. \ No newline at end of file +> This option is useful when DNIM is deployed offline, but Administrators still want devices to update even when they are not connected to a corporate network. For example, a user might take their laptop home before DNIM is deployed. diff --git a/docs/navigate/tools-diagnostics/toc.yml b/docs/navigate/tools-diagnostics/toc.yml index bfbe39811c2cf..eef4c6fcf80bc 100644 --- a/docs/navigate/tools-diagnostics/toc.yml +++ b/docs/navigate/tools-diagnostics/toc.yml @@ -384,7 +384,7 @@ items: - name: dnim query products href: ../../core/additional-tools/dnim-cli-query-products.md - name: dnim query releases - href: ../../core/additional-tools/dnim-cli-query=releases.md + href: ../../core/additional-tools/dnim-cli-query-releases.md - name: dnim scan href: ../../core/additional-tools/dnim-cli-scan.md - name: dnim trace From 4c0f1b8ae0a65808eb45685769fd36689bad3d5c Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Tue, 15 Sep 2026 09:10:33 -0700 Subject: [PATCH 08/31] Update TOC, fix relative URLs --- docs/core/additional-tools/dnim-overview.md | 2 +- docs/navigate/tools-diagnostics/toc.yml | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md index 0f02531c12896..9642b52230dbe 100644 --- a/docs/core/additional-tools/dnim-overview.md +++ b/docs/core/additional-tools/dnim-overview.md @@ -10,7 +10,7 @@ ai-usage: ai-assisted The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove or update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. -DNIM ships as a trimmed, single file .NET executable, making it easy to deploy across devices using tools like [Microsoft Configuration Manager](https://learn.microsoft.com/intune/configmgr/). +DNIM ships as a trimmed, single file .NET executable, making it easy to deploy across devices using tools like [Microsoft Configuration Manager](/intune/configmgr/). > [!IMPORTANT] > DNIM doesn't enforce any policies by default. Administrators should use the CLI to create deployments that best express their organization's compliance policies. diff --git a/docs/navigate/tools-diagnostics/toc.yml b/docs/navigate/tools-diagnostics/toc.yml index eef4c6fcf80bc..cadbace4efa5b 100644 --- a/docs/navigate/tools-diagnostics/toc.yml +++ b/docs/navigate/tools-diagnostics/toc.yml @@ -393,6 +393,10 @@ items: href: ../../core/additional-tools/dnim-cli-uninstall.md - name: dnim update href: ../../core/additional-tools/dnim-cli-update.md + - name: Logging + href: ../../core/additional-tools/dnim-logs.md + - name: FAQ + href: ../../core/additional-tools/dnim-faq.yml - name: .NET install tool for extension authors href: ../../core/additional-tools/vscode-dotnet-runtime.md - name: Generate self-signed certificates From 727883089a6923265b11a3a1d138644eab012547 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Tue, 15 Sep 2026 09:17:52 -0700 Subject: [PATCH 09/31] Remove trailing space --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index dae36242a82de..da43e4ad468d4 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -86,7 +86,7 @@ Bundles are identified using their display names and file information stored in ### MSI Detection -DNIM performs an exhaustive search against the installer component data stored in the registery under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components` to identify .NET MSIs. +DNIM performs an exhaustive search against the installer component data stored in the registery under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components` to identify .NET MSIs. The installer service tracks each component registry ey contains the component ID while its values contain MSI product codes. Both the component ID and product code is stored as packed GUIDs. The example below is of the component associated with `dotnet.exe`. From a0d9e4945c50ca51c2df6082bcd2b5b194e98351 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Tue, 15 Sep 2026 09:24:22 -0700 Subject: [PATCH 10/31] Make URL relative --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index da43e4ad468d4..0726d96b31472 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -35,7 +35,7 @@ Visual Studio can also be used to acquire .NET and uses the same MSIs as the sta The majority of upgrades are handled at the bundle level. The previous version is only removed once the new version is installed. There are two exceptions: the .NET host and ASP.NET Core Module MSIs are updated in place. -Starting with .NET 8, users have the option to [defer](https://learn.microsoft.com/en-us/dotnet/core/install/windows#choose-when-previous-versions-are-removed) removing the version of a bundle. +Starting with .NET 8, users have the option to [defer](/dotnet/core/install/windows#choose-when-previous-versions-are-removed) removing the previous version of a bundle. ## Bundle composition and reference counting From 945f1bf4c85688dd89b2bec2bab3779b34f6478c Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 13:03:01 -0700 Subject: [PATCH 11/31] Fix up CLI command docs --- docs/core/additional-tools/dnim-cli-layout.md | 8 +- .../dnim-cli-query-products.md | 5 + .../dnim-cli-query-releases.md | 7 ++ docs/core/additional-tools/dnim-cli-scan.md | 3 +- docs/core/additional-tools/dnim-cli-trace.md | 1 + .../additional-tools/dnim-cli-uninstall.md | 19 ++-- docs/core/additional-tools/dnim-cli-update.md | 92 ++++++++++++++----- docs/core/additional-tools/dnim-faq.yml | 8 ++ docs/core/additional-tools/dnim-logs.md | 5 +- .../dnim-cli-remove-EOL-versions-from-VS.md | 2 +- 10 files changed, 113 insertions(+), 37 deletions(-) diff --git a/docs/core/additional-tools/dnim-cli-layout.md b/docs/core/additional-tools/dnim-cli-layout.md index e1cccd6c89762..b0fe55ec030ba 100644 --- a/docs/core/additional-tools/dnim-cli-layout.md +++ b/docs/core/additional-tools/dnim-cli-layout.md @@ -26,7 +26,7 @@ dnim-win-[x86|x64|arm64] layout -?|-h|--help ## Description -The command create or updates a cache used for offline deployments inside network restricted environments. +The command creates or updates a cache used for offline deployments inside network restricted environments. The command requires internet access to download the necessary files and will verify the signatures of any installers that are downloaded. Adminitrators should place the files on a machine that is accessible from client devices inside the network. ## Options @@ -42,11 +42,9 @@ The command create or updates a cache used for offline deployments inside networ - [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] -## Results - ## Examples -- Create an offline deployment in `C:\dnim\layout` that only include the release metadata (no installers). +- Create an offline deployment in `C:\dnim\layout` that only includes the release metadata (no installers). ```console dnim-win-[x86|x64|arm64] layout C:\dnim\layout @@ -55,7 +53,7 @@ The command create or updates a cache used for offline deployments inside networ - Create an offline deployment in `C:\dnim\layout` that includes the latest installers. ```console - dnim-win-[x86|x64|arm64] layout C:\dnim\layout --latest + dnim-win-[x86|x64|arm64] layout C:\dnim\layout --include-installers --latest ``` ## See also diff --git a/docs/core/additional-tools/dnim-cli-query-products.md b/docs/core/additional-tools/dnim-cli-query-products.md index b0ec950540889..b771883d8b513 100644 --- a/docs/core/additional-tools/dnim-cli-query-products.md +++ b/docs/core/additional-tools/dnim-cli-query-products.md @@ -28,6 +28,7 @@ dnim-win-[x86|x64|arm64] query products -?|-h|--help ## Description + ## Options - [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] @@ -50,6 +51,10 @@ dnim-win-[x86|x64|arm64] query products -?|-h|--help ## Results +> [!IMPORTANT] +> The information provided by this command depends on the published releases JSON data. + + ## Examples - Display release information for all products: diff --git a/docs/core/additional-tools/dnim-cli-query-releases.md b/docs/core/additional-tools/dnim-cli-query-releases.md index aea32fa7172c5..69034d0595a22 100644 --- a/docs/core/additional-tools/dnim-cli-query-releases.md +++ b/docs/core/additional-tools/dnim-cli-query-releases.md @@ -3,6 +3,7 @@ title: dnim query prreleases command description: The query releases command provides information about specific .NET releases. author: joeloff ms.date: 08/11/2026 +ai-usage: ai-assisted --- # dnim query releases @@ -27,6 +28,10 @@ dnim-win-[x86|x64|arm64] query releases -?|-h|--help ## Description +The command can be used to obtain a summary of available .NET products. + + + ## Options - [!INCLUDE [accept-license](includes/dnim-cli-accept-license.md)] @@ -49,6 +54,8 @@ dnim-win-[x86|x64|arm64] query releases -?|-h|--help ## Results + + ## Examples - Display all releases include a specific CVE: diff --git a/docs/core/additional-tools/dnim-cli-scan.md b/docs/core/additional-tools/dnim-cli-scan.md index 67b173a934516..c37ab6d4b2c31 100644 --- a/docs/core/additional-tools/dnim-cli-scan.md +++ b/docs/core/additional-tools/dnim-cli-scan.md @@ -3,6 +3,7 @@ title: dnim scan command description: The scan command identifies .NET installations. author: joeloff ms.date: 08/11/2026 +ai-usage: ai-assisted --- # dnim scan @@ -57,7 +58,7 @@ Results can be filtered using the product version and support phase options to o ## Results -The results contain a summary of each installation, including its type (MSI, bundle, etc.), the .NET product to which it belongs and its current support phase. It may also include information about its origin. The example below contains three installations: two bundles and one MSI. The targeting pack MSI is shared between both SDK installs and multiple instances of Visual Studio: 17.14.37502 and 17.14.37110. +The results presents a summary of each installation, including its type (MSI, bundle, etc.), the .NET product to which it belongs and its current support phase. It may also include information about its origin. In the example below there are three installations: two bundles and one MSI. The targeting pack MSI is shared between both SDK installs and two instances of Visual Studio: 17.14.37502 and 17.14.37110. | Display Name | Product | Release | Type | Support | Installed By | | --- | --- | --- | --- | --- | --- | diff --git a/docs/core/additional-tools/dnim-cli-trace.md b/docs/core/additional-tools/dnim-cli-trace.md index 3a7ed82a4b07c..4ab8a3954e02a 100644 --- a/docs/core/additional-tools/dnim-cli-trace.md +++ b/docs/core/additional-tools/dnim-cli-trace.md @@ -3,6 +3,7 @@ title: dnim trace command description: The trace command identifies .NET processes. author: joeloff ms.date: 08/11/2026 +ai-usage: ai-assisted --- # dnim trace diff --git a/docs/core/additional-tools/dnim-cli-uninstall.md b/docs/core/additional-tools/dnim-cli-uninstall.md index fedc21421db8f..51d8c384d7dfc 100644 --- a/docs/core/additional-tools/dnim-cli-uninstall.md +++ b/docs/core/additional-tools/dnim-cli-uninstall.md @@ -3,6 +3,7 @@ title: dnim uninstall command description: The uninstall command removes .NET installations. author: joeloff ms.date: 08/11/2026 +ai-usage: ai-assisted --- # dnim uninstall @@ -29,11 +30,12 @@ dnim-win-[x86|x64|arm64] uninstall [-a|--accept-license] [-o|--output-file ] [--offline ] [--offline-revocation-checks] - [--output-format ] + [--output-format ] [--pv|--product-version ] [--remove-EOL-versions-from-VS] [--remove-orphaned-installs] - [--ri|report-issues] + [--restore-point-suffix|--rps ] + [--ri|--report-issues] [--rv|--release-version ] [--sp|--support-phase ] [-v|--verbosity ] @@ -58,6 +60,8 @@ Various options can be used to target specific installations. For example, an ad - [!INCLUDE [bin-deployed-installs](includes/dnim-cli-include-bin-deployed-installs.md)] +- [!INCLUDE [create-system-restore-point](includes/dnim-cli-create-system-restore-point.md)] + - [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] - [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] @@ -86,10 +90,12 @@ Various options can be used to target specific installations. For example, an ad - [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] -- [!INCLUDE [remove-EOL-versions-from-VS](includes/dnim-cli-remove-EOL-versions-from-VS.md)] +- [!INCLUDE [remove-EOL-versions-from-VS](includes/dnim-cli-remove-eol-versions-from-vs.md)] - [!INCLUDE [remove-orphaned-installs](includes/dnim-cli-remove-orphaned-installs.md)] +- [!INCLUDE [restore-point-suffix](includes/dnim-cli-restore-point-suffix.md)] + - [!INCLUDE [report-issues](includes/dnim-cli-report-issues.md)] - [!INCLUDE [release-version](includes/dnim-cli-release-version.md)] @@ -132,8 +138,7 @@ The table below contains an overview of the policies created from the command-li ### Example -Consider the following command-line: `dnim-win-x64 uninstall --pv 6.0`. The command only considers installations -associated with .NET 6.0 for removal. When the tool evaluates a .NET 7.0 installation, the product version policies will apply and exclude it. +Consider the following command-line: `dnim-win-x64 uninstall --pv 6.0`. The command only considers installations associated with .NET 6.0. When the tool evaluates a .NET 7.0 installation, the product version policy applies and excludes it. ## Policy Results @@ -171,13 +176,13 @@ a description for the various policy actions returned by the `uninstall` command dnim-win-[x86|x64|arm64] uninstall --sp eol ``` -- Remove all .NET installs, but retain the latest version for products that are in active support. +- Remove all .NET installs, but retain the latest version for any products that are in active support if they are installed. ```console dnim-win-[x86|x64|arm64] uninstall --klsp active ``` - Assume .NET 9 and 8 are in active support and the latest releases include 9.0.19 and 8.0.30. If a device contains .NET 9.0.17 and 8.0.30, the command will remove 9.0.17, but retain 8.0.30. + Assume .NET 9 and 8 are in active support and when the command was executed, the latest releases included 9.0.19 and 8.0.30. If a device has .NET 9.0.17 and 8.0.30 installed, the command will remove 9.0.17, but retain 8.0.30. - Remove all SDK bundles if their release version is less than 10.0.0. diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md index f2ca1a7e11276..b58c9188070a5 100644 --- a/docs/core/additional-tools/dnim-cli-update.md +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -2,7 +2,8 @@ title: dnim update command description: The update command updates existing .NET installations. author: joeloff -ms.date: 08/11/2026 +ms.date: 09/16/2026 +ai-usage: ai-assisted --- # dnim update @@ -14,13 +15,34 @@ ms.date: 08/11/2026 ## Synopsis ```dotnetcli -dnim-win-[x86|x64|arm64] update [-a|--accept-license] [-b|--include-bin-deployed-installs] - [--epv|--except-product-version ] +dnim-win-[x86|x64|arm64] update [-a|--accept-license] + [-b|--include-bin-deployed-installs] + [--csrp|--create-system-restore-point] + [--epv|--except-product-version ] [--esp|--except-support-phase ] - [-l|--log-file ] [-o|--output-file ] [--offline ] - [--output-format ] [--pv|--product-version ] + [--ignore-dependents] + [--it|--install-type ] + [--klpv|--keep-latest-product-version ] + [--klsp|--keep-latest-support-phase ] + [-l|--log-file ] + [--log-extra-debug-information, --lx] + [--no-wua] + [-o|--output-file ] + [--offline ] + [--offline-revocation-checks] + [--output-format ] + [--pv|--product-version ] + [--remove-EOL-versions-from-VS] + [--remove-orphaned-installs] + [--restore-point-suffix|--rps ] + [--ri|--report-issues] + [--rv|--release-version ] [--sp|--support-phase ] + [--update-discontinued-sdks] + [--update-EOL-versions] [-v|--verbosity ] + [--verify-signatures ] + [--what-if] dnim-win-[x86|x64|arm64] update -?|-h|--help ``` @@ -29,7 +51,9 @@ dnim-win-[x86|x64|arm64] update -?|-h|--help The `update` command detects, classifies, removes and updates .NET installations on Windows. MSIs and bundles are detected by default. Bin deployed (xcopy/zip) installs under `Program Files` can be detected using the `--include-bin-deployed-installs` option. -Results can be filtered using the product version and support phase options to only include installations matching the specified criteria. Results are written to both the console and diagnostic log. Additional output formats are available and include JSON, HTML and CSV. +The command can target specific products based on their product version, support phase, type and release version. Only standalone bundles can be updated. Installations of .NET that came from Visual Studio will require you to update Visual Studio. DNIM will not update Visual Studio. + +The command will first remove any applicable installs before applying updates. This approach yields better results to meet compliance goals and reduce the need for secondary deployments to remove old copies of .NET. ## Options @@ -37,52 +61,78 @@ Results can be filtered using the product version and support phase options to o - [!INCLUDE [bin-deployed-installs](includes/dnim-cli-include-bin-deployed-installs.md)] +- [!INCLUDE [create-system-restore-point](includes/dnim-cli-create-system-restore-point.md)] + - [!INCLUDE [except-product-version](includes/dnim-cli-except-product-version.md)] - [!INCLUDE [except-support-phase](includes/dnim-cli-except-support-phase.md)] +- [!INCLUDE [ignore-dependents](includes/dnim-cli-ignore-dependents.md)] + +- [!INCLUDE [install-type](includes/dnim-cli-install-type.md)] + +- [!INCLUDE [keep-latest-product-version](includes/dnim-cli-keep-latest-product-version.md)] + +- [!INCLUDE [keep-latest-support-phase](includes/dnim-cli-keep-latest-support-phase.md)] + - [!INCLUDE [log-file](includes/dnim-cli-log-file.md)] +- [!INCLUDE [log-extra-debug-information](includes/dnim-cli-log-extra-debug-information.md)] + +- [!INCLUDE [no-wua](includes/dnim-cli-no-wua.md)] + - [!INCLUDE [output-file](includes/dnim-cli-output-file.md)] - [!INCLUDE [offline](includes/dnim-cli-offline.md)] +- [!INCLUDE [offline-revocation-checks](includes/dnim-cli-offline-revocation-checks.md)] + - [!INCLUDE [output-format](includes/dnim-cli-output-format.md)] - [!INCLUDE [product-version](includes/dnim-cli-product-version.md)] +- [!INCLUDE [remove-EOL-versions-from-VS](includes/dnim-cli-remove-eol-versions-from-vs.md)] + +- [!INCLUDE [remove-orphaned-installs](includes/dnim-cli-remove-orphaned-installs.md)] + +- [!INCLUDE [report-issues](includes/dnim-cli-report-issues.md)] + +- [!INCLUDE [release-version](includes/dnim-cli-release-version.md)] + - [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] +- [!INCLUDE [update-discontinued-sdks](include/dnim-cli-update-discontinued-sdks.md)] + +- [!INCLUDE [update-EOL-versions](include/dnim-cli-update-discontinued-sdks.md)] + - [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] +- [!INCLUDE [verify-signatures](includes/dnim-cli-verify-signatures.md)] + +- [!INCLUDE [what-if](includes/dnim-cli-what-if.md)] + ## Results -The results contain detailed information about each installation, including its type (MSI, bundle, etc.), the .NET product to which it belongs and its current support phase. It may also include information about its origin. The example below contains three installations: two bundles and one MSI. The targeting pack MSI is shared between both SDK installs and multiple instances of Visual Studio: 17.14.37502 and 17.14.37110. +The results are similar to that of the uninstall command, but additional columns showing the update action and target version are included. -| Display Name | Product | Release | Type | Support | Installed By | -| --- | --- | --- | --- | --- | --- | -| Microsoft .NET SDK 6.0.136 (x64) | 6.0 | 6.0.136 | Bundle | EOL | | -| Microsoft .NET SDK 6.0.428 (x64) | 6.0 | 6.0.428 | Bundle | EOL | | -| Microsoft Windows Desktop Targeting Pack - 6.0.36 (x64) | 6.0 | 6.0.36 | Msi | EOL | VS 17.14.37502, VS 17.14.37110, Microsoft .NET SDK 6.0.428 (x64), Microsoft .NET SDK 6.0.136 (x64) | +| Display Name | Release | Type | Support | Uninstall Action | Update Action | Update Version | +| --- | --- | --- | --- | --- | --- | --- | +| Microsoft Windows Desktop Runtime 11.0.0 (x64) | 11.0.0-preview.7.26381.103 | Bundle | GoLive | Uninstall | Update | 11.0.0-rc.1.26425.128 | ## Examples -- Scan and report all .NET installations: +- Update .NET installs: ```console - dnim-win-[x86|x64|arm64] scan + dnim-win-[x86|x64|arm64] update ``` -- Scan and report .NET installations that are in active support: +- Updated all the .NET 8.0 installations, including discontinued SDKs. ```console - dnim-win-[x86|x64|arm64] scan --sp active + dnim-win-[x86|x64|arm64] update --update-discontinued-sdk --pv 8.0 ``` -- Scan for end-of-life (EOL) installations of .NET and write the results to an HTML file: - - ```console - dnim-win-[x86|x64|arm64] scan --sp eol -o report.html --output-format html - ``` + Assume 8.0.31 is the latest .NET 8 release. It includes updates for both the 8.0.1xx and 8.0.4xx SDKs. The 8.0.2xx and 8.0.3xx SDKs are no longer produced and considered discontinued. If a device has the 8.0.202 SDK installed, DNIM can install the 8.0.425 SDK and remove the 8.0.202 SDK. ## See also diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index aaba41c2042fb..69a9fc6da163c 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -28,6 +28,14 @@ sections: - The out-of-support metadata is unsupported by Visual Studio. The metadata was first introduced in Visual Studio 15.9.27, 16.0.18, 16.4.13, 16.7.3 and 16.8 Preview 3. - .NET was in support when Visual Studio, but no additional updates of Visual Studio were shipped and the metadata couldn't be updated. + - question: Does DNIM report the ASP.NET Core Module? + answer: | + No. The ANCM MSI is not currently being reported. + + - question: Why is the SDK placeholder MSI being reported? + answer: | + MSIs shipping with Visual Studio are usually hidden from the Programs and Features list (ARP). When .NET Core 3.0 began shipping MSIs in Visual Studio, a placeholder MSI was added to create a visible entry in ARP and direct users to remove the SDK through Visual Studio. The MSI can become orphaned and users can be left with multiple entries alluding to SDKs installed by Visual Studio when infact they only of a few. This has created confusion for users trying to remove non-existing SDKs. DNIM is able to detect and remove these orphaned placeholders. + - name: Best Practices questions: - question: What is the recommended approach to remove end-of-life versions of .NET? diff --git a/docs/core/additional-tools/dnim-logs.md b/docs/core/additional-tools/dnim-logs.md index 5174f452e920a..1405bc7b5ffc3 100644 --- a/docs/core/additional-tools/dnim-logs.md +++ b/docs/core/additional-tools/dnim-logs.md @@ -3,6 +3,7 @@ title: .NET Install Manager Logging description: An overview of various logs provided by DNIM. author: joeloff ms.date: 08/11/2026 +ai-usage: ai-assisted --- # Logging @@ -29,7 +30,7 @@ In the previous example, `d1000` indicates a diagnostic message with event ID 10 ## Registry -DNIM stores information about it's last execution in the registry. The data is stored under `HKCU\Software\Microsoft\DNIM` or `HKLM\Software\Microsoft\DNIM`. The latter key is used if the command was executed with administrator premissions. +DNIM stores information about its last execution in the registry. The data is stored under `HKCU\Software\Microsoft\DNIM` or `HKLM\Software\Microsoft\DNIM` (if the command was executed with administrator permissions). ```console D:\>reg query HKCU\Software\Microsoft\DNIM /s @@ -47,7 +48,7 @@ HKEY_CURRENT_USER\Software\Microsoft\DNIM\License ## Events -Commands that modify the state of a device may create one or more entry in the Windows Application log. The event source will be designated `DNIM`. +Commands that modify the state of a device will generate events in the Windows Application log using `DNIM` as the event source. ![DNIM Start Event](./media/dnim/eventlog.png) diff --git a/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md b/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md index c05ba57a51cda..380caf50c104c 100644 --- a/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md +++ b/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md @@ -4,7 +4,7 @@ ms.topic: include --- **`--remove-EOL-versions-from-VS`** -Remove end-of-life .NET installations installed by Visual Studio when every Visual Studio instance that installed them designates them as out of support. +Remove end-of-life .NET installations installed by Visual Studio if every Visual Studio instance designates the installation as out of support. > [!NOTE] > Starting with Visual Studio 15.9.27, 16.0.18, 16.4.13, 16.7.3 and 16.8 Preview 3, packages and components can be designated as out-of-support. Visual Studio will not reinstall out-of-support packages that have been manually uninstalled. From aaca6348273ee1e7183c9853b0b549729997c3b7 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 13:19:03 -0700 Subject: [PATCH 12/31] rename --- .../includes/{dnim-cli-remove-EOL-versions-from-VS.md => x.md} | 0 .../includes/{dnim-cli-update-EOL-versions.md => y.md} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename docs/core/additional-tools/includes/{dnim-cli-remove-EOL-versions-from-VS.md => x.md} (100%) rename docs/core/additional-tools/includes/{dnim-cli-update-EOL-versions.md => y.md} (100%) diff --git a/docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md b/docs/core/additional-tools/includes/x.md similarity index 100% rename from docs/core/additional-tools/includes/dnim-cli-remove-EOL-versions-from-VS.md rename to docs/core/additional-tools/includes/x.md diff --git a/docs/core/additional-tools/includes/dnim-cli-update-EOL-versions.md b/docs/core/additional-tools/includes/y.md similarity index 100% rename from docs/core/additional-tools/includes/dnim-cli-update-EOL-versions.md rename to docs/core/additional-tools/includes/y.md From 593d8579e63076f8a7e20da459543f3ca230848b Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 13:19:41 -0700 Subject: [PATCH 13/31] rename pt2 --- .../includes/{x.md => dnim-cli-remove-eol-versions-from-VS.md} | 0 .../includes/{y.md => dnim-cli-update-eol-versions.md} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename docs/core/additional-tools/includes/{x.md => dnim-cli-remove-eol-versions-from-VS.md} (100%) rename docs/core/additional-tools/includes/{y.md => dnim-cli-update-eol-versions.md} (100%) diff --git a/docs/core/additional-tools/includes/x.md b/docs/core/additional-tools/includes/dnim-cli-remove-eol-versions-from-VS.md similarity index 100% rename from docs/core/additional-tools/includes/x.md rename to docs/core/additional-tools/includes/dnim-cli-remove-eol-versions-from-VS.md diff --git a/docs/core/additional-tools/includes/y.md b/docs/core/additional-tools/includes/dnim-cli-update-eol-versions.md similarity index 100% rename from docs/core/additional-tools/includes/y.md rename to docs/core/additional-tools/includes/dnim-cli-update-eol-versions.md From ed3096f8d7cd7ebce85ecf5c0c27e003d3aa9fed Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 13:29:51 -0700 Subject: [PATCH 14/31] rename pt1 --- .../includes/{dnim-cli-remove-eol-versions-from-VS.md => x.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename docs/core/additional-tools/includes/{dnim-cli-remove-eol-versions-from-VS.md => x.md} (100%) diff --git a/docs/core/additional-tools/includes/dnim-cli-remove-eol-versions-from-VS.md b/docs/core/additional-tools/includes/x.md similarity index 100% rename from docs/core/additional-tools/includes/dnim-cli-remove-eol-versions-from-VS.md rename to docs/core/additional-tools/includes/x.md From 0159f834229b9244a106768c011b089e70feb9a7 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 13:30:27 -0700 Subject: [PATCH 15/31] rename pt2 --- .../includes/{x.md => dnim-cli-remove-eol-versions-from-vs.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename docs/core/additional-tools/includes/{x.md => dnim-cli-remove-eol-versions-from-vs.md} (100%) diff --git a/docs/core/additional-tools/includes/x.md b/docs/core/additional-tools/includes/dnim-cli-remove-eol-versions-from-vs.md similarity index 100% rename from docs/core/additional-tools/includes/x.md rename to docs/core/additional-tools/includes/dnim-cli-remove-eol-versions-from-vs.md From 63ca343fd1a70ee8c219dc56375283bc0ad3352b Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 13:30:42 -0700 Subject: [PATCH 16/31] Fix include paths --- docs/core/additional-tools/dnim-cli-update.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md index b58c9188070a5..ad3987f8eebf5 100644 --- a/docs/core/additional-tools/dnim-cli-update.md +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -101,9 +101,9 @@ The command will first remove any applicable installs before applying updates. T - [!INCLUDE [support-phase](includes/dnim-cli-support-phase.md)] -- [!INCLUDE [update-discontinued-sdks](include/dnim-cli-update-discontinued-sdks.md)] +- [!INCLUDE [update-discontinued-sdks](includes/dnim-cli-update-discontinued-sdks.md)] -- [!INCLUDE [update-EOL-versions](include/dnim-cli-update-discontinued-sdks.md)] +- [!INCLUDE [update-EOL-versions](includes/dnim-cli-update-eol-versions.md)] - [!INCLUDE [verbosity](includes/dnim-cli-verbosity.md)] From 62b6d95da85b16c45420cdf1224896fb42f09279 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 16:47:06 -0700 Subject: [PATCH 17/31] Update docs/core/additional-tools/index.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/index.md b/docs/core/additional-tools/index.md index 285c544a0d55f..4374c76450b1b 100644 --- a/docs/core/additional-tools/index.md +++ b/docs/core/additional-tools/index.md @@ -57,4 +57,4 @@ You can use [dotnet-coverage](dotnet-coverage.md) to collect [code coverage](../ ## .NET Install Manager -Use the [.NET Install Manager](dnim-overview.md) to detect, uninstall or update .NET installations on Windows to remediate devices flagged by software vulnerability scanners. +Use the [.NET Install Manager](dnim-overview.md) to detect, uninstall, or update .NET installations on Windows to remediate devices flagged by software vulnerability scanners. From 906c233ae9d30211eec5128b446706e8999165d3 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:25:19 -0700 Subject: [PATCH 18/31] Update docs/core/additional-tools/dnim-faq.yml Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index 69a9fc6da163c..e869e9ec010a8 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -8,7 +8,7 @@ metadata: title: .NET Install Manager FAQ summary: | - The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove or update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. + The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove, and update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. sections: - name: General From 743838ef8226dfa9facaaf0503fc2059c0c2bbd0 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:25:35 -0700 Subject: [PATCH 19/31] Update docs/core/additional-tools/dnim-net-installs.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index 0726d96b31472..e7e1e470acf56 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -1,6 +1,6 @@ --- title: Managed .NET installations on Windows -description: Provides a technical overview of .NET installations on windows, including composition and reference counting. +description: Provides a technical overview of .NET installations on Windows, including composition and reference counting. author: joeloff ms.date: 09/14/2026 ai-usage: ai-assisted From 02de65ca1259abacb2135d489c1576237d648424 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:25:59 -0700 Subject: [PATCH 20/31] Update docs/core/additional-tools/dnim-net-installs.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index e7e1e470acf56..7eb1be05fe4d0 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -14,7 +14,7 @@ On Windows, .NET components like the runtime and SDK consist of multiple MSIs. I ## Acquiring .NET on Windows -- Standalone bundles (EXEs) can be downloaded from [.NET](https://dotnet.microsoft.com/download). +- Standalone bundles (EXEs) can be downloaded from [the .NET website](https://dotnet.microsoft.com/download). - WinGet provides packages that contain the .NET bundles. - Servicing updates distribute the bundles through Microsoft Update using automatic updates, WSUS and the Windows Update Catalog. - Independent software vendors (ISVs) may redistribute .NET bundles as part of their software. From 411a5228a7c20a59c52c6a1920aa74583b236f72 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:26:26 -0700 Subject: [PATCH 21/31] Update docs/core/additional-tools/dnim-net-installs.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index 7eb1be05fe4d0..36ade0b92d736 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -111,7 +111,7 @@ Because DNIM performs an exhaustive search of installer components, any files un Incorrect classification of installations can result in removing or retaining the wrong installation, potentially breaking applications or leaving devices in a non-compliant state. -Once a product (e.g., NET 10) is identified, additional information like its release (e.g., 10.0.4) and support phase (e.g., active) can be determined. This allows administrators to create flexible deploymentss. +Once a product (for example, NET 10) is identified, additional information like its release (for example, 10.0.4) and support phase (for example, active) can be determined. This allows administrators to create flexible deployments. Installations are further classified according to their .NET component (ASP.NET Core, SDK, etc.), architecure and type of installation (bundle, MSI, or bin deployed). From f644bea4c43831b84db9c89ed199e079cbc7c742 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:26:39 -0700 Subject: [PATCH 22/31] Update docs/core/additional-tools/dnim-net-installs.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index 36ade0b92d736..e19259765e958 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -113,7 +113,7 @@ Incorrect classification of installations can result in removing or retaining th Once a product (for example, NET 10) is identified, additional information like its release (for example, 10.0.4) and support phase (for example, active) can be determined. This allows administrators to create flexible deployments. -Installations are further classified according to their .NET component (ASP.NET Core, SDK, etc.), architecure and type of installation (bundle, MSI, or bin deployed). +Installations are further classified according to their .NET component (ASP.NET Core, SDK, etc.), architecture, and type of installation (bundle, MSI, or bin deployed). There are some special cases worth mentioning. From e543f387b5434d4be777a2b2b1ca4eca225260bb Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:27:32 -0700 Subject: [PATCH 23/31] Update docs/core/additional-tools/dnim-net-installs.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index e19259765e958..885b18d18c084 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -119,7 +119,7 @@ There are some special cases worth mentioning. ### .NET Standard 2.1 -Ensuring consistent behavior requires installations to define their product, release and support phase. The targeting pack for .NET Standard 2.1 presents an interesting challenge. It doesn't contain executable code and only provides reference assemblies for the APIs defined by the standard. The targeting pack first shipped as part of the .NET Core 3.0.100 SDK, but was included in every subsequent SDKs until .NET 10. While DNIM will classify the release and product under .NET Core 3.0, the support phase is always reported as active since it may be included in SDKs that are in active support. +Ensuring consistent behavior requires installations to define their product, release, and support phase. The targeting pack for .NET Standard 2.1 presents an interesting challenge. It doesn't contain executable code and only provides reference assemblies for the APIs defined by the standard. The targeting pack first shipped as part of the .NET Core 3.0.100 SDK, but was included in every subsequent SDKs until .NET 10. While DNIM will classify the release and product under .NET Core 3.0, the support phase is always reported as active since it may be included in SDKs that are in active support. > [!NOTE] > The .NET Standard 2.1 targeting pack was removed from the SDK installation in .NET 10. SDKs automatically download missing targeting packs using NuGet packages when building applications. From c2dbfdfe715d3beece558573132ce5c06e66f4b2 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:27:48 -0700 Subject: [PATCH 24/31] Update docs/core/additional-tools/dnim-overview.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md index 9642b52230dbe..4b0448900bee1 100644 --- a/docs/core/additional-tools/dnim-overview.md +++ b/docs/core/additional-tools/dnim-overview.md @@ -8,7 +8,7 @@ ai-usage: ai-assisted # .NET Install Manager overview -The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove or update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. +The .NET Install Manager (*DNIM*) is a command-line tool used to identify, remove, and update .NET installations on Windows. It's primarily intended to assist organizations in removing vulnerable copies of .NET from devices to meet compliance targets. DNIM ships as a trimmed, single file .NET executable, making it easy to deploy across devices using tools like [Microsoft Configuration Manager](/intune/configmgr/). From f39b0d534bfaad9e453db5f51792c15bf89e7c7d Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:27:59 -0700 Subject: [PATCH 25/31] Update docs/core/additional-tools/dnim-net-installs.md Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/core/additional-tools/dnim-net-installs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/core/additional-tools/dnim-net-installs.md b/docs/core/additional-tools/dnim-net-installs.md index 885b18d18c084..c77f183e28286 100644 --- a/docs/core/additional-tools/dnim-net-installs.md +++ b/docs/core/additional-tools/dnim-net-installs.md @@ -124,7 +124,7 @@ Ensuring consistent behavior requires installations to define their product, rel > [!NOTE] > The .NET Standard 2.1 targeting pack was removed from the SDK installation in .NET 10. SDKs automatically download missing targeting packs using NuGet packages when building applications. -### .NET SDK Feature bands +### .NET SDK feature bands In .NET Core 1.0 and 1.1, SDKs used a versioning scheme similar to the runime. The last SDK in .NET Core 1.1 was versioned as 1.1.14 and included the 1.1.13 runtime. From a91493a15c4f9773fbf75daeab661b8a50f26532 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:28:40 -0700 Subject: [PATCH 26/31] Update classification --- docfx.json | 1 + 1 file changed, 1 insertion(+) diff --git a/docfx.json b/docfx.json index 6f8aa8d29e332..e839e072dad42 100644 --- a/docfx.json +++ b/docfx.json @@ -222,6 +222,7 @@ "_vblang/spec/*.md": "language-reference", "docs/architecture/**/*.md": "concept-article", "docs/azure/migration/**/*.md": "upgrade-and-migration-article", + "docs/core/additional-tools/dnim*.md": "reference", "docs/core/compatibility/**/*.md": "concept-article", "docs/core/deploying/native-aot/warnings/**.md": "error-reference", "docs/core/deploying/single-file/warnings/**.md": "error-reference", From 95f7ace3dde995f24814d75f0b8c9ccc1d9dda34 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:53:57 -0700 Subject: [PATCH 27/31] Fix lint errors --- .../dnim-cli-query-products.md | 21 ++++++++++---- .../dnim-cli-query-releases.md | 28 +++++++++++++++---- 2 files changed, 38 insertions(+), 11 deletions(-) diff --git a/docs/core/additional-tools/dnim-cli-query-products.md b/docs/core/additional-tools/dnim-cli-query-products.md index b771883d8b513..2583213280257 100644 --- a/docs/core/additional-tools/dnim-cli-query-products.md +++ b/docs/core/additional-tools/dnim-cli-query-products.md @@ -28,6 +28,10 @@ dnim-win-[x86|x64|arm64] query products -?|-h|--help ## Description +The command provides a summary of .NET products, including the latest versions, support phase and expected end-of-life date. + +> [!IMPORTANT] +> The information provided by this command depends on the published releases JSON data. ## Options @@ -51,28 +55,35 @@ dnim-win-[x86|x64|arm64] query products -?|-h|--help ## Results -> [!IMPORTANT] -> The information provided by this command depends on the published releases JSON data. +The example below lists all products whose support phase is not `eol`. The security update column indicates whether the latest release addressed security vulnerabilities. The [`query releases`](dnim-cli-query-releases.md) command can be used to obtain a list of vulnerabilities addressed by the latest release. +| Version | Support | Release type | Latest release | Latest release date | Latest SDK | Latest runtime | End of support | Security update | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +| 11.0 | GoLive | STS | 11.0.0-rc.1 | 9/8/2026 | 11.0.100-rc.1.26425.128 | 11.0.0-rc.1.26425.128 | n/a | True | +| 10.0 | Active | LTS | 10.0.12 | 9/8/2026 | 10.0.401 | 10.0.12 | 11/14/2028 | True | +| 9.0 | Maintenance | STS | 9.0.20 | 9/8/2026 | 9.0.318 | 9.0.20 | 11/10/2026 | True | +| 8.0 | Maintenance | LTS | 8.0.31 | 9/8/2026 | 8.0.425 | 8.0.31 | 11/10/2026 | True | ## Examples -- Display release information for all products: +- Display information for all .NET products. ```console dnim-win-[x86|x64|arm64] query products ``` -- Display release information for all products that are not end-of-life: +- Display information for all products that are not end-of-life: ```console dnim-win-[x86|x64|arm64] query products --esp eol ``` -- Display release information for .NET 7.0 and 9.0 +- Only display information for the .NET 7.0 and 9.0 products. ```console dnim-win-[x86|x64|arm64] query products --pv 7.0 --pv 9.0 ``` ## See also + +The [`query-releases`](dnim-cli-query-releases.md) command. diff --git a/docs/core/additional-tools/dnim-cli-query-releases.md b/docs/core/additional-tools/dnim-cli-query-releases.md index 69034d0595a22..86bfc61da7c04 100644 --- a/docs/core/additional-tools/dnim-cli-query-releases.md +++ b/docs/core/additional-tools/dnim-cli-query-releases.md @@ -28,9 +28,10 @@ dnim-win-[x86|x64|arm64] query releases -?|-h|--help ## Description -The command can be used to obtain a summary of available .NET products. - +The command can be used to obtain information for specific .NET releases. +> [!IMPORTANT] +> The information provided by this command depends on the published releases JSON data. ## Options @@ -54,20 +55,35 @@ The command can be used to obtain a summary of available .NET products. ## Results - +The example below shows the latest release information for .NET Core 3.1. + +```console +Version: 3.1.32 +Release date: 12/13/2022 +Release notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.32/3.1.32.md +Security: True +CVEs: + CVE-2022-41089, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41089 +SDK 3.1.426 + ASP.NET Core Runtime 3.1.32 + .NET Core Runtime 3.1.32 + Desktop Runtime 3.1.32 +``` ## Examples -- Display all releases include a specific CVE: +- Display all releases that addressed a specific CVE: ```console dnim-win-[x86|x64|arm64] query releases --cve CVE-2026-71328 ``` -- Display the latest releases that are not end-of-life +- Display the latest releases available for all products that are not end-of-life. ```console - dnim-win-[x86|x64|arm64] query products --esp eol --latest + dnim-win-[x86|x64|arm64] query release --esp eol --latest ``` ## See also + +The [`query products`](dnim-cli-query-products.md) command. From 2705120cca5da7fb5371962765fba9efb0945da7 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 21:58:08 -0700 Subject: [PATCH 28/31] Add aka.ms link for DLC --- docs/core/additional-tools/dnim-overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md index 4b0448900bee1..fc0a3ac845ff1 100644 --- a/docs/core/additional-tools/dnim-overview.md +++ b/docs/core/additional-tools/dnim-overview.md @@ -17,6 +17,10 @@ DNIM ships as a trimmed, single file .NET executable, making it easy to deploy a The tool is data driven and depends on the [release information](https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json) published for .NET. While internet access is required to download the latest release information and updates, administrators can prepare offline deployments for network restricted environments. +## Download + +The latest release can be found on the [Microsoft Download Center](https://aka.ms/dnim). + ## Support > [!IMPORTANT] From df7a92ebd969bc870fce2520252188b01e8ee073 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Wed, 16 Sep 2026 22:28:47 -0700 Subject: [PATCH 29/31] Minor updates --- docs/core/additional-tools/dnim-cli-scan.md | 2 ++ docs/core/additional-tools/dnim-cli-uninstall.md | 2 ++ docs/core/additional-tools/dnim-cli-update.md | 2 ++ docs/core/additional-tools/dnim-faq.yml | 13 +++++++++++-- docs/core/additional-tools/dnim-overview.md | 4 ++++ 5 files changed, 21 insertions(+), 2 deletions(-) diff --git a/docs/core/additional-tools/dnim-cli-scan.md b/docs/core/additional-tools/dnim-cli-scan.md index c37ab6d4b2c31..cfc12e64f78bf 100644 --- a/docs/core/additional-tools/dnim-cli-scan.md +++ b/docs/core/additional-tools/dnim-cli-scan.md @@ -87,3 +87,5 @@ The results presents a summary of each installation, including its type (MSI, bu ``` ## See also + +[.NET Installs](dnim-net-installs.md) diff --git a/docs/core/additional-tools/dnim-cli-uninstall.md b/docs/core/additional-tools/dnim-cli-uninstall.md index 51d8c384d7dfc..dff3ab4d382b2 100644 --- a/docs/core/additional-tools/dnim-cli-uninstall.md +++ b/docs/core/additional-tools/dnim-cli-uninstall.md @@ -191,3 +191,5 @@ a description for the various policy actions returned by the `uninstall` command ``` ## See also + +[.NET Installs](dnim-net-installs.md) diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md index ad3987f8eebf5..69f2bdd750d6e 100644 --- a/docs/core/additional-tools/dnim-cli-update.md +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -136,3 +136,5 @@ The results are similar to that of the uninstall command, but additional columns Assume 8.0.31 is the latest .NET 8 release. It includes updates for both the 8.0.1xx and 8.0.4xx SDKs. The 8.0.2xx and 8.0.3xx SDKs are no longer produced and considered discontinued. If a device has the 8.0.202 SDK installed, DNIM can install the 8.0.425 SDK and remove the 8.0.202 SDK. ## See also + +[.NET Installs](dnim-net-installs.md) diff --git a/docs/core/additional-tools/dnim-faq.yml b/docs/core/additional-tools/dnim-faq.yml index e869e9ec010a8..d281b86045319 100644 --- a/docs/core/additional-tools/dnim-faq.yml +++ b/docs/core/additional-tools/dnim-faq.yml @@ -15,9 +15,12 @@ sections: questions: - question: What is the difference between DNIM and the .NET Uninstall tool? answer: | + - The uninstall is targeted to developers to assist with cleaning up old SDKs and runtimes. - The uninstall tool supports other operating systems like macOS. DNIM is specifically designed for Windows. - The uninstall tool doesn't support MSI detection or detailed analysis of Visual Studio. - The uninstall tool doesn't support updating installations. + - DNIM provides strong diagnostic capabilities, including the ability to identify .NET processes and runtime versions. + - DNIM was designed to work with deployment tools like Intune inside large enterprise environments. - question: Does DNIM require internet access? answer: | @@ -41,8 +44,14 @@ sections: - question: What is the recommended approach to remove end-of-life versions of .NET? answer: | - Start with a small pilot to gather information and understand the state of devices. - - Consider using [Visual Studio](https://learn.microsoft.com/visualstudio/install/update-visual-studio?view=visualstudio#remove-out-of-support-components) to remove old .NET components it installed. - - Deploy DNIM using `--sp eol` and remove any installs that were left behind or orphaned using `--remove-orphaned-installs` and `--remove-EOL-versions-from-VS`. + - To gather live data, you can push deploytments of the `uninstall` and `update` commands that include the `--what-if` option. To minimize risk, consider using Windows Sandbox to set up a controlled environment where you can install .NET and experiment with the CLI. + - If devices acquire .NET through Visual Studio, consider using [Visual Studio](https://learn.microsoft.com/visualstudio/install/update-visual-studio?view=visualstudio#remove-out-of-support-components) to remove old .NET components. + - Use Microsoft Update to patch .NET copies installed by the standalone bundles. + - Deploy DNIM to clean up any remaining installs using `--sp eol`. If a more agressive cleanup is required, consider including the `--remove-orphaned-installs` and `--remove-EOL-versions-from-VS` options. + + - question: Can DNIM be used instead of Microsoft Update? + answer: | + It is recommended to continue using Microsoft Update. DNIM can be used to manage updates when Windows do not offer automatic updates for .NET, for example Windows insiders. - name: Troubleshooting questions: diff --git a/docs/core/additional-tools/dnim-overview.md b/docs/core/additional-tools/dnim-overview.md index fc0a3ac845ff1..533c60885af17 100644 --- a/docs/core/additional-tools/dnim-overview.md +++ b/docs/core/additional-tools/dnim-overview.md @@ -21,6 +21,10 @@ The tool is data driven and depends on the [release information](https://builds. The latest release can be found on the [Microsoft Download Center](https://aka.ms/dnim). +## System Requirements + +DNIM is currently built using .NET 8 and compatible with all versions of Windows supported by .NET 8. + ## Support > [!IMPORTANT] From 372de13ccfd9eb166551f488d9142cdadde54d22 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Thu, 17 Sep 2026 09:39:31 -0700 Subject: [PATCH 30/31] Add Caution bubbles for uninstall/update --- docs/core/additional-tools/dnim-cli-uninstall.md | 3 +++ docs/core/additional-tools/dnim-cli-update.md | 3 +++ 2 files changed, 6 insertions(+) diff --git a/docs/core/additional-tools/dnim-cli-uninstall.md b/docs/core/additional-tools/dnim-cli-uninstall.md index dff3ab4d382b2..35dc481b9cfe3 100644 --- a/docs/core/additional-tools/dnim-cli-uninstall.md +++ b/docs/core/additional-tools/dnim-cli-uninstall.md @@ -49,6 +49,9 @@ dnim-win-[x86|x64|arm64] uninstall -?|-h|--help The `uninstall` command attempts to remove all copies of .NET from the device. This may not be possible if installations are shared with other products like Visual Studio (see [Managed .NET installations on Windows](dnim-net-installs.md)). +> [!CAUTION] +> DNIM always attempts to remove all copies of .NET on a device. Use the `--what-if` option to review planned actions. + Various options can be used to target specific installations. For example, an administrator may want to remove all copies of .NET that are not in active support to comply with their organization's internal policies. > [!IMPORTANT] diff --git a/docs/core/additional-tools/dnim-cli-update.md b/docs/core/additional-tools/dnim-cli-update.md index 69f2bdd750d6e..220f6779fc241 100644 --- a/docs/core/additional-tools/dnim-cli-update.md +++ b/docs/core/additional-tools/dnim-cli-update.md @@ -51,6 +51,9 @@ dnim-win-[x86|x64|arm64] update -?|-h|--help The `update` command detects, classifies, removes and updates .NET installations on Windows. MSIs and bundles are detected by default. Bin deployed (xcopy/zip) installs under `Program Files` can be detected using the `--include-bin-deployed-installs` option. +> [!CAUTION] +> DNIM always attempts to remove all copies of .NET on a device before updating, even if the latest release is instaleld. Use the `--what-if` option to review planned actions and consider using the `--keep-latest-product-version` and `keep-latest-support-phase` options to retain specific installations. + The command can target specific products based on their product version, support phase, type and release version. Only standalone bundles can be updated. Installations of .NET that came from Visual Studio will require you to update Visual Studio. DNIM will not update Visual Studio. The command will first remove any applicable installs before applying updates. This approach yields better results to meet compliance goals and reduce the need for secondary deployments to remove old copies of .NET. From 056a9c06baed6a69b0fe3e069885bff5f3b5ff85 Mon Sep 17 00:00:00 2001 From: Jacques Eloff Date: Thu, 17 Sep 2026 12:37:09 -0700 Subject: [PATCH 31/31] Update uninstall doc with DNIM reference --- docs/core/install/remove-runtime-sdk-versions.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/core/install/remove-runtime-sdk-versions.md b/docs/core/install/remove-runtime-sdk-versions.md index 12ba134ae0f51..0e8eefb93ddf7 100644 --- a/docs/core/install/remove-runtime-sdk-versions.md +++ b/docs/core/install/remove-runtime-sdk-versions.md @@ -1,6 +1,6 @@ --- title: Remove the .NET runtime and SDK -description: This article describes how to uninstall .NET on Windows, macOS, and Linux. Uninstall .NET manually, through a package manager, or with the .NET Uninstall Tool. +description: This article describes how to uninstall .NET on Windows, macOS, and Linux. Uninstall .NET manually, through a package manager, with the .NET Uninstall Tool, or the .NET Install Manager. author: adegeo ms.author: adegeo ms.date: 04/23/2026 @@ -149,6 +149,10 @@ sudo rm -rf /usr/local/share/dotnet/sdk/6.0.406 The .NET Uninstall Tool lets you remove .NET SDKs and runtimes from a system. A collection of options is available to specify which versions should be uninstalled. For more information, see [.NET uninstall tool overview](../additional-tools/uninstall-tool-overview.md). +## .NET Install Manager + +On Windows, the .NET Install Manager (DNIM) can be used to remove .NET SDKs and runtimes. DNIM was designed for at-scale deployments in large environments to assist organizations in removing vulnerable copies of .NET to meet their own compliance policies. For more information, see [.NET Install Manager overview] (../additional-tools/dnim-overview.md). + ## Remove the NuGet fallback directory Before .NET Core 3.0 SDK, the .NET Core SDK installers used a directory named *NuGetFallbackFolder* to store a cache of NuGet packages. This cache was used during operations such as `dotnet restore` or `dotnet build /t:Restore`. The *NuGetFallbackFolder* was located under the *sdk* folder where .NET is installed. For example it could be at *C:\\Program Files\\dotnet\\sdk\\NuGetFallbackFolder* on Windows and at */usr/local/share/dotnet/sdk/NuGetFallbackFolder* on macOS.