mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-27 20:57:23 +00:00
Merge branch 'master' into privacy-update-vb
This commit is contained in:
Sinead O'Sullivan
commit
01304f7d28
@ -1,5 +1,80 @@
|
||||
{
|
||||
"redirections": [
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-textinput.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-shell.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-rcspresence.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-otherassets.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-nfc.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-multivariant.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-modemconfigurations.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-messaging.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-internetexplorer.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-initialsetup.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-deviceinfo.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-calling.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-callandmessagingenhancement.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-automatictime.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-theme.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/configuration/wcd/wcd-embeddedlockdownprofiles.md",
|
||||
"redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
|
||||
|
||||
@ -2,8 +2,11 @@
|
||||
|
||||
|
||||
|
||||
## Week of April 26, 2021
|
||||
## Week of October 25, 2021
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 10/28/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
|
||||
| 10/28/2021 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified |
|
||||
| 10/28/2021 | [Windows 10 for Education (Windows 10)](/education/windows/index) | modified |
|
||||
|
||||
@ -2,8 +2,10 @@
|
||||
|
||||
|
||||
|
||||
## Week of April 26, 2021
|
||||
## Week of October 25, 2021
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 10/28/2021 | [Deploy and manage a full cloud IT solution for your business](/windows/smb/cloud-mode-business-setup) | modified |
|
||||
| 10/28/2021 | [Windows 10/11 for small to midsize businesses](/windows/smb/index) | modified |
|
||||
|
||||
@ -40,6 +40,7 @@ The MDM security baseline includes policies that cover the following areas:
|
||||
|
||||
For more details about the MDM policies defined in the MDM security baseline and what Microsoft’s recommended baseline policy values are, see:
|
||||
|
||||
- [MDM Security baseline for Windows 11](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/Windows11-MDM-SecurityBaseLine-Document.zip)
|
||||
- [MDM Security baseline for Windows 10, version 2004](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/2004-MDM-SecurityBaseLine-Document.zip)
|
||||
- [MDM Security baseline for Windows 10, version 1909](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1909-MDM-SecurityBaseLine-Document.zip)
|
||||
- [MDM Security baseline for Windows 10, version 1903](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1903-MDM-SecurityBaseLine-Document.zip)
|
||||
|
||||
@ -12,12 +12,12 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 06/26/2017
|
||||
ms.date: 11/02/2021
|
||||
---
|
||||
|
||||
# Enterprise settings, policies, and app management
|
||||
|
||||
The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
|
||||
The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
|
||||
|
||||
Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](configuration-service-provider-reference.md).
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.date: 10/11/2021
|
||||
ms.date: 11/02/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -266,7 +266,7 @@ ADMX Info:
|
||||
<!--/ADMXMapped-->
|
||||
|
||||
<a href="" id="status"></a>**Status**
|
||||
Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device.
|
||||
Returns bitmask that indicates status of Application Guard installation for Microsoft Edge and prerequisites on the device.
|
||||
|
||||
Value type is integer. Supported operation is Get.
|
||||
|
||||
@ -275,11 +275,13 @@ Value type is integer. Supported operation is Get.
|
||||
- Bit 2 - Set to 1 when the client machine has a valid OS license and SKU.
|
||||
- Bit 3 - Set to 1 when Application Guard installed on the client machine.
|
||||
- Bit 4 - Set to 1 when required Network Isolation Policies are configured.
|
||||
> [!IMPORTANT]
|
||||
> If you are deploying Application Guard via Intune, Network Isolation Policy must be configured to enable Application Guard for Microsoft Edge.
|
||||
- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements.
|
||||
- Bit 6 - Set to 1 when system reboot is required.
|
||||
- Bit 6 - Set to 1 when system reboot is required.
|
||||
|
||||
<a href="" id="platformstatus"></a>**PlatformStatus**
|
||||
Added in Windows 10, version 2004. Returns bitmask that indicates status of Application Guard platform installation and prerequisites on the device.
|
||||
Added in Windows 10, version 2004. Applies to Microsoft Office/Generic platform. Returns bitmask that indicates status of Application Guard platform installation and prerequisites on the device.
|
||||
|
||||
Value type is integer. Supported operation is Get.
|
||||
|
||||
|
||||
@ -190,14 +190,8 @@
|
||||
href: wcd/wcd-admxingestion.md
|
||||
- name: AssignedAccess
|
||||
href: wcd/wcd-assignedaccess.md
|
||||
- name: AutomaticTime
|
||||
href: wcd/wcd-automatictime.md
|
||||
- name: Browser
|
||||
href: wcd/wcd-browser.md
|
||||
- name: CallAndMessagingEnhancement
|
||||
href: wcd/wcd-callandmessagingenhancement.md
|
||||
- name: Calling
|
||||
href: wcd/wcd-calling.md
|
||||
- name: CellCore
|
||||
href: wcd/wcd-cellcore.md
|
||||
- name: Cellular
|
||||
@ -218,8 +212,6 @@
|
||||
href: wcd/wcd-developersetup.md
|
||||
- name: DeviceFormFactor
|
||||
href: wcd/wcd-deviceformfactor.md
|
||||
- name: DeviceInfo
|
||||
href: wcd/wcd-deviceinfo.md
|
||||
- name: DeviceManagement
|
||||
href: wcd/wcd-devicemanagement.md
|
||||
- name: DeviceUpdateCenter
|
||||
@ -236,10 +228,6 @@
|
||||
href: wcd/wcd-folders.md
|
||||
- name: HotSpot
|
||||
href: wcd/wcd-hotspot.md
|
||||
- name: InitialSetup
|
||||
href: wcd/wcd-initialsetup.md
|
||||
- name: InternetExplorer
|
||||
href: wcd/wcd-internetexplorer.md
|
||||
- name: KioskBrowser
|
||||
href: wcd/wcd-kioskbrowser.md
|
||||
- name: Licensing
|
||||
@ -247,23 +235,13 @@
|
||||
- name: Location
|
||||
href: wcd/wcd-location.md
|
||||
- name: Maps
|
||||
href: wcd/wcd-maps.md
|
||||
- name: Messaging
|
||||
href: wcd/wcd-messaging.md
|
||||
- name: ModemConfigurations
|
||||
href: wcd/wcd-modemconfigurations.md
|
||||
- name: Multivariant
|
||||
href: wcd/wcd-multivariant.md
|
||||
href: wcd/wcd-maps.md
|
||||
- name: NetworkProxy
|
||||
href: wcd/wcd-networkproxy.md
|
||||
- name: NetworkQOSPolicy
|
||||
href: wcd/wcd-networkqospolicy.md
|
||||
- name: NFC
|
||||
href: wcd/wcd-nfc.md
|
||||
href: wcd/wcd-networkqospolicy.md
|
||||
- name: OOBE
|
||||
href: wcd/wcd-oobe.md
|
||||
- name: OtherAssets
|
||||
href: wcd/wcd-otherassets.md
|
||||
href: wcd/wcd-oobe.md
|
||||
- name: Personalization
|
||||
href: wcd/wcd-personalization.md
|
||||
- name: Policies
|
||||
@ -271,13 +249,9 @@
|
||||
- name: Privacy
|
||||
href: wcd/wcd-privacy.md
|
||||
- name: ProvisioningCommands
|
||||
href: wcd/wcd-provisioningcommands.md
|
||||
- name: RcsPresence
|
||||
href: wcd/wcd-rcspresence.md
|
||||
href: wcd/wcd-provisioningcommands.md
|
||||
- name: SharedPC
|
||||
href: wcd/wcd-sharedpc.md
|
||||
- name: Shell
|
||||
href: wcd/wcd-shell.md
|
||||
href: wcd/wcd-sharedpc.md
|
||||
- name: SMISettings
|
||||
href: wcd/wcd-smisettings.md
|
||||
- name: Start
|
||||
@ -293,11 +267,7 @@
|
||||
- name: TabletMode
|
||||
href: wcd/wcd-tabletmode.md
|
||||
- name: TakeATest
|
||||
href: wcd/wcd-takeatest.md
|
||||
- name: TextInput
|
||||
href: wcd/wcd-textinput.md
|
||||
- name: Theme
|
||||
href: wcd/wcd-theme.md
|
||||
href: wcd/wcd-takeatest.md
|
||||
- name: Time
|
||||
href: wcd/wcd-time.md
|
||||
- name: UnifiedWriteFilter
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Add image for secondary Microsoft Edge tiles (Windows 10)
|
||||
description:
|
||||
description: Add app tiles on Windows 10 that's a secondary tile.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
@ -18,7 +18,6 @@ manager: dansimp
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
App tiles are the Start screen tiles that represent and launch an app. A tile that allows a user to go to a specific location in an app is a *secondary tile*. Some examples of secondary tiles include:
|
||||
|
||||
@ -43,7 +42,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE
|
||||
|
||||
**Example of secondary tiles in XML generated by Export-StartLayout**
|
||||
|
||||
```
|
||||
```xml
|
||||
<start:SecondaryTile
|
||||
AppUserModelID="Microsoft.Windows.Edge_cw5n1h2txyewy!Microsoft.Edge.Edge"
|
||||
TileID="-9513911450"
|
||||
@ -65,21 +64,22 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE
|
||||
|
||||
1. Follow the instructions in [Customize and export Start layout](customize-and-export-start-layout.md#customize-the-start-screen-on-your-test-computer) to customize the Start screen on your test computer.
|
||||
2. Open Windows PowerShell as an administrator and enter the following command:
|
||||
|
||||
```
|
||||
|
||||
```powershell
|
||||
Export-StartLayout -path <path><file name>.xml
|
||||
```
|
||||
|
||||
In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml).
|
||||
|
||||
Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet does not append the file name extension, and the policy settings require the extension.
|
||||
|
||||
Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet does not append the file name extension, and the policy settings require the extension.
|
||||
|
||||
3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references.
|
||||
- For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"`
|
||||
- Open `C:\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images.
|
||||
|
||||
- Open `C:\Users\<username>\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images.
|
||||
|
||||
4. In Windows PowerShell, enter the following command:
|
||||
|
||||
```
|
||||
```powershell
|
||||
Export-StartLayoutEdgeAssets assets.xml
|
||||
```
|
||||
|
||||
@ -91,22 +91,38 @@ You can apply the customized Start layout with images for secondary tiles by usi
|
||||
|
||||
In Microsoft Intune, you create a device restrictions policy to apply to device group. For other MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`.
|
||||
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
3. Enter the following properties:
|
||||
|
||||
1. In the Microsoft Azure portal, search for **Intune** or go to **More services** > **Intune**.
|
||||
2. Select **Device configuration**.
|
||||
3. Select **Profiles**.
|
||||
4. Select **Create profile**.
|
||||
5. Enter a friendly name for the profile.
|
||||
6. Select **Windows 10 and later** for the platform.
|
||||
7. Select **Device restrictions** for the profile type.
|
||||
8. Select **Start**.
|
||||
9. In **Start menu layout**, browse to and select your Start layout XML file.
|
||||
9. In **Pin websites to tiles in Start menu**, browse to and select your assets XML file.
|
||||
10. Select **OK** twice, and then select **Create**.
|
||||
11. [Assign the profile to a group](/intune/device-profile-assign).
|
||||
- **Platform**: Select **Windows 10 and later**.
|
||||
- **Profile**: Select **Templates** > **Device restrictions**.
|
||||
|
||||
>[!NOTE]
|
||||
>The device restrictions in Microsoft Intune include [other Start settings](/intune/device-restrictions-windows-10#start) that you can also configure in your profile.
|
||||
4. Select **Create**.
|
||||
5. In **Basics**, enter the following properties:
|
||||
|
||||
- **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later.
|
||||
- **Description**: Enter a description for the policy. This setting is optional, but recommended.
|
||||
|
||||
6. Select **Next**.
|
||||
|
||||
7. In **Configuration settings**, select **Start**. Configure the following properties:
|
||||
|
||||
- **Start menu layout**: Browse to, and select your Start layout XML file.
|
||||
- **Pin websites to tiles in Start menu**: Browse to, and select your assets XML file.
|
||||
|
||||
There are more Start menu settings you can configure. For more information on these settings, see [Start settings in Intune](/intune/device-restrictions-windows-10#start)
|
||||
|
||||
8. Select **Next**.
|
||||
9. In **Scope tags** (optional), assign a tag to filter the profile to specific IT groups, such as `US-NC IT Team` or `JohnGlenn_ITDepartment`. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
|
||||
|
||||
Select **Next**.
|
||||
|
||||
10. In **Assignments**, select the users or groups that will receive your profile. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
|
||||
|
||||
Select **Next**.
|
||||
|
||||
11. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list.
|
||||
|
||||
### Using a provisioning package
|
||||
|
||||
@ -199,7 +215,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
|
||||
26. Double-click the ppkg file and allow it to install.
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md)
|
||||
- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
|
||||
@ -207,7 +223,6 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md)
|
||||
- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
|
||||
- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
|
||||
- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
|
||||
- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
|
||||
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
|
||||
|
||||
|
||||
|
||||
@ -21,7 +21,6 @@ ms.date: 4/16/2018
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
|
||||
|
||||
@ -36,7 +35,7 @@ You can use these tools to configure access to Microsoft Store: AppLocker or Gro
|
||||
|
||||
## <a href="" id="block-store-applocker"></a>Block Microsoft Store using AppLocker
|
||||
|
||||
Applies to: Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile
|
||||
Applies to: Windows 10 Enterprise, Windows 10 Education
|
||||
|
||||
|
||||
AppLocker provides policy-based access control management for applications. You can block access to Microsoft Store app with AppLocker by creating a rule for packaged apps. You'll give the name of the Microsoft Store app as the packaged app that you want to block from client computers.
|
||||
@ -100,23 +99,9 @@ You can also use Group Policy to manage access to Microsoft Store.
|
||||
> [!Important]
|
||||
> Enabling **Turn off the Store application** policy turns off app updates from Microsoft Store.
|
||||
|
||||
## <a href="" id="block-store-mobile"></a>Block Microsoft Store on Windows 10 Mobile
|
||||
|
||||
|
||||
Applies to: Windows 10 Mobile
|
||||
|
||||
If you have mobile devices in your organization that you upgraded from earlier versions of Windows Phone 8 to Windows 10 Mobile, existing policies created using the Windows Phone 8.1 CSPs with your MDM tool will continue to work on Windows 10 Mobile. If you are starting with Windows 10 Mobile, we recommend using [AppLocker](#block-store-applocker) to manage access to Microsoft Store app.
|
||||
|
||||
When your MDM tool supports Microsoft Store for Business, the MDM can use these CSPs to block Microsoft Store app:
|
||||
|
||||
- [Policy](/windows/client-management/mdm/policy-configuration-service-provider)
|
||||
|
||||
- [EnterpriseAssignedAccess](/windows/client-management/mdm/enterpriseassignedaccess-csp) (Windows 10 Mobile, only)
|
||||
|
||||
For more information, see [Configure an MDM provider](/microsoft-store/configure-mdm-provider-windows-store-for-business).
|
||||
|
||||
## Show private store only using Group Policy
|
||||
Applies to Windows 10 Enterprise, version 1607, Windows 10 Education
|
||||
|
||||
Applies to Windows 10 Enterprise, Windows 10 Education
|
||||
|
||||
If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store.
|
||||
|
||||
|
||||
@ -21,11 +21,11 @@ Use these settings to configure the Account Manager service.
|
||||
|
||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DeletionPolicy](#deletionpolicy) | | | | X | |
|
||||
| [EnableProfileManager](#enableprofilemanager) | | | | X | |
|
||||
| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | | X | |
|
||||
| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | | X | |
|
||||
| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | | X | |
|
||||
| [DeletionPolicy](#deletionpolicy) | | | | ✔️ | |
|
||||
| [EnableProfileManager](#enableprofilemanager) | | | | ✔️ | |
|
||||
| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | | ✔️ | |
|
||||
| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | | ✔️ | |
|
||||
| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | | ✔️ | |
|
||||
|
||||
>[!NOTE]
|
||||
>Although the AccountManagement settings are available in advanced provisioning for other editions, you should only use them for HoloLens devices.
|
||||
|
||||
@ -28,8 +28,8 @@ Starting in Windows 10, version 1703, you can import (*ingest*) select Group Pol
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | X | | | | |
|
||||
| [ConfigOperations](#configoperations) | X | | | | |
|
||||
| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | | |
|
||||
| [ConfigOperations](#configoperations) | ✔️ | | | | |
|
||||
|
||||
## ConfigADMXInstalledPolicy
|
||||
|
||||
|
||||
@ -21,8 +21,8 @@ Use this setting to configure single use (kiosk) devices.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AssignedAccessSettings](#assignedaccesssettings) | X | | | X | |
|
||||
| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | X | | | X | |
|
||||
| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | | ✔️ | |
|
||||
| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | | ✔️ | |
|
||||
|
||||
|
||||
## AssignedAccessSettings
|
||||
@ -31,9 +31,7 @@ Enter the account and the application you want to use for Assigned access, using
|
||||
|
||||
**Example**:
|
||||
|
||||
```
|
||||
{"Account":"domain\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}
|
||||
```
|
||||
`{"Account":"domain\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}`
|
||||
|
||||
## MultiAppAssignedAccessSettings
|
||||
|
||||
|
||||
@ -1,76 +0,0 @@
|
||||
---
|
||||
title: AutomaticTime (Windows 10)
|
||||
description: This section describes the AutomaticTime settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 04/30/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# AutomaticTime (Windows Configuration Designer reference)
|
||||
|
||||
Use these settings to configure automatic time updates. Mobile devices primarily rely on Network Identify and Time zone (NITZ), which is provided by the mobile operator, to automatically update the time on the device. When NITZ is available from the cellular network, there are no issues maintaining accurate time in devices. However, for devices that do not have a SIM or have had the SIM removed for some time, or for devices that have a SIM but NITZ is not supported, the device may run into issues maintaining accurate time on the device.
|
||||
|
||||
The OS includes support for Network Time Protocol (NTP), which enables devices to receive time when NITZ is not supported or when cellular data is not available. NTP gets the time by querying a server at a specified time interval. NTP is based on Coordinated Universal Time (UTC) and doesn't support time zone or daylight saving time so users will need to manually update the time zone after an update from NTP if users move between time zones.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EnableAutomaticTime](#enableautomatictime) | | X | | | |
|
||||
| [NetworkTimeUpdateThreshold](#networktimeupdatethreshold) | | X | | | |
|
||||
| [NTPEnabled](#ntpenabled) | | X | | | |
|
||||
| [NTPRegularSyncInterval](#ntpregularsyncinterval) | | X | | | |
|
||||
| [NTPRetryInterval](#ntpretryinterval) | | X | | | |
|
||||
| [NTPServer](#ntpserver) | | X | | | |
|
||||
| [PreferredSlot](#preferredslot) | | X | | | |
|
||||
|
||||
## EnableAutomaticTime
|
||||
|
||||
Set to **True** to enable automatic time and to **False** to disable automatic time.
|
||||
|
||||
## NetworkTimeUpdateThreshold
|
||||
|
||||
Specify the difference (in number of seconds) between the NITZ information and the current device time before a device time update is triggered.
|
||||
|
||||
## NTPEnabled
|
||||
|
||||
Set to **True** to enable the NTP client and to **False** to disable the NTP client.
|
||||
|
||||
## NTPRegularSyncInterval
|
||||
|
||||
Set the regular sync interval for phones that are set to use Network Time Protocol (NTP) time servers. Select a value between `1` and `168` hours, inclusive, The default sync interval is `12` hours.
|
||||
|
||||
|
||||
## NTPRetryInterval
|
||||
|
||||
Set the retry interval if the regular sync fails. Select a value between `1` and `24` hours, inclusive.
|
||||
|
||||
## NTPServer
|
||||
|
||||
Change the default NTP server for phones that are set to use NTP. To enumerate the NTP source server(s) used by the NTP client, set the value for NTPServer to a list of server names, delimited by semi-colons.
|
||||
|
||||
**Example**:
|
||||
|
||||
```
|
||||
ntpserver1.contoso.com;ntpserver2.fabrikam.com;ntpserver3.contoso.com
|
||||
```
|
||||
|
||||
The list should contain one or more server names. The default NTP source server value is `time.windows.com`.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## PreferredSlot
|
||||
|
||||
Specify which UICC slot will be preferred for NITZ handling on a C+G dual SIM phone.
|
||||
|
||||
- Set to `0` to use the UICC in Slot 0 for NITZ handling.
|
||||
- Set to '1' to use the UICC in Slot 1 for NITZ handling.
|
||||
@ -21,11 +21,11 @@ Use to configure browser settings that should only be set by OEMs who are part o
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowPrelaunch](#allowprelaunch) | | | X | | |
|
||||
| [FavoriteBarItems](#favoritebaritems) | X | | | | |
|
||||
| [Favorites](#favorites) | | X | | | |
|
||||
| [PartnerSearchCode](#partnersearchcode) | X | X | X | | |
|
||||
| [SearchProviders](#searchproviders) | | X | | | |
|
||||
| [AllowPrelaunch](#allowprelaunch) | | | ✔️ | | |
|
||||
| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | | |
|
||||
| [Favorites](#favorites) | | ✔️ | | | |
|
||||
| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [SearchProviders](#searchproviders) | | ✔️ | | | |
|
||||
|
||||
|
||||
## AllowPrelaunch
|
||||
@ -76,9 +76,6 @@ OEMs who are part of the program only have one PartnerSearchCode and this should
|
||||
|
||||
Contains the settings you can use to configure the default and additional search providers.
|
||||
|
||||
Microsoft Bing is the default search provider for Windows 10 Mobile. The default search provider must be set to Bing, except for devices shipping to certain countries where a different default search provider is required as specified in the [Specific region guidance](#specific-region-guidance) section of [Default](#default).
|
||||
|
||||
|
||||
### Default
|
||||
|
||||
Use *Default* to specify a name that matches one of the search providers you enter in [SearchProviderList](#searchproviderlist). If you don't specify a default search provider, this will default to Microsoft Bing.
|
||||
@ -104,8 +101,3 @@ For example, to specify Yandex in Russia and Commonwealth of Independent States
|
||||
|
||||
When configured with multiple search providers, the browser can display up to ten search providers.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Microsoft Bing is the default search provider for Windows 10 Mobile. The default search provider must be set to Bing, except for devices shipping to certain countries where a different default search provider is required as specified in the [Specific region guidance](#specific-region-guidance) section of [Default](#default).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,42 +0,0 @@
|
||||
---
|
||||
title: CallAndMessageEnhancement (Windows 10)
|
||||
description: This section describes the CallAndMessagingEnhancement settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/21/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# CallAndMessagingEnhancement (Windows Configuration Designer reference)
|
||||
|
||||
Use to configure call origin and blocking apps.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>These settings are intended to be used only by manufacturers, mobile operators, and solution providers when configuring devices, and are not intended for use by administrators in the enterprise.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [BlockingApp](#blockingapp) | | X | | | |
|
||||
| [CallOriginApp](#calloriginapp) | | X | | | |
|
||||
|
||||
## BlockingApp
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| ActiveBlockingAppUserModelId | AUMID | The AUMID of the application that will be set as the active blocking app by default. |
|
||||
| DefaultBlockingAppUserModelId | AUMID | The AUMID of the application that the OS will select as the active blocking app if the user uninstalls the current active blocking app. This app should be uninstallable. |
|
||||
|
||||
## CallOriginApp
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| ActiveCallOriginAppUserModelId | AUMID | The AUMID of the application to be set as the active call origin provider app by default. |
|
||||
| DefaultCallOriginAppUserModelId | AUMID | The AUMID of the application that the OS will select as the active call origin provider app if the user uninstalls the current active call origin app. This app should be uninstallable. |
|
||||
@ -1,218 +0,0 @@
|
||||
---
|
||||
title: Calling (Windows 10)
|
||||
description: This section describes the Calling settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 04/30/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Calling (Windows Configuration Designer reference)
|
||||
|
||||
Use to configure settings for Calling.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>These settings are intended to be used only by manufacturers, mobile operators, and solution providers when configuring devices, and are not intended for use by administrators in the enterprise.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
|
||||
## Branding
|
||||
|
||||
See [Branding for phone calls](/windows-hardware/customize/mobile/mcsf/branding-for-phone-calls).
|
||||
|
||||
## CallIDMatchOverrides
|
||||
|
||||
Enter a GEOID, select **Add**, and then enter the number of digits for matching caller ID.
|
||||
|
||||
For a list of GEOID codes and default number of digits for each country/region, see [Overriding the OS default minimu number of digits for caller ID matching](/windows-hardware/customize/mobile/mcsf/caller-id-matching#a-href-idoverriding-os-default-min-number-digitsaoverriding-the-os-default-minimum-number-of-digits-for-caller-id-matching).
|
||||
|
||||
## CauseCodeRegistrationTable
|
||||
|
||||
See [Cause codes](/windows-hardware/customize/mobile/mcsf/cause-codes).
|
||||
|
||||
|
||||
## CDMAHeuristics
|
||||
|
||||
CDMA Heuristics (on by default) makes CDMA calling more user-friendly by exposing an interface that supports multiple calls with call waiting, swapping, and three-way calling.
|
||||
|
||||
For **CDMAPriorityCallPrefix**, enter a custom call prefix that would allow the user to override an ongoing call with a remote party mostly used in emergency services and law enforcement.
|
||||
|
||||
Set **DisableCdmaHeuristics** to **True** to disable the built-in heuristics.
|
||||
|
||||
|
||||
## PartnerAppSupport
|
||||
|
||||
See [Dialer codes to launch diagnostic applications](/windows-hardware/customize/mobile/mcsf/dialer-codes-to-launch-diagnostic-applications).
|
||||
|
||||
## PerSimSettings
|
||||
|
||||
Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the following settings.
|
||||
|
||||
### Critical
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
MOSimFallbackVoicemailNumber | Partners who do not have the voicemail numbers on the device SIM can configure the voicemail number for their devices. If the voicemail number is not on the SIM and the registry key is not set, the default voicemail will not be set and the user will need to set the number. Set MOSimFallbackVoicemailNumber to the voicemail number that you want to use for the phone.
|
||||
SimOverrideVoicemailNumber | Mobile operators can override the voicemail number on the UICC with a different voicemail number that is configured in the registry. Set SimOverrideVoicemailNumber to a string that contains the digits of the voicemail number to use instead of the voicemail number on the UICC.
|
||||
|
||||
|
||||
### General
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
AllowMixedAudioVideoConferencing | Set as **True** to enable audio and video calls in the same conference.
|
||||
AllowVideoConferencing | Set as **True** to enable the ability to conference video calls.
|
||||
AutoDismissUssedWaitingDialog | Set as **True** to enable automatic dismissal of "Waiting" dialog on USSD session termination.
|
||||
CallerIdBlockingPrefixList | Enter a list of prefixes which will not see the caller ID. Use a semicolon (;) as a delimiter.
|
||||
DefaultCallerIdSetting | Configure the default setting for caller ID. Select between `No one`, `Only contacts`, `Every one`, and `Network default`. If set to `Network default`, set `ShowCallerIdNetworkDefaultSetting` to **True**.
|
||||
DefaultEnableVideoCalling | Set as **True** to enable LTE video calling as the default setting.
|
||||
DefaultEnableVideoCapability | Set as **True** to enable LTE video capability sharing as the default setting.
|
||||
EnableSupplementaryServiceEraseToDeactivateOverride | Enables conversion of supplementary service erase commands to deactivate commands.
|
||||
IgnoreCallerIdBlockingPrefix | DO NOT USE
|
||||
IgnoreMWINotifications | Set as **True** to configure the voicemail system so the phone ignores message waiting indicator (MWI) notifications.
|
||||
IgnoreProhibitedDialingPrefix | Ignore prohibited dialing prefix. An OEM/MO can specify a certain set of strings by region that when dialed will block a user's caller ID from being displayed on the device receiving the call. The list is separated by semicolon. This setting does not apply beyond Windows 10, version 1709.
|
||||
IgnoreUssdExclusions | Set as **True** to ignore Unstructured Supplementary Service Data (USSD) exclusions.
|
||||
ProhibitedDialingPrefixList | A semicolon delimited list of previxes that are prohibited from being dialed.
|
||||
ResetCallForwarding | When set to **True**, user is provided with an option to retry call forwarding settings query.
|
||||
ShowCallerIdNetworkDefaultSetting | Indicates whether the network default setting can be allowed for outgoing caller ID.
|
||||
ShowVideoCallingSwitch | Use to specify whether to show the video capability sharing switch on the mobile device's Settings screen.
|
||||
ShowVideoCapabilitySwitch | Configure the phone settings to show the video capability sharing switch.
|
||||
SupressVideoCallingChargesDialog | Configure the phone settings CPL to suppress the video calling charges dialog.
|
||||
UssdExclusionList | List used to exclude predefined USSD entries, allowing the number to be sent as standard DTMF tones instead. Set UssdExclusionList to the list of desired exclusions, separated by semicolons. For example, setting the value to 66;330 will override 66 and 330. Leading zeros are specified by using F. For example, to override code 079, set the value to F79. If you set UssdExclusionList, you must set IgnoreUssdExclusions as well. Otherwise, the list will be ignored. See [List of USSD codes](#list-of-ussd-codes) for values.
|
||||
WiFiCallingOperatorName | Enter the operator name to be shown when the phone is using WiFi calling. If you don't set a value for WiFiCallingOperatorName, the device will always display **SIMServiceProviderName Wi-Fi**, where *SIMServiceProviderName* is a string that corresponds to the SPN for the SIM on the device. If the service provider name in the SIM is not set, only **Wi-Fi** will be displayed.
|
||||
|
||||
### HDAudio
|
||||
|
||||
To customize call progress branding when a call is made using a specific audio codec, select the audio codec from the dropdown menu and select **Add**. Select the codec in **Available Customizations** and then enter a text string (up to 10 characters) to be used for call progress branding for calls using that codec. For more information, see [Use HD audio codec for call branding](/windows-hardware/customize/mobile/mcsf/use-hd-audio-codec-for-call-branding).
|
||||
|
||||
### IMSSubscriptionUpdate
|
||||
|
||||
These are Verizon/Sprint-only settings to allow the operator to send an OMA-DM update to the device with the given alert characteristics, which are defined between the mobile operator and OEM, which in turn will inform the device to turn on or off IMS.
|
||||
|
||||
### RoamingNumberOverrides
|
||||
|
||||
See [Dial string overrides when roaming](/windows-hardware/customize/mobile/mcsf/dial-string-overrides-when-roaming).
|
||||
|
||||
## PhoneSettings
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
AdjustCDMACallTime | Change the calculation of CDMA call duration to exclude the time before the call connects.
|
||||
AssistedDialSetting | Turn off the international assist feature that helps users with the country codes needed for dialing international phone numbers.
|
||||
CallIDMatch | Sets the number of digits that the OS will try to match against contacts for Caller ID. For any country/region that doesn't exist in the default mapping table, mobile operators can use this legacy CallIDMatch setting to specify the minimum number of digits to use for matching caller ID.
|
||||
CallRecordingOff | Indicates if call recording is turned off. Users will not see the call recording functionality when this is set to **True**.
|
||||
ConferenceCallMaximumPartyCount | Enter a number to limit the number of parties that can participate in a conference call.
|
||||
ContinuousDTMFEnabled | Enable DTMF tone duration for as long as the user presses a dialpad key.
|
||||
DisableVideoUpgradeStoreNavigation | If there are no compatible video upgrade apps installed, tapping the video upgrade button will launch a dialog that will navigate to the Microsoft Store. If this option is enabled, it will show a dialog that informs the user that no video app is installed, but it will not navigate to the Microsoft Store.
|
||||
DisableVoicemailPhoneNumberDisplay | Disable the display of the voicemail phone number below the Voicemail label in call progress dialog.
|
||||
DisplayNoDataMessageDuringCall | Display a message to the user indicating that there is no Internet connectivity during a phone call.
|
||||
DisplayNumberAsDialed | Display the outgoing number "as dialed" rather than "as connected".
|
||||
EnableVideoCalling | Set to **True** to enable video calling.
|
||||
HideCallForwarding | Partners can hide the user option to turn on call forwarding. By default, users can decide whether to turn on call forwarding. Partners can hide this user option so that call forwarding is permanently disabled.
|
||||
HideSIMSecurityUI | Hide the SIM Security panel from phone Settings.
|
||||
LowVideoQualityTimeout | Configure the phone timer to automatically drop video when the quality is low, in milliseconds.
|
||||
MinTimeBetweenCallSwaps | Configure how often the user can swap between two active phone calls, in milliseconds.
|
||||
PromptVideoCallingCharges | Prompt user for charges associated with video calls.
|
||||
ShowLongTones | Partners can make a user option visible that makes it possible to toggle between short and long DTMF tones, instead of the default continuous tones. By default, the phone supports Dual-Tone Multi-frequency (DTMF) with continuous tones. Partners can make a user option visible that makes it possible to toggle between short and long tones instead.
|
||||
UseOKForUssdDialogs | OEMs can change the button label in USSD dialogs from **Close** (the default) to **OK**.
|
||||
UseVoiceDomainForEmergencyCallBranding | Use voice domain to decide whether to use **Emergency calls only** or **No service** in branding.
|
||||
VideoCallingChargesMessage | Enter text for the message informing the user about the charges associated with video calls.
|
||||
VideoCallingChargesTitle | Enter text for the title of the dialog informing the user about the charges associated with video calls.
|
||||
VideoCallingDescription | Enter text to describe the video calling feature.
|
||||
VideoCallingLabel | Enter text to describe the video calling toggle.
|
||||
VideoCapabilityDescription | Enter text to describe the video capability feature.
|
||||
VideoCapabilityLabel | Enter text to describe the video capability toggle.
|
||||
VideoTransitionTimeout | Enter the time in milliseconds to check how long the video transition state will remain until the remote party responds. The minimum value is 10000 and the maximum value is 30000.
|
||||
VoLTEAudioQualityString | Partners can add a string to the call progress screen to indicate if the active call is a high quality voice over LTE (VoLTE). Set the value of VoLTEAudioQualityString to the string that you want to display in the call progress screen to indicate that the call is a VoLTE call. This string is combined with the PLMN so if the string is "VoLTE", the resulting string is "PLMN_String VoLTE". For example, the string displayed in the call progress screen can be "Litware VoLTE" if the PLMN_String is "Litware". The value you specify for VoLTEAudioQualityString must exceed 10 characters.
|
||||
|
||||
|
||||
## PhoneShellUI
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
EnableSoftwareProximitySensorMitigation | Enable software proximity sensor mitigation.
|
||||
|
||||
## PhoneSmsFilter
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
AppId | Enter the app ID for your phone call/SMS filter application.
|
||||
|
||||
## SupplementaryServiceCodeOverrides
|
||||
|
||||
See [Dialer codes for supplementary services](/windows-hardware/customize/mobile/mcsf/dialer-codes-for-supplementary-services).
|
||||
|
||||
## VoicemailRegistrationTable
|
||||
|
||||
Configure these settings to customize visual voicemail in the Windows 10 Mobile UI. For settings and values, see [Visual voicemail](/windows-hardware/customize/mobile/mcsf/visual-voicemail).
|
||||
|
||||
|
||||
## List of USSD codes
|
||||
|
||||
|
||||
Codes | Description | DWORD Value
|
||||
--- | --- | ---
|
||||
04 | CHANGEPIN | 000000F4
|
||||
042 | CHANGEPIN2 | 00000F42
|
||||
05 | UNBLOCKPIN | 000000F5
|
||||
052 | UNBLOCKPIN2 | 00000F52
|
||||
03 | SSCHANGEPASSWORD | 000000F3
|
||||
75 | EMLPPBASE | 00000075
|
||||
750 | EMLPPLEVEL0 | 00000750
|
||||
751 | EMLPPLEVEL1 | 00000751
|
||||
752 | EMLPPLEVEL2 | 00000752
|
||||
753 | EMLPPLEVEL3 | 00000753
|
||||
754 | EMLPPLEVEL4 | 00000754
|
||||
66 | CALLDEFLECT | 00000066
|
||||
30 | CALLIDCLIP | 00000030
|
||||
31 | CALLIDCLIR | 00000031
|
||||
76 | CALLIDCOLP | 00000076
|
||||
77 | CALLIDCOLR | 00000077
|
||||
21 | FWDUNCONDITIONAL | 00000021
|
||||
67 | FWDBUSY | 00000067
|
||||
61 | FWDNOREPLY | 00000061
|
||||
62 | FWDNOTREACHABLE | 00000062
|
||||
002 | FWDALL | 00000FF2
|
||||
004 | FWDALLCONDITIONAL | 00000FF4
|
||||
43 | CALLWAITING | 00000043
|
||||
360 | UUSALL | 00000360
|
||||
361 | UUSSERVICE1 | 00000361
|
||||
362 | UUSSERVICE2 | 00000362
|
||||
363 | UUSSERVICE3 | 00000363
|
||||
33 | BARROUT | 00000033
|
||||
331 | BARROUTINTL | 00000331
|
||||
332 | BARROUTINTLEXTOHOME | 00000332
|
||||
35 | BARRIN | 00000035
|
||||
351 | BARRINROAM | 00000351
|
||||
330 | BARRALL | 00000330
|
||||
333 | BARRALLOUT | 00000333
|
||||
353 | BARRALLIN | 00000353
|
||||
354 | BARRINCOMINGINTERMEDIATE | 00000354
|
||||
96 | CALLTRANSFER | 00000096
|
||||
37 | CALLCOMPLETEBUSY | 00000037
|
||||
070 | PNP0 | 00000F70
|
||||
071 | PNP1 | 00000F71
|
||||
072 | PNP2 | 00000F72
|
||||
073 | PNP3 | 00000F73
|
||||
074 | PNP4 | 00000F74
|
||||
075 | PNP5 | 00000F75
|
||||
076 | PNP6 | 00000F76
|
||||
077 | PNP7 | 00000F77
|
||||
078 | PNP8 | 00000F78
|
||||
079 | PNP9 | 00000F79
|
||||
300 | CALLCNAP | 00000300
|
||||
591 | MSP1 | 00000591
|
||||
592 | MSP2 | 00000592
|
||||
593 | MSP3 | 00000593
|
||||
594 | MSP4 | 00000594
|
||||
@ -26,24 +26,24 @@ Use to configure settings for cellular data.
|
||||
|
||||
Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core
|
||||
--- | :---: | :---: | :---: | :---: | :---:
|
||||
PerDevice: [CellConfigurations](#cellconfigurations) | | X | | | |
|
||||
PerDevice: [CellData](#celldata) | X | X | X | |
|
||||
PerDevice: [CellUX](#cellux) | X | X | X | |
|
||||
PerDevice: [CGDual](#cgdual) | | X | | |
|
||||
PerDevice: [eSim](#esim) | X | X | X | |
|
||||
PerDevice: [External](#external) | | X | | |
|
||||
PerDevice: [General](#general) | | X | | |
|
||||
PerDevice: [RCS](#rcs) | | X | | |
|
||||
PerDevice: [SMS](#sms) | X | X | X | |
|
||||
PerDevice: [UIX](#uix) | | X | | |
|
||||
PerDevice: [UTK](#utk) | | X | | |
|
||||
PerlMSI: [CellData](#celldata2) | | X | | |
|
||||
PerIMSI: [CellUX](#cellux2) | | X | | |
|
||||
PerIMSI: [General](#general2) | | X | | |
|
||||
PerIMSI: [RCS](#rcs2) | | X | | |
|
||||
PerIMSI: [SMS](#sms2) | X | X | X | |
|
||||
PerIMSI: [UTK](#utk2) | | X | | |
|
||||
PerIMSI: [VoLTE](#volte) | | X | | |
|
||||
PerDevice: [CellConfigurations](#cellconfigurations) | | ✔️ | | | |
|
||||
PerDevice: [CellData](#celldata) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [CGDual](#cgdual) | | ✔️ | | |
|
||||
PerDevice: [eSim](#esim) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [External](#external) | | ✔️ | | |
|
||||
PerDevice: [General](#general) | | ✔️ | | |
|
||||
PerDevice: [RCS](#rcs) | | ✔️ | | |
|
||||
PerDevice: [SMS](#sms) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [UIX](#uix) | | ✔️ | | |
|
||||
PerDevice: [UTK](#utk) | | ✔️ | | |
|
||||
PerlMSI: [CellData](#celldata2) | | ✔️ | | |
|
||||
PerIMSI: [CellUX](#cellux2) | | ✔️ | | |
|
||||
PerIMSI: [General](#general2) | | ✔️ | | |
|
||||
PerIMSI: [RCS](#rcs2) | | ✔️ | | |
|
||||
PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | ✔️ | |
|
||||
PerIMSI: [UTK](#utk2) | | ✔️ | | |
|
||||
PerIMSI: [VoLTE](#volte) | | ✔️ | | |
|
||||
|
||||
|
||||
## PerDevice
|
||||
@ -124,7 +124,7 @@ ShowWifiCallingEmergencyCallWarning | Select **Yes** to show Wi-Fi emergency cal
|
||||
ShowWifiCallingError | Select **Yes** to show Wi-Fi calling error message.
|
||||
SlotSelectionSim1Name | Enter text for the name of SIM 1 in slot selection UI.
|
||||
SlotSelectionSim2Name | Enter text for the name of SIM 2 in slot selection UI.
|
||||
SuppressDePersoUI | Select **Yes** to hide the perso unlock UI.
|
||||
SuppressDePersoUI | Select **Yes** to hide the Perso unlock UI.
|
||||
|
||||
|
||||
### CGDual
|
||||
@ -228,11 +228,11 @@ UserEnabled | Select **Yes** to show the user setting if RCS is enabled on the d
|
||||
| SmsStoreDeleteSize | Set the number of messages that can be deleted when a "message full" indication is received from the modem. |
|
||||
| SprintFragmentInfoInBody | Partners can enable the messaging client to allow users to enter more than 160 characters per message. Messages longer than 160 characters are sent as multiple SMS messages that contain a tag at the beginning of the message in the form "(1/2)", where the first number represents the segment or part number and the second number represents the total number of segments or parts. Multiple messages are limited to 6 total segments. When enabled, the user cannot enter more characters after the 6 total segments limit is reached. Any message received with tags at the beginning is recombined with its corresponding segments and shown as one composite message. |
|
||||
| Type3GPP > ErrorHandling > ErrorType | Enter a name for ERRORCODE3GPP, and click **Add**. Configure the error type that you added as **Transient Failure** or **Permanent Failure**. |
|
||||
| Type3GPP > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP, and click **Add**. Configure the error class that you added as **generic error**, **invalid recepient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP, and click **Add**. Configure the error class that you added as **generic error**, **invalid recipient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP > IMS > AttemptThresholdForIMS | Set the maximum number of tries to send SMS on IMS. |
|
||||
| Type3GPP > IMS > RetryEnabled | Configure whether to enable one automatic retry after failure to send over IMS. |
|
||||
| Type 3GPP > SmsUse16BitReferenceNumbers | Configure whether to use 8-bit or 16-bit message ID (reference number) in the UDH. |
|
||||
| Type3GPP2 > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP2, and click **Add**. Configure the error class that you added as **generic error**, **invalid recepient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP2 > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP2, and click **Add**. Configure the error class that you added as **generic error**, **invalid recipient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP2 > ErrorHandling > UseReservedAsPermanent | Set the 3GPP2 permanent error type. |
|
||||
|
||||
### UIX
|
||||
@ -385,9 +385,9 @@ See descriptions in Windows Configuration Designer.
|
||||
| SmsPageLimit | Partners can specify a maximum length for SMS messages. This requires setting both the maximum number of SMS fragments per SMS message, from 1 to 255, and the maximum size in bytes of each SMS fragment, from 16 to 140 bytes. Use SmsPageLimit to set the maximum number of segments in a concatenated SMS message. You must set the value to 255 (0xFF) or smaller. You must also use SmsFragmentLimit to set the maximum number of bytes in the body of the SMS message. |
|
||||
| SprintFragmentInfoInBody | Partners can enable the messaging client to allow users to enter more than 160 characters per message. Messages longer than 160 characters are sent as multiple SMS messages that contain a tag at the beginning of the message in the form "(1/2)", where the first number represents the segment or part number and the second number represents the total number of segments or parts. Multiple messages are limited to 6 total segments. When enabled, the user cannot enter more characters after the 6 total segments limit is reached. Any message received with tags at the beginning is recombined with its corresponding segments and shown as one composite message. |
|
||||
| Type3GPP > ErrorHandling > ErrorType | Enter a name for ERRORCODE3GPP, and click **Add**. Configure the error type that you added as **Transient Failure** or **Permanent Failure**. |
|
||||
| Type3GPP > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP, and click **Add**. Configure the error class that you added as **generic error**, **invalid recepient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP, and click **Add**. Configure the error class that you added as **generic error**, **invalid recipient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP > IMS > SmsUse16BitReferenceNumbers | Configure whether to use 8-bit or 16-bit message ID (reference number) in the UDH. |
|
||||
| Type3GPP2 > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP2, and click **Add**. Configure the error class that you added as **generic error**, **invalid recepient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP2 > ErrorHandling > FriendlyErrorClass | Enter a name for ERRORCODE3GPP2, and click **Add**. Configure the error class that you added as **generic error**, **invalid recipient address**, or **network connectivity trouble**. |
|
||||
| Type3GPP2 > ErrorHandling > UseReservedAsPermanent | Set the 3GPP2 permanent error type. |
|
||||
|
||||
<span id="utk2" />
|
||||
|
||||
@ -23,7 +23,7 @@ Use to configure settings for cellular connections.
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
## PerDevice
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ Use to deploy Root Certificate Authority (CA) certificates to devices. The follo
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All setting groups | X | X | X | X | X |
|
||||
| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
|
||||
## CACertificates
|
||||
|
||||
@ -21,8 +21,8 @@ Use to remove user-installed and pre-installed applications, with the option to
|
||||
|
||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| CleanPCRetainingUserData | X | | | | |
|
||||
| CleanPCWithoutRetainingUserData | X | | | | |
|
||||
| CleanPCRetainingUserData | ✔️ | | | | |
|
||||
| CleanPCWithoutRetainingUserData | ✔️ | | | | |
|
||||
|
||||
For each setting, the options are **Enable** and **Not configured**.
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ Use to configure settings related to various types of phone connections.
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | X | X | | |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
For each setting group:
|
||||
|
||||
@ -21,12 +21,12 @@ Use to configure profiles that a user will connect with, such as an email accoun
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Email](#email) | X | X | X | | |
|
||||
| [Exchange](#exchange) | X | X | X | | |
|
||||
| [KnownAccounts](#knownaccounts) | X | X | X | | |
|
||||
| [VPN](#vpn) | X | X | X | X | |
|
||||
| [WiFiSense](#wifisense) | X | X | X | | |
|
||||
| [WLAN](#wlan) | X | X | X | X | |
|
||||
| [Email](#email) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [Exchange](#exchange) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
||||
| [WiFiSense](#wifisense) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
||||
|
||||
## Email
|
||||
|
||||
@ -118,8 +118,8 @@ Configure settings to change the default maximum transmission unit ([MTU](#mtu))
|
||||
| --- | --- |
|
||||
| **ProfileType** | Choose between **Native** and **Third Party** |
|
||||
| AlwaysOn | Set to **True** to automatically connect the VPN at sign-in |
|
||||
| ByPassForLocal | When set to **True**, requests to local resources on the same Wi-Fi neetwork as the VPN client can bypass VPN |
|
||||
| DnsSuffix | Enter one or more comma-separated DNS suffixes. The first suffix listed is usedas the primary connection-specific DNS suffix for the VPN interface. The list is added to the SuffixSearchList. |
|
||||
| ByPassForLocal | When set to **True**, requests to local resources on the same Wi-Fi network as the VPN client can bypass VPN |
|
||||
| DnsSuffix | Enter one or more comma-separated DNS suffixes. The first suffix listed is used as the primary connection-specific DNS suffix for the VPN interface. The list is added to the SuffixSearchList. |
|
||||
| LockDown | When set to **True**:</br>- Profile automatically becomes an "always on" profile</br>- VPN cannot be disconnected</br>-If the profile is not connected, the user has no network connectivity</br>- No other profiles can be connected or modified |
|
||||
| Proxy | Configure to **Automatic** or **Manual** |
|
||||
| ProxyAutoConfigUrl | When **Proxy** is set to **Automatic**, enter the URL to automatically retrieve the proxy settings |
|
||||
@ -135,7 +135,7 @@ AuthenticationUserMethod | When you set **NativeProtocolType** to **IKEv2**, cho
|
||||
EAPConfiguration | When you set **AuthenticationUserMethod** to **EAP**, enter the HTML-encoded XML to configure EAP. For more information, see [EAP configuration](/windows/client-management/mdm/eap-configuration).
|
||||
NativeProtocolType | Choose between **PPTP**, **L2TP**, **IKEv2**, and **Automatic**.
|
||||
RoutingPolicyType | Choose between **SplitTunnel**, in which traffic can go over any interface as determined by the networking stack, and **ForceTunnel**, in which all IP traffic must go over the VPN interface.
|
||||
Server | Enter the public or routable IP address or DNS name for the VPN gateway. It can point to the exteranl IP of a gateway or a virtual IP for a server farm.
|
||||
Server | Enter the public or routable IP address or DNS name for the VPN gateway. It can point to the external IP of a gateway or a virtual IP for a server farm.
|
||||
|
||||
When **ProfileType** is set to **Third Party**, the following additional settings are available.
|
||||
|
||||
@ -201,4 +201,4 @@ Enter a SSID, click **Add**, and then configure the following settings for the S
|
||||
| ProxyServerPort | (Optional) Specify the configuration of the network proxy as **host:port**. A proxy server host and port can be specified per connection for Windows 10 for mobile devices. The host can be server name, FQDN, or SLN or IPv4 or IPv6 address. This proxy configuration is only supported in Windows 10 for mobile devices. Using this configuration in Windows 10 for desktop editions will result in failure. |
|
||||
| AutoConnect | (Optional) Select **True** or **false** to specify whether to automatically connect to WLAN. |
|
||||
| HiddenNetwork | (Optional) Select **True** or **false** to specify whether the network is hidden. |
|
||||
| SecurityType | Choose between **Open**, **WEP**, and **WPA2-Personal**. </br></br>If you select **WEP** or **WPA2-Personal**, enter the **SecurityKey** required by the WLAN. |
|
||||
| SecurityType | Choose between **Open**, **WEP**, and **WPA2-Personal**. </br></br>If you select **WEP** or **WPA2-Personal**, enter the **SecurityKey** required by the WLAN. |
|
||||
|
||||
@ -21,6 +21,6 @@ Use to configure a setting that partners must customize to ship Windows devices
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| CountryCodeForExtendedCapabilityPrompts | X | X | X | | |
|
||||
| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
You can set the **CountryCodeForExtendedCapabilityPrompts** setting for **China** to enable additional capability prompts when apps use privacy-sensitive features (such as Contacts or Microphone).
|
||||
|
||||
@ -21,5 +21,5 @@ Do not use. Instead, use the [Personalization settings](wcd-personalization.md).
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
|
||||
@ -21,8 +21,8 @@ Use to unlock developer mode on HoloLens devices and configure authentication to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EnableDeveloperMode](#enabledevelopermode) | | | | X | |
|
||||
| [AuthenticationMode](#authenticationmode) | | | | X | |
|
||||
| [EnableDeveloperMode](#enabledevelopermode) | | | | ✔️ | |
|
||||
| [AuthenticationMode](#authenticationmode) | | | | ✔️ | |
|
||||
|
||||
|
||||
<span id="enabledevelopermode" />
|
||||
|
||||
@ -21,7 +21,7 @@ Use to identify the form factor of the device.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| DeviceForm | X | X | X | | |
|
||||
| DeviceForm | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
Specifies the device form factor running Windows 10. Generally, the device form is set by the original equipment manufacturer (OEM), however you might want to change the device form based on its usage in your organization.
|
||||
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
---
|
||||
title: DeviceInfo (Windows 10)
|
||||
description: This section describes the DeviceInfo settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/21/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# DeviceInfo (Windows Configuration Designer reference)
|
||||
|
||||
Use to configure settings for DeviceInfo.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>These settings are intended to be used only by manufacturers, mobile operators, and solution providers when configuring devices, and are not intended for use by administrators in the enterprise.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
|
||||
## PhoneMobileOperatorDisplayName
|
||||
|
||||
Enter a friendly name for the mobile operator. This string is displayed in the support section of the **Settings > About** screen and in the ringtone list.
|
||||
|
||||
## PhoneMobileOperatorName
|
||||
|
||||
This setting is used for targeting phone updates. It must contain a code specified by Microsoft that corresponds to the mobile operator. These codes are provided in [Registry values for mobile operator IDs](https://msdn.microsoft.com/library/windows/hardware/dn772250.aspx). For open market phones, in which the mobile operator is not known, use the codes in [Registry values for carrier-unlocked phones](https://msdn.microsoft.com/library/windows/hardware/dn772248.aspx) instead.
|
||||
|
||||
This string is not visible to the user.
|
||||
|
||||
This setting must not be changed over time even if the user switches SIMs or mobile operators, as updates are always targeted based on the first mobile operator associated with the phone.
|
||||
|
||||
The [PhoneManufacturer](/previous-versions/windows/hardware/previsioning-framework/mt138328(v=vs.85)), [PhoneManufacturerModelName](/previous-versions/windows/hardware/previsioning-framework/mt138336(v=vs.85)), and PhoneMobileOperatorName should create a unique Phone-Operator-Pairing (POP).
|
||||
|
||||
|
||||
|
||||
## PhoneOEMSupportLink
|
||||
|
||||
This should be a functional link that starts with http://. The link should be a URL that redirects to the mobile version of the web page. The content in the webpage should reflow to the screen width. This can be achieved by adding the CSS Tag `"@-ms-viewport { width: device-width; }"`.
|
||||
|
||||
The default is an empty string (""), which means that a support link will not be displayed to the user.
|
||||
|
||||
This setting varies by OEM.
|
||||
|
||||
|
||||
## PhoneSupportLink
|
||||
|
||||
This should be a functional link that starts with http://. The link should be a URL that redirects to the mobile version of the web page. The content in the webpage should reflow to the screen width. This can be achieved by adding the CSS Tag `"@-ms-viewport { width: device-width; }"`.
|
||||
|
||||
The default is an empty string (""), which means that a support link will not be displayed to the user.
|
||||
|
||||
This setting varies by OEM.
|
||||
|
||||
|
||||
## PhoneSupportPhoneNumber
|
||||
|
||||
Use to specify the OEM or mobile operator's support contact phone number. The country code is not required. This string is displayed in the About screen in Settings. This setting also corresponds to the Genuine Windows Phone Certificates (GWPC) support number.
|
||||
@ -21,10 +21,10 @@ Use to configure device management settings.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Accounts](#accounts) | X | X | X | | |
|
||||
| [PGList](#pglist) | X | X | X | | |
|
||||
| [Policies](#policies) | X | X | X | | |
|
||||
| [TrustedProvisioningSource](#trustedprovisioningsource) | X | X | X | | |
|
||||
| [Accounts](#accounts) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [PGList](#pglist) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [Policies](#policies) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
## Accounts
|
||||
|
||||
@ -45,7 +45,7 @@ Use to configure device management settings.
|
||||
| DisableOnRoaming | Specify whether the client will connect while cellular roaming |
|
||||
| InitialBackOffTime | Specify the initial amount of time (in milliseconds) that the DM client waits before attempting a connection retry |
|
||||
| InitiateSession | Specify whether a session should be started with the MDM server when the account is provisioned |
|
||||
| MaxBackOffTime | Specify the maximum number of milliseconds to wait before attemption a connection retry |
|
||||
| MaxBackOffTime | Specify the maximum number of milliseconds to wait before attempting a connection retry |
|
||||
| Name | Enter a display name for the management server |
|
||||
| Port | Enter the OMA DM server port |
|
||||
| PrefConRef | Enter a URI to NAP management object or a connection GUID used by the device Connection Manager |
|
||||
@ -92,4 +92,4 @@ In **PROVURL**, enter the URL for a Trusted Provisioning Server (TPS).
|
||||
## Related topics
|
||||
|
||||
- [DMAcc configuration service provider (CSP)](/windows/client-management/mdm/dmacc-csp)
|
||||
- [PXLOGICAL CSP](/windows/client-management/mdm/pxlogical-csp)
|
||||
- [PXLOGICAL CSP](/windows/client-management/mdm/pxlogical-csp)
|
||||
|
||||
@ -19,5 +19,5 @@ Do not use **DeviceUpdateCenter** settings at this time.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ Use to specify enterprise-specific mobile device management configuration settin
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| UpdateManagementServiceAddress | X | X | X | | X |
|
||||
| UpdateManagementServiceAddress | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
For the **UpdateManagementServiceAddress** setting, enter a list of servers. The first server in the semi-colon delimited list is the server that will be used to instantiate MDM sessions.
|
||||
|
||||
|
||||
@ -21,9 +21,9 @@ Use to upgrade the edition of Windows 10 on the device. [Learn about Windows 10
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ChangeProductKey](#changeproductkey) | X | X | | | |
|
||||
| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | X | X | | X | |
|
||||
| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | X | X | | | |
|
||||
| [ChangeProductKey](#changeproductkey) | ✔️ | ✔️ | | | |
|
||||
| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | ✔️ | | ✔️ | |
|
||||
| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | ✔️ | | | |
|
||||
|
||||
|
||||
## ChangeProductKey
|
||||
|
||||
@ -21,7 +21,7 @@ Use to enable AllJoyn router to work on public networks.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| EnableAllJoynOnPublicNetwork | | | | | X |
|
||||
| EnableAllJoynOnPublicNetwork | | | | | ✔️ |
|
||||
|
||||
Set to **True** or **False**.
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ Use these settings to configure the out-of-box experience (OOBE) to set up HoloL
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | X | |
|
||||
| All settings | | | | ✔️ | |
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
|
||||
@ -21,6 +21,6 @@ Use to add files to the device.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| PublicDocuments | X | X | X | | |
|
||||
| PublicDocuments | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
Browse to and select a file or files that will be included in the provisioning package and added to the public profile documents folder on the target device. You can use the **Relative path to directory on target device** field to create a new folder within the public profile documents folder.
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
---
|
||||
title: InitialSetup (Windows 10)
|
||||
description: This section describes the InitialSetup setting that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/06/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# InitialSetup (Windows Configuration Designer reference)
|
||||
|
||||
Use to set the name of the Windows mobile device.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| DeviceName | | X | | | |
|
||||
|
||||
In **DeviceName**, enter a name for the device. If **DeviceName** is set to an asterisk (*) or is an empty string, a random device name will be generated.
|
||||
|
||||
**DeviceName** is a string with a maximum length of 15 bytes of content:
|
||||
|
||||
- **DeviceName** can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.
|
||||
- **DeviceName** cannot use spaces or any of the following characters: { | } ~ [ \ ] ^ ' : ; < = > ? @ ! " # $ % ` ( ) + / . , * &, or contain any spaces.
|
||||
- **DeviceName** cannot use some non-standard characters, such as emoji.
|
||||
|
||||
@ -1,98 +0,0 @@
|
||||
---
|
||||
title: InternetExplorer (Windows 10)
|
||||
description: This section describes the InternetExplorer settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/06/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# InternetExplorer (Windows Configuration Designer reference)
|
||||
|
||||
Use to configure settings related to Internet Explorer.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [CustomHTTPHeaders](#customhttpheaders) | | X | | | |
|
||||
| [CustomUserAgentString](#customuseragentstring) | | X | | | |
|
||||
| DataSaving > [BrowseDataSaver](#browsedatasaver) | | X | | | |
|
||||
| DataSaving > [ShowPicturesAutomatically](#showpicturesautomatically) | | X | | | |
|
||||
| [FirstRunURL](#firstrunurl) | | X | | | |
|
||||
|
||||
## CustomHTTPHeaders
|
||||
|
||||
Configure Microsoft Edge to send custom HTTP headers. These will be sent in addition to the default HTTP headers with all HTTP and HTTPS requests. The header is the portion of the HTTP request that defines the form of the message.
|
||||
|
||||
- A maximum of 16 custom headers can be defined.
|
||||
- Custom headers cannot be used to modify the user agent string.
|
||||
- Each header must be no more than 1 KB in length.
|
||||
|
||||
The following header names are reserved and must not be overwritten:
|
||||
|
||||
- Accept
|
||||
- Accept-Charset
|
||||
- Accept-Encoding
|
||||
- Authorization
|
||||
- Expect
|
||||
- Host
|
||||
- If-Match
|
||||
- If-Modified-Since
|
||||
- If-None-Match
|
||||
- If-Range
|
||||
- If-Unmodified-Since
|
||||
- Max-Forwards
|
||||
- Proxy-Authorization
|
||||
- Range
|
||||
- Referer
|
||||
- TE
|
||||
- USER-AGENT
|
||||
- X-WAP-PROFILE
|
||||
|
||||
1. In **Available customizations**, select **CustomHTTPHeaders**, enter a name, and then click **Add**.
|
||||
2. In **Available customizations**, select the name that you just created.
|
||||
3. Enter the custom header.
|
||||
|
||||
## CustomUserAgentString
|
||||
|
||||
The user agent string indicates which browser you are using, its version number, and details about your system, such as operating system and version. A web server can use this information to provide content that is tailored for your specific browser and phone.
|
||||
|
||||
The user agent string for the browser cannot be modified. By default, the string has the following format:
|
||||
|
||||
`Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; <Manufacturer>; <Device>) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.10166`
|
||||
|
||||
- `<Manufacturer>` is automatically replaced with the OEM name. This is the same as the PhoneManufacturer setting value that is set as part of the customization Phone metadata in DeviceTargetingInfo.
|
||||
- `<Device>` is replaced with the device name or phone name. This is the same as the PhoneModelName setting value that is set as part of the customization Phone metadata in DeviceTargetingInfo.
|
||||
|
||||
|
||||
**Limitations and restrictions:**
|
||||
|
||||
- The user agent string for the browser cannot be modified outside of the customizations listed above.
|
||||
- The user agent type registry setting cannot be modified or used to change the default browser view from Mobile to Desktop.
|
||||
|
||||
|
||||
|
||||
## BrowseDataSaver
|
||||
|
||||
Use to set the browser data saver default setting. **True** turns on the browser data saver feature.
|
||||
|
||||
Partners can configure the default setting for the browser data saver feature by turning the browser optimization service (through the BrowserDataSaver setting) on or off.
|
||||
|
||||
|
||||
## ShowPicturesAutomatically
|
||||
|
||||
Use to enable or disable whether the **Show pictures automatically** setting is available in Internet Explorer **advanced settings**.
|
||||
|
||||
|
||||
## FirstRunURL
|
||||
|
||||
Use to set the home page that appears the first time that Microsoft Edge is opened. This page is only shown the first time the browser is opened. After that, the browser displays either the most recently viewed page or an empty page if the user has closed all tabs or opens a new tab.
|
||||
|
||||
Specify the **FirstRunURL** value with a valid link that starts with http://. It is recommended you use a forward link that redirects the user to a localized page.
|
||||
@ -21,7 +21,7 @@ Use KioskBrowser settings to configure Internet sharing.
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | | X |
|
||||
| All settings | | | | | ✔️ |
|
||||
|
||||
>[!NOTE]
|
||||
>To configure Kiosk Browser settings for desktop editions, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
|
||||
|
||||
@ -21,8 +21,8 @@ Use for settings related to Microsoft licensing programs.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | X | | | | |
|
||||
| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | X | | | | |
|
||||
| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | | |
|
||||
| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | | |
|
||||
|
||||
## AllowWindowsEntitlementReactivation
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ Use Location settings to configure location services.
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EnableLocation](#enablelocation) | | | | | X |
|
||||
| [EnableLocation](#enablelocation) | | | | | ✔️ |
|
||||
|
||||
## EnableLocation
|
||||
|
||||
|
||||
@ -20,9 +20,9 @@ Use for settings related to Maps.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ChinaVariantWin10](#chinavariantwin10) | X | X | X | | |
|
||||
| [UseExternalStorage](#useexternalstorage) | X | X | X | | |
|
||||
| [UseSmallerCache](#usesmallercache) | X | X | X | | |
|
||||
| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
## ChinaVariantWin10
|
||||
|
||||
@ -1,359 +0,0 @@
|
||||
---
|
||||
title: Messaging (Windows 10)
|
||||
description: This section describes the Messaging settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Messaging (Windows Configuration Designer reference)
|
||||
|
||||
Use for settings related to Messaging and Commercial Mobile Alert System (CMAS).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>These settings are intended to be used only by manufacturers, mobile operators, and solution providers when configuring devices, and are not intended for use by administrators in the enterprise.
|
||||
|
||||
>[!NOTE]
|
||||
>CMAS is now known as Wireless Emergency Alerts (WEA).
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
## GlobalSettings
|
||||
|
||||
### DisplayCmasLifo
|
||||
|
||||
Use this setting to change the order in which CMAS alert messages are displayed, from the default first in/first out (FIFO) message order to last in/first out (LIFO) message order.
|
||||
|
||||
If the phone receives at least one CMAS alert message which has not been acknowledged by the user, and another CMAS alert message arrives on the phone, partners can configure the order in which the newly received alert messages are displayed on the phone regardless of the service category of the alert. Users will not be able to change the message order once it has been set.
|
||||
|
||||
If partners do not specify a value for this customization, the default FIFO display order is used. Users will be able to acknowledge the messages in the reverse order they were received.
|
||||
|
||||
When configured as **True**, you set a LIFO message order. When configured as **False**, you set a FIFO message order.
|
||||
|
||||
### EnableCustomLineSetupDialog
|
||||
|
||||
Enable this setting to allow custom line setup dialogs in the Messaging app.
|
||||
|
||||
### ExtractPhoneNumbersInStrings"
|
||||
|
||||
Set as **True** to tag any 5-or-more digit number as a tappable phone number.
|
||||
|
||||
### ShowSendingStatus
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
Set **ShowSendingStatus** to **True** to display the sending status for SMS/MMS messages.
|
||||
|
||||
### VoicemailIntercept
|
||||
|
||||
Partners can define a filter that intercepts an incoming SMS message and triggers visual voicemail synchronization. The filtered message does not appear in the user’s conversation list.
|
||||
|
||||
A visual voicemail sync is triggered by an incoming SMS message if the following conditions are met:
|
||||
|
||||
- The message sender value starts with the string specified in the SyncSender setting. The length of the specified values must be greater than 3 characters but less than 75 characters.
|
||||
|
||||
- The body of the message starts with the string specified in the SyncPrefix setting. The length of the specified values must be greater than 3 characters but less than 75 characters.
|
||||
|
||||
- Visual voicemail is configured and enabled. For more information, see [Visual voicemail](https://msdn.microsoft.com/library/windows/hardware/dn790032.aspx).
|
||||
|
||||
>[!NOTE]
|
||||
>These settings are atomic, so both SyncSender and SyncPrefix must be set.
|
||||
>
|
||||
>The SyncSender and SyncPrefix values vary for each mobile operator, so you must work with your mobile operators to obtain the correct or required values.
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
SyncPrefix | Specify a value for SyncPrefix that is greater than 3 characters but less than 75 characters in length. For networks that support it, this value can be the keyword for the SMS notification.
|
||||
SyncSender | Specify a value for SyncSender that is greater than 3 characters but less than 75 characters in length. For networks that support it, this value can be a short code of the mailbox server that sends a standard SMS notification.
|
||||
|
||||
|
||||
|
||||
## PerSimSettings
|
||||
|
||||
Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the following settings.
|
||||
|
||||
### AllowMmsIfDataIsOff
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
AllowMmsIfDataIsOff | **True** allows MMS if data is off
|
||||
AllowMmsIfDataIsOffSupported | **True** shows the toggle for allowing MMS if data is turned off
|
||||
AllowMmsIfDataIsOffWhileRoaming | **True** allows MMS if data is off while roaming
|
||||
|
||||
### AllowSelectAllContacts
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709, and later.
|
||||
|
||||
Set to **True** to show the select all contacts/unselect all menu option to allow users to easily select multiple recipients for an SMS or MMS message. This menu option provides users with an easier way to add multiple recipients and may also meet a mandatory requirement for some mobile operator networks.
|
||||
|
||||
Windows 10 Mobile supports the following select multiple recipients features:
|
||||
|
||||
- A multi-select chooser, which enables users to choose multiple contacts.
|
||||
- A **select all contacts/unselect all** menu option, which enables users to select or unselect all their contacts. This option is not shown by default and must be enabled by the OEM.
|
||||
|
||||
### AllowSendingDeliveryReport
|
||||
|
||||
Specify whether the phone automatically sends a receipt acknowledgment for MMS messages. Partners can specify whether the phone automatically sends a receipt acknowledgment for MMS messages when they arrive, and they can determine whether users can control the receipt acknowledgments by using the **Send MMS acknowledgment** toggle in **Messaging > settings**. By default, this user setting is visible and turned on.
|
||||
|
||||
| Setting | Description |
|
||||
| --- | --- |
|
||||
| AllowSendingDeliveryReport | **True** sets the **Send MMS acknowledgment** toggle to **On** |
|
||||
| AllowSendingDeliveryReportIsSupported | **True** shows the **Send MMS acknowledgment** toggle, and **False** hides the toggle |
|
||||
|
||||
### AutomaticallyDownload
|
||||
|
||||
Specify whether MMS messages are automatically downloaded.
|
||||
|
||||
| Setting | Description |
|
||||
| --- | --- |
|
||||
| AutomaticallyDownload | **True** sets the **Automatically download MMS** toggle to **On** |
|
||||
| ShowAutomaticallyDownloadMMSToggle | **True** shows the **Automatically download MMS** toggle, and **False** hides the toggle |
|
||||
|
||||
|
||||
### DefaultContentLocationUrl
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
For networks that require it, you can specify the default GET path within the MMSC to use when the GET URL is missing from the WAP push MMS notification.
|
||||
|
||||
Set **DefaultContentLocationUrl** to specify the default GET path within the MMSC.
|
||||
|
||||
### ErrorCodeEnabled
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
You can choose to display additional content in the conversation view when an SMS or MMS message fails to send. This content includes a specific error code in decimal format that the user can report to technical support. Common errors also include a friendly string to help the user self-diagnose and fix the problem.
|
||||
|
||||
Set to **True** to display the error message with an explanation of the problem and the decimal-format error codes. When set to **False**, the full error message is not displayed.
|
||||
|
||||
### EmergencyAlertOptions
|
||||
|
||||
Configure settings for CMAS alerts.
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
CmasAMBERAlertEnabled | **True** enables the device to receive AMBER alerts
|
||||
CmasExtremeAlertEnabled | **True** enables the device to receive extreme alerts
|
||||
CmasSevereAlertEnabled | **True** enables the device to receive severe alerts
|
||||
EmOperatorEnabled | Select which Emergency Alerts Settings page is displayed from dropdown menu
|
||||
EtwsSoundEnabled | Set to **True** to play Earthquake & Tsunami Warning System (ETWS) sound during alert.
|
||||
SevereAlertDependentOnExtremeAlert | When set as **True**, the CMAS-Extreme alert option must be on to modify CMAS-Severe alert option
|
||||
|
||||
|
||||
### General
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
AllowSelectAllContacts | Set to **True** to show the **select all contacts/unselect all** menu option to allow users to easily select multiple recipients for an SMS or MMS message. This menu option provides users with an easier way to add multiple recipients and may also meet a mandatory requirement for some mobile operator networks. Windows 10 Mobile supports the following select multiple recipients features:</br></br>- A multi-select chooser, which enables users to choose multiple contacts.</br>- A **select all contacts/unselect all** menu option, which enables users to select or unselect all their contacts. This option is not shown by default and must be enabled by the OEM.
|
||||
AllowSMStoSMTPAddress | Allow SMS to SMTP address.
|
||||
AssistedDialingMcc | By setting AssistedDialingMcc and AssistedDialingMnc, international assisted dialing will be enabled for SMS if the user setting for international assisted dialing is enabled. Enter the Mobile Country Code (MCC) to use for sending SMS.
|
||||
AssistedDialingMnc | By setting AssistedDialingMcc and AssistedDialingMnc, international assisted dialing will be enabled for SMS if the user setting for international assisted dialing is enabled. Enter the Mobile Network Code (MNC) to use for sending SMS.
|
||||
AssistedDialingPlusCodeSupportOverride | For devices that support IMS over SMS, you can override support for the assisted dialing plus (+) code for SMS by setting AssistedDialingPlusCodeSupportOverride. If enabled, the OS will not convert the plus (+) code to the proper assisted number when the user turns on the dialing assist option.
|
||||
AutoRetryDownload | You can configure the messaging app to automatically retry downloading an MMS message if the initial download attempt fails. When this customization is enabled, the download is retried 3 times at 20-, 40-, and 60-second intervals.
|
||||
BroadcastChannels | You can specify one or more ports from which the device will accept cellular broadcast messages. Set the BroadcastChannels value to the port number(s) that can accept cellular broadcast messages. If you specify the same port that Windows 10 Mobile already recognizes as an Emergency Alert port (a CMAS or ETWS port number) and a cell broadcast message is received on that port, the user will only receive the message once. The message that is received will be displayed as an Emergency Alert message.
|
||||
ConvertLongSMStoMMS | For networks that do support MMS and do not support segmentation of SMS messages, you can specify an automatic switch from SMS to MMS for long messages.
|
||||
DefaultContentLocationUrl | For networks that require it, you can specify the default GET path within the MMSC to use when the GET URL is missing from the WAP push MMS notification. Set DefaultContentLocationUrl to specify the default GET path within the MMSC.
|
||||
EarthquakeMessageString | To override the Primary Earthquake default message, specify the EarthquakeMessageString setting value. This string will be used regardless of what language is set on the device.
|
||||
EarthquakeTsunamiMessageString| To override the Primary Tsunami and Earthquake default message, specify the EarthquakeTsunamiMessageString setting value. This string will be used regardless of what language is set on the device.
|
||||
ErrorCodeEnabled | You can choose to display additional content in the conversation view when an SMS or MMS message fails to send. This content includes a specific error code in decimal format that the user can report to technical support. Common errors also include a friendly string to help the user self-diagnose and fix the problem. Set to **True** to display the error message with an explanation of the problem and the decimal-format error codes. When set to **False**, the full error message is not displayed.
|
||||
EtwsSoundFileName | Set the value to the name of a sound file.
|
||||
HideMediumSIPopups | By default, when a service indication message is received with a signal-medium or signal-high setting, the phone interrupts and shows the user prompt for these messages. However, you can hide the user prompts for signal-medium messages.
|
||||
ImsiAuthenticationToken | Configure whether MMS messages include the IMSI in the GET and POST header. Set ImsiAuthenticationToken to the token used as the header for authentication. The string value should match the IMSI provided by the UICC.
|
||||
LimitRecipients | Set the maximum number of recipients to which a single SMS or MMS message can be sent. Enter a number between 1 and 500 to limit the maximum number of recipients.
|
||||
MaxRetryCount | You can specify the number of times that the phone can retry sending the failed MMS message and photo before the user receives a notification that the photo could not be sent. Specify MaxRetryCount to specify the number of times the MMS transport will attempt resending the MMS message. This value has a maximum limit of 3.
|
||||
MMSLimitAttachments | You can specify the maximum number of attachments for MMS messages, from 1 to 20. The default is 5.
|
||||
NIInfoEnabled | NIInfoEnabled
|
||||
ProxyAuthorizationToken | See [Proxy authorization for MMS.](/windows-hardware/customize/mobile/mcsf/proxy-authorization-for-mms)
|
||||
RetrySize | For MMS messages that have photo attachments and that fail to send, you can choose to automatically resize the photo and attempt to resend the message. Specify the maximum size to use to resize the photo in KB. Minimum is 0xA (10 KB).
|
||||
SetCacheControlNoTransform | When set, proxies and transcoders are instructed not to change the HTTP header and the content should not be modified. A value of 1 or 0x1 adds support for the HTTP header Cache-Control No-Transform directive. When the SetCacheControlNoTransform``Value is set to 0 or 0x0 or when the setting is not set, the default HTTP header Cache-Control No-Cache directive is used.
|
||||
ShowRequiredMonthlyTest | **True** enables devices to receive CMAS Required Monthly Test (RMT) messages and have these show up on the device. **False** disables devices from receiving CMAS RMT messages.
|
||||
SIProtocols | Additional supported service indication protocol name.
|
||||
SmscPanelDisabled | **True** disables the short message service center (SMSC) panel.
|
||||
SMStoSMTPShortCode | Use to configure SMS messages to be sent to email addresses and phone numbers. `0` disables sending SMS messages to SMTP addresses. `1` enables sending SMS messages to SMTP addresses.
|
||||
TargetVideoFormat | You can specify the transcoding to use for video files sent as attachments in MMS messages. Set TargetVideoFormat to one of the following values to configure the default transcoding for video files sent as attachments in MMS messages:</br></br>- 0 or 0x0 Sets the transcoding to H.264 + AAC + MP4. This is the default set by the OS.</br>- 1 or 0x1 Sets the transcoding to H.264 + AAC + 3GP.</br>- 2 or 0x2 Sets the transcoding to H.263 + AMR.NB + 3GP.</br>- 3 or 0x3 Sets the transcoding to MPEG4 + AMR.NB + 3GP.
|
||||
TsunamiMessageString | To override the Primary Tsunami default message, specify the TsunamiMessageString setting value. This string will be used regardless of what language is set on the device.
|
||||
UAProf | You can specify a user agent profile to use on the phone for MMS messages. The user agent profile XML file details a phone’s hardware specifications and media capabilities so that an MMS application server (MMSC) can return supported optimized media content to the phone. The user agent profile XML file is generally stored on the MMSC. There are two ways to correlate a user agent profile with a given phone:</br></br>- You can take the user agent string of the phone that is sent with MMS requests and use it as a hash to map to the user agent profile on the MMSC. The user agent string cannot be modified.</br>- Alternatively, you can directly set the URI of the user agent profile on the phone.</br></br>Set UAProf to the full URI of your user agent profile file. Optionally, you can also specify the custom user agent property name for MMS that is sent in the header by setting UAProfToken to either `x-wap-profile` or `profile`.
|
||||
UAProfToken | You can specify a user agent profile to use on the phone for MMS messages. The user agent profile XML file details a phone’s hardware specifications and media capabilities so that an MMS application server (MMSC) can return supported optimized media content to the phone. The user agent profile XML file is generally stored on the MMSC.
|
||||
UseDefaultAddress | By default, the MMS transport sends an acknowledgement to the provisioned MMS application server (MMSC). However, on some networks, the correct server to use is sent as a URL in the MMS message. In that case, a registry key must be set, or else the acknowledgement will not be received and the server will continue to send duplicate messages. **True** enables some networks to correctly acknowledge MMS messages. **False** disables the feature.
|
||||
UseInsertAddressToken | Use insert address token or local raw address.
|
||||
UserAgentString | Set UserAgentString to the new user agent string for MMS in its entirely. By default, this string has the format WindowsPhoneMMS/MicrosoftMMSVersionNumber WindowsPhoneOS/OSVersion-buildNumber OEM-deviceName, in which the italicized text is replaced with the appropriate values for the phone.
|
||||
UseUTF8ForUnspecifiedCharset | Some incoming MMS messages may not specify a character encoding. To properly decode MMS messages that do not specify a character encoding, you can set UTF-8 to decode the message.
|
||||
WapPushTechnology | For networks that require non-standard handling of single-segment incoming MMS WAP Push notifications, you can specify that MMS messages may have some of their content truncated and that they may require special handling to reconstruct truncated field values. `1` or `0x1` enables MMS messages to have some of their content truncated. `0` or `0x0` disables MMS messages from being truncated
|
||||
|
||||
## ImsiAuthenticationToken
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
Configure whether MMS messages include the IMSI in the GET and POST header.
|
||||
|
||||
Set **ImsiAuthenticationToken** to the token used as the header for authentication. The string value should match the IMSI provided by the UICC.
|
||||
|
||||
|
||||
### LatAlertOptions
|
||||
|
||||
Enable `LatLocalAlertEnabled` to enable support for LAT-Alert Local Alerts for devices sold in Chile. For more information, see [Emergency notifications](/windows-hardware/customize/mobile/mcsf/emergency-notifications).
|
||||
|
||||
### MaxRetryCount
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
You can specify the number of times that the phone can retry sending the failed MMS message and photo before the user receives a notification that the photo could not be sent.
|
||||
|
||||
Specify MaxRetryCount to specify the number of times the MMS transport will attempt resending the MMS message. This value has a maximum limit of 3.
|
||||
|
||||
### MMSGroupText
|
||||
|
||||
Set options for group messages sent to multiple people.
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
MMSGroupText | **True** enables group messages to multiple people sent as MMS.
|
||||
ShowMMSGroupTextUI | **True** shows the toggle for group text in messaging settings.
|
||||
ShowMmsGroupTextWarning | **True** shows the warning that alerts users of possible additional charges before sending a group text as MMS.
|
||||
|
||||
### NIAlertOptions
|
||||
|
||||
Enable `NI2AlertEnabled` to enable support for the Netherlands Announcements for devices sold in the Netherlands. For more information, see [Emergency notifications](/windows-hardware/customize/mobile/mcsf/emergency-notifications).
|
||||
|
||||
### RcsOptions
|
||||
|
||||
Set options for Rich Communications Services (RCS).
|
||||
|
||||
| Setting | Description |
|
||||
| --- | --- |
|
||||
RcsAllowLeaveClosedGroupChats | Whether or not to allow users to leave closed group chats.
|
||||
| RcsEnabled | Toggle to enable/disable RCS service. Set to **True** to enable. |
|
||||
| RcsFileTransferAutoAccept | Set to **True** to auto-accept RCS incoming file transfer if the file size is less than warning file size.|
|
||||
RcsFiletransferAutoAcceptWhileRoaming | Auto-accept RCS incoming file transfer when the file size is less than the warning file size while roaming.
|
||||
RcsGroupChatCreationMode | The mode used to create new RCS group chats.
|
||||
RcsGroupChatCreationgThreadingMode | The mode used to thread newly created RCS group chats.
|
||||
| RcsSendReadReceipt | Set to **True** to send read receipt to the sender when a message is read. |
|
||||
RcsTimeWindowsAfterSelfLeave | After RCS receives a self-left message, it will ignore messages during this time (in milliseconds), except self-join.
|
||||
| ShowRcsEnabled | Set to **True** to show the toggle for RCS activation. |
|
||||
|
||||
|
||||
### RequestDeliveryReport
|
||||
|
||||
Set options related to MMS message notifications. You can specify whether users receive notification that MMS messages could not be delivered, and determine whether users can control this by using the MMS delivery confirmation toggle in **Messaging > settings**. By default, this user setting is visible but turned off.
|
||||
|
||||
| Setting | Description |
|
||||
| --- | --- |
|
||||
| RequestDeliveryReport | Set to **True** to set the default value to on. |
|
||||
| RequestDeliveryReportIsSupported | **True** shows the toggle for MMS delivery confirmation, and **False** hides the toggle. |
|
||||
|
||||
|
||||
### SMSDeliveryNotify
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
DeliveryNotifySupported | Set to **True** to enable SMS delivery confirmation.
|
||||
SMSDeliveryNotify | Set to **True** to toggle SMS delivery confirmation.
|
||||
|
||||
### TargetVideoFormat
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
You can specify the transcoding to use for video files sent as attachments in MMS messages.
|
||||
|
||||
Set TargetVideoFormat to one of the following values to configure the default transcoding for video files sent as attachments in MMS messages:
|
||||
|
||||
| Value | Description |
|
||||
| --- | --- |
|
||||
| 0 or 0x0 | Sets the transcoding to H.264 + AAC + MP4. This is the default set by the OS. |
|
||||
| 1 or 0x1 | Sets the transcoding to H.264 + AAC + 3GP. |
|
||||
| 2 or 0x2 | Sets the transcoding to H.263 + AMR.NB + 3GP. |
|
||||
| 3 or 0x3 | Sets the transcoding to MPEG4 + AMR.NB + 3GP. |
|
||||
|
||||
|
||||
### TaiwanAlertOptions
|
||||
|
||||
Set options for Taiwan Emergency Alerts system. For more information, see [Emergency notifications](/windows-hardware/customize/mobile/mcsf/emergency-notifications#taiwan-alerts).
|
||||
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
TaiwanAlertEnabled | Receive Taiwan alerts.
|
||||
TaiwanEmergencyAlertEnabled | Receive Taiwan emergency alerts.
|
||||
TaiwanPresidentialAlertEnabled | Receive alerts from the Leader of the Taiwan Area.
|
||||
TaiwanRequiredMonthlytestEnabled | Receive Taiwan Required Monthly Test alerts.
|
||||
|
||||
|
||||
|
||||
### UAProf
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
You can specify a user agent profile to use on the phone for MMS messages. The user agent profile XML file details a phone’s hardware specifications and media capabilities so that an MMS application server (MMSC) can return supported optimized media content to the phone. The user agent profile XML file is generally stored on the MMSC.
|
||||
|
||||
There are two ways to correlate a user agent profile with a given phone:
|
||||
- You can take the user agent string of the phone that is sent with MMS requests and use it as a hash to map to the user agent profile on the MMSC. The user agent string cannot be modified.
|
||||
- Alternatively, you can directly set the URI of the user agent profile on the phone.
|
||||
|
||||
Set **UAProf** to the full URI of your user agent profile file. Optionally, you can also specify the custom user agent property name for MMS that is sent in the header by setting **UAProfToken** to either `x-wap-profile` or `profile`.
|
||||
|
||||
|
||||
### UAProfToken
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
You can specify a user agent profile to use on the phone for MMS messages. The user agent profile XML file details a phone’s hardware specifications and media capabilities so that an MMS application server (MMSC) can return supported optimized media content to the phone. The user agent profile XML file is generally stored on the MMSC.
|
||||
|
||||
Optionally, in addition to specifying **UAProf**, you can also specify the custom user agent property name for MMS that is sent in the header by setting **UAProfToken** to either `x-wap-profile` or `profile`.
|
||||
|
||||
|
||||
### UserAgentString
|
||||
|
||||
>[!NOTE]
|
||||
>This setting is removed in Windows 10, version 1709.
|
||||
|
||||
Set **UserAgentString** to the new user agent string for MMS in its entirely.
|
||||
|
||||
By default, this string has the format WindowsPhoneMMS/MicrosoftMMSVersionNumber WindowsPhoneOS/OSVersion-buildNumber OEM-deviceName, in which the italicized text is replaced with the appropriate values for the phone.
|
||||
|
||||
|
||||
### w4
|
||||
|
||||
| Setting | Description |
|
||||
| --- | --- |
|
||||
| ADDR | Specify the absolute MMSC URL. The possible values to configure the ADDR parameter are:</br></br>- A Uniform Resource Identifier (URI)</br>- An IPv4 address represented in decimal format with dots as delimiters</br>- A fully qualified Internet domain name |
|
||||
| APPID | Set to `w4`. |
|
||||
| MS | (optional) Specify the maximum size of MMS, in KB. If the value is not a number, or is less than or equal to 10, it will be ignored and outgoing MMS will not be resized. |
|
||||
| NAME | (optional) Enter user–readable application identity. This parameter is also used to define part of the registry path for the APPLICATION parameters. The possible values to configure the **NAME** parameter are:</br></br>- Character string containing the name</br>- no value specified</br></br>If no value is specified, the registry location will default to `<unnamed>`. If **NAME** is greater than 40 characters, it will be truncated to 40 characters. |
|
||||
| TONAPID | Specify the network access point identification name (NAPID) defined in the provisioning file. This parameter takes a string value. It is only possible to refer to network access points defined within the same provisioning file (except if the INTERNET attribute is set in the NAPDEF characteristic). For more information about the NAPDEF characteristic, see [NAPDEF configuration service provider](/windows/client-management/mdm/napdef-csp). |
|
||||
| TOPROXY | Specify one logical proxy with a matching PROXY-ID. It is only possible to refer to proxies defined within the same provisioning file. Only one proxy can be listed. The TO-PROXY value must be set to the value of the PROXY ID in PXLOGICAL that defines the MMS specific-proxy. |
|
||||
|
||||
### WapPushTechnology
|
||||
|
||||
>[!NOTE]
|
||||
>These settings are removed in Windows 10, version 1709.
|
||||
|
||||
For networks that require non-standard handling of single-segment incoming MMS WAP Push notifications, you can specify that MMS messages may have some of their content truncated and that they may require special handling to reconstruct truncated field values.
|
||||
|
||||
| Value | Description |
|
||||
| --- | --- |
|
||||
| 1 or 0x1 | Enables MMS messages to have some of their content truncated. |
|
||||
| 0 or 0x0 | Disables MMS messages from being truncated. |
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Customizations for SMS and MMS](/windows-hardware/customize/mobile/mcsf/customizations-for-sms-and-mms)
|
||||
@ -1,24 +0,0 @@
|
||||
---
|
||||
title: ModemConfiguration (Windows 10)
|
||||
description: This section describes the ModemConfiguration settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# ModemConfiguration (Windows Configuration Designer reference)
|
||||
|
||||
ModemConfiguration settings are removed in Windows 10, version 1709.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
@ -1,25 +0,0 @@
|
||||
---
|
||||
title: Multivariant (Windows 10)
|
||||
description: This section describes the Multivariant settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Multivariant (Windows Configuration Designer reference)
|
||||
|
||||
Use to select a default profile for mobile devices that have multivariant configurations.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| DefaultProfile | | X | | | |
|
||||
|
||||
If you will be adding [multivariant settings](../provisioning-packages/provisioning-multivariant.md) to your provisioning package, you can use the **DefaultProfile** setting to specify which variant should be applied by default if OOBE is skipped. In the **DefaultProfile** field, enter the UINAME from your customizations.xml that you want to use as default.
|
||||
@ -20,7 +20,7 @@ Use for settings related to NetworkProxy.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | X | | |
|
||||
| All settings | | | ✔️ | | |
|
||||
|
||||
|
||||
## AutoDetect
|
||||
|
||||
@ -20,7 +20,7 @@ Use to create network Quality of Service (QoS) policies. A QoS policy performs a
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | X | | |
|
||||
| All settings | | | ✔️ | | |
|
||||
|
||||
1. In **Available customizations**, select **NetworkQ0SPolicy**, enter a friendly name for the account, and then click **Add**.
|
||||
2. In **Available customizations**, select the name that you just created. The following table describes the settings you can configure.
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
---
|
||||
title: NFC (Windows 10)
|
||||
description: This section describes the NFC settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# NFC (Windows Configuration Designer reference)
|
||||
|
||||
Use to configure settings related to near field communications (NFC) subsystem.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
Expand **NFC** > **SEMgr** > **UI**. The following table describes the settings you can configure.
|
||||
|
||||
| Setting | Description |
|
||||
| --- | --- |
|
||||
| CardEmulationState | Configure the default state of **Tap to pay**. Select between **OFF**, **When Phone Unlocked**, **When Screen On**, and **Anytime**. |
|
||||
| DefaultFastCardSetting | Configure the default fast card usage for NFC payments. Select between **When Phone Unlocked**, **When Screen On**, and **Anytime**. |
|
||||
| HideFastCardsOption | Show or hide the fast cards options drop-down menu in the **NFC** > **Tap to pay** control panel. |
|
||||
@ -20,10 +20,10 @@ Use to configure settings for the [Out Of Box Experience (OOBE)](/windows-hardwa
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Desktop > EnableCortanaVoice](#enablecortanavoice) | X | | | | |
|
||||
| [Desktop > HideOobe](#hided) | X | | | | |
|
||||
| [Mobile > EnforceEnterpriseProvisioning](#nforce) | | X | | | |
|
||||
| [Mobile > HideOobe](#hidem) | | X | | | |
|
||||
| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | | |
|
||||
| [Desktop > HideOobe](#hided) | ✔️ | | | | |
|
||||
| [Mobile > EnforceEnterpriseProvisioning](#nforce) | | ✔️ | | | |
|
||||
| [Mobile > HideOobe](#hidem) | | ✔️ | | | |
|
||||
|
||||
|
||||
|
||||
@ -50,8 +50,3 @@ When set to **True**, it forces the OOBE flow into using the enterprise provisio
|
||||
When set to **False**, it does not force the OOBE flow to the enterprise provisioning page.
|
||||
|
||||
<span id="hidem" />
|
||||
## HideOobe for mobile
|
||||
|
||||
When set to **True**, it hides the interactive OOBE flow for Windows 10 Mobile.
|
||||
|
||||
When set to **False**, the OOBE screens are displayed.
|
||||
@ -1,30 +0,0 @@
|
||||
---
|
||||
title: OtherAssets (Windows 10)
|
||||
description: This section describes the OtherAssets settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/06/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# OtherAssets (Windows Configuration Designer reference)
|
||||
|
||||
Use to configure settings for Map data.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| MapData | | X | | | |
|
||||
|
||||
Use **MapData** to specify the source directory location of the map region you want to include.
|
||||
|
||||
For example, if C:\Path\Maps\Europe contains the downloaded map data that you want to preload, set the value to that directory.
|
||||
|
||||
To add additional maps, add a new MapData setting and set the source to the directory location of the map region you want to include.
|
||||
@ -20,10 +20,10 @@ Use to configure settings to personalize a PC.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DeployDesktopImage](#deploydesktopimage) | X | | | | |
|
||||
| [DeployLockScreenImage](#deploylockscreenimage) | X | | | | |
|
||||
| [DesktopImageUrl](#desktopimageurl) | X | | | | |
|
||||
| [LockScreenImageUrl](#lockscreenimageurl) | X | | | | |
|
||||
| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | | |
|
||||
| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | | |
|
||||
| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | | |
|
||||
| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | | |
|
||||
|
||||
## DeployDesktopImage
|
||||
|
||||
|
||||
@ -20,24 +20,24 @@ This section describes the **Policies** settings that you can configure in [prov
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | X | | | |
|
||||
| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | X | X | | | |
|
||||
| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | ✔️ | | | |
|
||||
| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | ✔️ | | | |
|
||||
|
||||
## Accounts
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | X | X | | | |
|
||||
| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | X | X | | X | |
|
||||
| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | X | X | | | |
|
||||
| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | X | X | | | |
|
||||
| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | ✔️ | | | |
|
||||
| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | ✔️ | | | |
|
||||
| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | ✔️ | | | |
|
||||
|
||||
|
||||
## ApplicationDefaults
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | X | | | | |
|
||||
| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | | |
|
||||
|
||||
|
||||
## ApplicationManagement
|
||||
@ -45,16 +45,16 @@ This section describes the **Policies** settings that you can configure in [prov
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | X | X | | | X |
|
||||
| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | X | X | | | X |
|
||||
| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | X | X | X | X | X |
|
||||
| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | X | | | | |
|
||||
| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | X | X | | | |
|
||||
| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | X | | | |
|
||||
| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | x | | | |
|
||||
| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | X | | | | |
|
||||
| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | X | X | | | X |
|
||||
| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | X | X | | | X |
|
||||
| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | ✔️ | | | ✔️ |
|
||||
| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | ✔️ | | | ✔️ |
|
||||
| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | | |
|
||||
| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | ✔️ | | | |
|
||||
| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | ✔️ | | | |
|
||||
| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | ✔️ | | | |
|
||||
| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | | |
|
||||
| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
|
||||
| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
|
||||
|
||||
|
||||
|
||||
@ -63,218 +63,218 @@ This section describes the **Policies** settings that you can configure in [prov
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | X | X | X | X | X |
|
||||
| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | X | X | X | | X |
|
||||
| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | X | X | X | | X |
|
||||
| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | X | X | X | | X |
|
||||
| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
|
||||
## BitLocker
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | X | X | | | |
|
||||
| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | ✔️ | | | |
|
||||
|
||||
|
||||
## Bluetooth
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | X | X | X | X | X |
|
||||
| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | X | X | X | X | X |
|
||||
| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | X | X | X | X | X |
|
||||
| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | X | X | X | X | X |
|
||||
| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | X | X | X | X | X |
|
||||
| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | X | X | X | X | X |
|
||||
| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
## Browser
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | X | | | | |
|
||||
| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | X | X | X | | X |
|
||||
| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | X | X | | | |
|
||||
[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | X | X | | | |
|
||||
| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | X | X | X | | X |
|
||||
| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | X | | | | |
|
||||
| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | X | X | X | | X |
|
||||
| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | X | | | | |
|
||||
| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | X | | | | |
|
||||
| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | X | | | | |
|
||||
| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | X | X | X | | X |
|
||||
| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | X | X | X | | X |
|
||||
| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | X | X | X | | X |
|
||||
| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | X | X | X | | X |
|
||||
| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | X | | | X | |
|
||||
| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | X | | | | |
|
||||
| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | X | X | X | | X |
|
||||
| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | X | | | | |
|
||||
| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | X | X | X | | X |
|
||||
| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | X | X | X | | X |
|
||||
| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | X | | | | |
|
||||
| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | X | X | X | X | X |
|
||||
| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | X | | | | |
|
||||
| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | X | X | X | | X |
|
||||
[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | X | X | | | |
|
||||
| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | X | | | | |
|
||||
| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | X | X | X | | X |
|
||||
| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | X | | | | |
|
||||
| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | X | | | | |
|
||||
| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | X | | | | |
|
||||
| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | X | | | | |
|
||||
| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | X | | | | |
|
||||
| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | X | | | | |
|
||||
| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | X | | | | |
|
||||
[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | X | X | | | |
|
||||
| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | X | | | | |
|
||||
| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | X | | | | |
|
||||
| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | X | X | | | |
|
||||
| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | X | | | | |
|
||||
[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | X | X | | | |
|
||||
| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | X | X | X | | X |
|
||||
| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | X | X | X | | X |
|
||||
| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | X | | | | |
|
||||
| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | X | X | X | | X |
|
||||
| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | X | X | X | | X |
|
||||
| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | X | X | X | | X |
|
||||
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | X | | | | |
|
||||
| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | X | | | | |
|
||||
| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | X | X | X | | X |
|
||||
[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | X | X | | | |
|
||||
| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | X | | | | |
|
||||
| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | X | X | X | | X |
|
||||
| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | X | | | | |
|
||||
| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | X | | | | |
|
||||
| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | X | | | | |
|
||||
| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | X | | | | |
|
||||
| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | X | | | | |
|
||||
[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | X | X | | | |
|
||||
| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | | |
|
||||
| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | ✔️ | | | |
|
||||
[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | ✔️ | | | |
|
||||
| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | | |
|
||||
| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | | |
|
||||
| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | | |
|
||||
| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | | |
|
||||
| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | | ✔️ | |
|
||||
| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | | |
|
||||
| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | | |
|
||||
| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | | |
|
||||
| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | | |
|
||||
| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | ✔️ | | | |
|
||||
| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | | |
|
||||
| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | | |
|
||||
| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | | |
|
||||
| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | | |
|
||||
| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | | |
|
||||
| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | | |
|
||||
| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | | |
|
||||
| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | | |
|
||||
[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | | |
|
||||
| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | | |
|
||||
| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | | |
|
||||
| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | ✔️ | | | |
|
||||
| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | | |
|
||||
[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | ✔️ | | | |
|
||||
| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | | |
|
||||
| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | | |
|
||||
| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | | |
|
||||
| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | ✔️ | | | |
|
||||
| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | | |
|
||||
| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | | |
|
||||
| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | | |
|
||||
| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | | |
|
||||
| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | | |
|
||||
| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | | |
|
||||
[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | ✔️ | | | |
|
||||
|
||||
|
||||
## Camera
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | X | X | X | | |
|
||||
| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
## Connectivity
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | X | X | X | X | X |
|
||||
| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | X | X | X | | X |
|
||||
| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | X | X | X | | X |
|
||||
| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | X | X | X | | X |
|
||||
| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | X | | | X |
|
||||
| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | X | | | X |
|
||||
| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlyinng connections VPN is allowed to use. |X | X | X | | X |
|
||||
| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | X | X | X | | X |
|
||||
| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | X | X | X | | X |
|
||||
| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | X | X | X | | X |
|
||||
| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | ✔️ | | | ✔️ |
|
||||
| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | ✔️ | | | ✔️ |
|
||||
| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlyinng connections VPN is allowed to use. |✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## CredentialProviders
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | X | | | | |
|
||||
[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | | |
|
||||
|
||||
## Cryptography
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | X | X | | | |
|
||||
| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | X | X | | | |
|
||||
| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | ✔️ | | | |
|
||||
| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | ✔️ | | | |
|
||||
|
||||
## Defender
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | X | | | | |
|
||||
| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | X | | | | |
|
||||
| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | X | | | | |
|
||||
| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | X | | | | |
|
||||
| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | X | | | | |
|
||||
| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | X | | | | |
|
||||
| [AllowIntrusionPreventionSystem](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowintrusionpreventionsystem) | Allow or disallow Windows Defender Intrusion Prevention functionality. | X | | | | |
|
||||
| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | X | | | | |
|
||||
| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | X | | | | |
|
||||
| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | X | | | | |
|
||||
| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | X | | | | |
|
||||
| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | X | | | | |
|
||||
| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | X | | | | |
|
||||
| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defeder scan (in percent). | X | | | | |
|
||||
| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | X | | | | |
|
||||
| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore durinng a scan. Separate each file type in the list by using \|. | X | | | | |
|
||||
| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | X | | | | |
|
||||
| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore durinng a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | X | | | | |
|
||||
| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | X | | | | |
|
||||
| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | X | | | | |
|
||||
| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | X | | | | |
|
||||
| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | X | | | | |
|
||||
| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | X | | | | |
|
||||
| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | X | | | | |
|
||||
| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | X | | | | |
|
||||
| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | X | | | | |
|
||||
| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | | |
|
||||
| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | | |
|
||||
| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | | |
|
||||
| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | | |
|
||||
| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | | |
|
||||
| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | | |
|
||||
| [AllowIntrusionPreventionSystem](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowintrusionpreventionsystem) | Allow or disallow Windows Defender Intrusion Prevention functionality. | ✔️ | | | | |
|
||||
| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | | |
|
||||
| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | | |
|
||||
| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | | |
|
||||
| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | | |
|
||||
| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | | |
|
||||
| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | | |
|
||||
| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defeder scan (in percent). | ✔️ | | | | |
|
||||
| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | | |
|
||||
| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore durinng a scan. Separate each file type in the list by using \|. | ✔️ | | | | |
|
||||
| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | | |
|
||||
| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore durinng a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | | |
|
||||
| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | | |
|
||||
| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | | |
|
||||
| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | | |
|
||||
| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | | |
|
||||
| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | | |
|
||||
| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | | |
|
||||
| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | | |
|
||||
| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | | |
|
||||
|
||||
## DeliveryOptimization
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | X | | | | |
|
||||
| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | X | | | | |
|
||||
| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | X | | | | |
|
||||
| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | X | | | | |
|
||||
| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | X | | | | |
|
||||
| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | X | | | | |
|
||||
| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | X | | | | |
|
||||
| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | X | | | | |
|
||||
| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | X | | | | |
|
||||
| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | X | | | | |
|
||||
| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity usinng Delivery Optimization. | X | | | | |
|
||||
| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | X | | | | |
|
||||
| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | X | | | | |
|
||||
| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capabity in GB) for the device to use Peer Caching. | X | | | | |
|
||||
| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | X | | | | |
|
||||
| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB requried to use Peer Caching. | X | | | | |
|
||||
| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | X | | | | |
|
||||
| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | X | | | | |
|
||||
| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | X | | | | |
|
||||
| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | X | | | | |
|
||||
| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | X | | | | |
|
||||
| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | X | | | | |
|
||||
| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | X | | | | |
|
||||
| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | X | | | | |
|
||||
| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | | |
|
||||
| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | | |
|
||||
| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | | |
|
||||
| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | | |
|
||||
| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | | |
|
||||
| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | | |
|
||||
| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | | |
|
||||
| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | | |
|
||||
| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | | |
|
||||
| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | | |
|
||||
| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity usinng Delivery Optimization. | ✔️ | | | | |
|
||||
| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | | |
|
||||
| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | | |
|
||||
| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capabity in GB) for the device to use Peer Caching. | ✔️ | | | | |
|
||||
| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | | |
|
||||
| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB requried to use Peer Caching. | ✔️ | | | | |
|
||||
| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | | |
|
||||
| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | | |
|
||||
| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | | |
|
||||
| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
|
||||
## DeviceGuard
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | X | | | | |
|
||||
[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | | |
|
||||
|
||||
## DeviceLock
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | X | | | |
|
||||
| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | X | | | |
|
||||
| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | X | X | | X | |
|
||||
|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | X | X | | X | |
|
||||
| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | X | X | | X | |
|
||||
| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | X | X | | X | |
|
||||
| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | X | X | | X | |
|
||||
| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | X | X | | X | |
|
||||
| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | X | X | | X | |
|
||||
| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | X | X | | X | |
|
||||
| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | X | X | | X | |
|
||||
| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | X | | | |
|
||||
| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | ✔️ | | | |
|
||||
| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | ✔️ | | | |
|
||||
| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | ✔️ | | ✔️ | |
|
||||
|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | ✔️ | | | |
|
||||
|
||||
|
||||
## DeviceManagement
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | X | | | | |
|
||||
| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | | |
|
||||
|
||||
|
||||
|
||||
@ -282,37 +282,37 @@ PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Star
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | X | | | |
|
||||
| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | X | X | | X | |
|
||||
| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | X | X | | | |
|
||||
| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | X | X | | | |
|
||||
| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | X | X | | X | |
|
||||
| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | X | | | |
|
||||
| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | X | | | |
|
||||
| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | X | X | | | |
|
||||
| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | X | | | | |
|
||||
| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | X | | | |
|
||||
| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | X | | | | |
|
||||
| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | X | | | |
|
||||
| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggetions, membership notifications, post-OOBE app install, and redirect tiles. | X | | | | |
|
||||
| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | X | | | | |
|
||||
| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | X | | | | |
|
||||
| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | X | | | | |
|
||||
| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | X | | | | |
|
||||
| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | X | | | | |
|
||||
| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | ✔️ | | | |
|
||||
| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | ✔️ | | | |
|
||||
| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | ✔️ | | | |
|
||||
| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | ✔️ | | | |
|
||||
| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | ✔️ | | | |
|
||||
| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | ✔️ | | | |
|
||||
| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | | |
|
||||
| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | ✔️ | | | |
|
||||
| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | | |
|
||||
| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | ✔️ | | | |
|
||||
| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggetions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | | |
|
||||
| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | | |
|
||||
| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | | |
|
||||
| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | | |
|
||||
| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | | |
|
||||
| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | | |
|
||||
|
||||
## ExploitGuard
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | X | X | | | |
|
||||
| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | ✔️ | | | |
|
||||
|
||||
|
||||
## Games
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | X | | | | |
|
||||
| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | | |
|
||||
|
||||
|
||||
## KioskBrowser
|
||||
@ -321,13 +321,13 @@ These settings apply to the **Kiosk Browser** app available in Microsoft Store.
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | X | | | | |
|
||||
[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | X | | | | |
|
||||
[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | X | | | | |
|
||||
[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | X | | | | |
|
||||
[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | X | | | | |
|
||||
[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | X | | | | |
|
||||
[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | X | | | | |
|
||||
[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | | |
|
||||
[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | | |
|
||||
[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | | |
|
||||
[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | | |
|
||||
[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | | |
|
||||
[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | | |
|
||||
[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | | |
|
||||
|
||||
To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer:
|
||||
|
||||
@ -342,9 +342,9 @@ To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | X | | | | |
|
||||
| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | X | | | | |
|
||||
| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | X | | | | |
|
||||
| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | | |
|
||||
| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | | |
|
||||
| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | | |
|
||||
|
||||
## Location
|
||||
|
||||
@ -356,54 +356,54 @@ To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | X | | | | |
|
||||
| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | X | | | | |
|
||||
| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | X | | | | |
|
||||
| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | X | | | | |
|
||||
| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | X | | | | |
|
||||
| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | X | | | | |
|
||||
| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | X | | | | |
|
||||
| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | X | | | | |
|
||||
| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | X | | | | |
|
||||
| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | X | | | | |
|
||||
| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | X | | | | |
|
||||
| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | X | | | | |
|
||||
| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | X | | | | |
|
||||
| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | X | | | | |
|
||||
| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | X | | | | |
|
||||
| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | X | | | | |
|
||||
| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | X | | | | |
|
||||
| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | X | | | | |
|
||||
| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | X | | | | |
|
||||
| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | X | | | | |
|
||||
| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | X | | | | |
|
||||
| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | X | | | | |
|
||||
| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | | |
|
||||
| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | | |
|
||||
| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | | |
|
||||
| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | | |
|
||||
| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | | |
|
||||
| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | | |
|
||||
| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | | |
|
||||
| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | | |
|
||||
| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | | |
|
||||
| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | | |
|
||||
| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | | |
|
||||
| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | | |
|
||||
| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | | |
|
||||
| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | | |
|
||||
| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | | |
|
||||
| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | | |
|
||||
| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | | |
|
||||
| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | | |
|
||||
| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | | |
|
||||
| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | | |
|
||||
| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | | |
|
||||
| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | | |
|
||||
|
||||
## Privacy
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | X | | | |
|
||||
| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | X | X | | X | |
|
||||
| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | ✔️ | | | |
|
||||
| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | ✔️ | | ✔️ | |
|
||||
|
||||
|
||||
## Search
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | X | X | | | |
|
||||
[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | X | | | | |
|
||||
| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | X | X | | | |
|
||||
| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | X | X | | X | |
|
||||
| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | X | X | | | |
|
||||
| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.</br></br>- **Off** setting disables Windows indexer</br>- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)</br>- **Enterprise** setting reduces potential network loads for enterprises</br>- **Standard** setting is appropriate for consuemrs | X | X | | | |
|
||||
| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | X | X | | | |
|
||||
| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | X | X | | | |
|
||||
| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | X | X | | | |
|
||||
| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | X | X | | | |
|
||||
| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | X | X | | | |
|
||||
| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | X | X | | | |
|
||||
| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | X | | | |
|
||||
[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | ✔️ | | | |
|
||||
[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | | |
|
||||
| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | ✔️ | | | |
|
||||
| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | ✔️ | | | |
|
||||
| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.</br></br>- **Off** setting disables Windows indexer</br>- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)</br>- **Enterprise** setting reduces potential network loads for enterprises</br>- **Standard** setting is appropriate for consuemrs | ✔️ | ✔️ | | | |
|
||||
| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | ✔️ | | | |
|
||||
| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | ✔️ | | | |
|
||||
| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | ✔️ | | | |
|
||||
| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | ✔️ | | | |
|
||||
| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | ✔️ | | | |
|
||||
| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | ✔️ | | | |
|
||||
| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | ✔️ | | | |
|
||||
|
||||
|
||||
|
||||
@ -411,181 +411,181 @@ To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | X | X | X | | X |
|
||||
| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | X | | | |
|
||||
| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | X | X | X | | X |
|
||||
| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | X | | | |
|
||||
| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | X | X | X | X | X |
|
||||
| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | X | X | X | | X |
|
||||
| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | X | X | | | |
|
||||
| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | ✔️ | | | |
|
||||
| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | ✔️ | | | |
|
||||
| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | ✔️ | | | |
|
||||
|
||||
## Settings
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | X | | | |
|
||||
| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | X | | | |
|
||||
| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | X | | X | |
|
||||
| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | X | | | | |
|
||||
[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | X | | | | |
|
||||
| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | ✔️ | | | |
|
||||
| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | ✔️ | | | |
|
||||
| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | ✔️ | | ✔️ | |
|
||||
| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | | |
|
||||
[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | | |
|
||||
|
||||
## Start
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloadds shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | X | | | | |
|
||||
| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | X | | | | |
|
||||
DisableContextMenus | Prevent context menus from being invoked in the Start menu. | X | | | | |
|
||||
| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | X | | | | |
|
||||
| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | X | | | | |
|
||||
| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | X | | | | |
|
||||
| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | X | | | | |
|
||||
| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | X | | | | |
|
||||
| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | X | | | | |
|
||||
| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | X | | | | |
|
||||
| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | X | | | | |
|
||||
| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | X | | | | |
|
||||
| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | X | | | | |
|
||||
| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | X | | | | |
|
||||
| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | X | | | | |
|
||||
| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | X | | | | |
|
||||
| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | X | | | | |
|
||||
| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | X | | | | |
|
||||
| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | X | | | | |
|
||||
| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | X | | | | |
|
||||
| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | X | | | | |
|
||||
| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | X | | | | |
|
||||
| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloadds shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | | |
|
||||
DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | | |
|
||||
| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | | |
|
||||
| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | | |
|
||||
| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | | |
|
||||
| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | | |
|
||||
| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | | |
|
||||
| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | | |
|
||||
| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | | |
|
||||
| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | | |
|
||||
| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | | |
|
||||
| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | | |
|
||||
| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | | |
|
||||
| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | | |
|
||||
| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | | |
|
||||
| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | | |
|
||||
| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | | |
|
||||
|
||||
## System
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | X | X | | | |
|
||||
| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | X | X | X | | X |
|
||||
| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | X | X | | | |
|
||||
| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | X | X | X | X | X |
|
||||
| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | X | X | X | | X |
|
||||
| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | X | X | | X | |
|
||||
| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | X | X | | | |
|
||||
ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | X | X | | | |
|
||||
ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | X | X | | | |
|
||||
| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | X | X | | | |
|
||||
| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | X | X | | | |
|
||||
| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | X | | | | |
|
||||
| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | X | X | | | |
|
||||
| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | ✔️ | | | |
|
||||
| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | ✔️ | | | |
|
||||
| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | ✔️ | | | |
|
||||
ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | ✔️ | | | |
|
||||
ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | ✔️ | | | |
|
||||
| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
|
||||
| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
|
||||
| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | | |
|
||||
| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | ✔️ | | | |
|
||||
|
||||
|
||||
## TextInput
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | X | | | | |
|
||||
| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | X | | | | |
|
||||
| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | X | | | | |
|
||||
| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | X | | | | |
|
||||
| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | X | | | | |
|
||||
| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | X | | | | |
|
||||
| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | X | | | | |
|
||||
| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | X | | | | |
|
||||
| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | X | | | | |
|
||||
| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | | |
|
||||
| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | | |
|
||||
| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | | |
|
||||
| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | | |
|
||||
| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | | |
|
||||
| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | | |
|
||||
| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | | |
|
||||
| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | | |
|
||||
| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | | |
|
||||
| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | X | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | X | | | | |
|
||||
| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | X | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
||||
| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
||||
|
||||
|
||||
## TimeLanguageSettings
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | X | | | |
|
||||
| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | ✔️ | | | |
|
||||
|
||||
|
||||
## Update
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------:|:---------------:|:-----------:|:--------:|:--------:|
|
||||
| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update rboots are not scheduled. | X | X | X | | X |
|
||||
| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | X | X | X | | X |
|
||||
| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | X | X | X | | X |
|
||||
| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | X | X | X | X | X |
|
||||
| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | X | X | X | | X |
|
||||
| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | X | X | X | X | X |
|
||||
| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | X | X | X | | X |
|
||||
| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | X | X | X | X | X |
|
||||
| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | X | X | X | | X |
|
||||
| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | X | X | X | | X |
|
||||
| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | X | X | X | | X |
|
||||
| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | X | X | X | | X |
|
||||
| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | X | X | X | X | X |
|
||||
| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | X | X | X | | X |
|
||||
| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | X | X | X | | X |
|
||||
| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | X | X | X | X | X |
|
||||
| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | X | X | X | X | X |
|
||||
| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | X | X | X | X | X |
|
||||
| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | X | X | X | | X |
|
||||
| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | X | X | X | | X |
|
||||
| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | X | X | X | | X |
|
||||
| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | X | X | X | | X |
|
||||
| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | X | X | X | | X |
|
||||
| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | X | X | X | | X |
|
||||
| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | X | X | X | | X |
|
||||
| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windws Update (WU) drivers during quality updates. | X | | X | | X |
|
||||
| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | X | X | X | | X |
|
||||
| ManagePreviewBuilds | Use to enable or disable preview builds. | X | X | X | X | X |
|
||||
| PhoneUpdateRestrictions | Deprecated | | X | | | |
|
||||
| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | X | X | X | X | X |
|
||||
| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | X | X | X | X | X |
|
||||
| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | X | X | X | X | X |
|
||||
| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | X | X | X | X | X |
|
||||
| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | X | X | X | X | X |
|
||||
| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | X | X | X | X | X |
|
||||
| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | X | X | X | X | X |
|
||||
| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | X | X | X | X | X |
|
||||
| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | X | X | X | | X |
|
||||
| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | X | X | X | | X |
|
||||
| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | X | X | X | | X |
|
||||
| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | X | X | X | | X |
|
||||
| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | X | X | X | | X |
|
||||
| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | X | X | X | | X |
|
||||
| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | X | X | X | | X |
|
||||
| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | X | X | X | X | X |
|
||||
| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | X | X | X | X | X |
|
||||
| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update rboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windws Update (WU) drivers during quality updates. | ✔️ | | ✔️ | | ✔️ |
|
||||
| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| PhoneUpdateRestrictions | Deprecated | | ✔️ | | | |
|
||||
| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
## WiFi
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | X | X | | | |
|
||||
| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | X | X | | | |
|
||||
| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | X | | | |
|
||||
| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | X | | | |
|
||||
| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | X | X | X | | X |
|
||||
| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | ✔️ | | | |
|
||||
| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | ✔️ | | | |
|
||||
| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | ✔️ | | | |
|
||||
| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | ✔️ | | | |
|
||||
| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## WindowsInkWorkspace
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | X | | | | |
|
||||
| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | X | | | | |
|
||||
| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | | |
|
||||
| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | | |
|
||||
|
||||
|
||||
## WindowsLogon
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | X | | | | |
|
||||
| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | | |
|
||||
|
||||
## WirelessDisplay
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | X | X | | | |
|
||||
| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | ✔️ | | | |
|
||||
@ -19,7 +19,7 @@ Use **Privacy** to configure settings for app activation with voice.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | X | X | | X |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## LetAppsActivateWithVoice
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ Use ProvisioningCommands settings to install Windows desktop applications using
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
For instructions on adding apps to provisioning packages, see [Provision PCs with apps](../provisioning-packages/provision-pcs-with-apps.md).
|
||||
|
||||
|
||||
@ -1,32 +0,0 @@
|
||||
---
|
||||
title: RcsPresence (Windows 10)
|
||||
description: This section describes the RcsPresence settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 04/30/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# RcsPresence (Windows Configuration Designer reference)
|
||||
|
||||
Use these settings to configure RcsPresence.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
BypassvideoCapabilities | Do not use.
|
||||
MaxWaitForCapabilitiesRequestInSeconds | Maximum number of seconds to wait for a Capabilities Request to complete.
|
||||
MinAvailabilityCacheInSeconds | Number of seconds to cache result of Capabilities Request per each number, to avoid excessive network requests.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ Use SharedPC settings to optimize Windows 10 for shared use scenarios, such as t
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
## AccountManagement
|
||||
|
||||
@ -30,19 +30,19 @@ Use these settings to configure settings for accounts allowed on the shared PC.
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| AccountModel | - Only guest</br>- Domain-joined only</br>- Domain-joined and guest | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in. Specifying the guest option will add the Guest option to the sign-in screen and enable anonymous guest access to the PC. </br></br>- Only guest allows anyone to use the PC as a local standard (non-admin) account.</br>- Domain-joined only allows users to sign in with an Active Directory or Azure AD account.</br>- Domain-joined and guest allows users to sign in with an Active Directory, Azure AD, or local standard account. |
|
||||
| DeletionPolicy | - Delete immediately </br>- Delete at disk space threshold</br>- Delete at disk space threshold and inactive threshold | - Delete immediately will delete the account on sign-out.</br>- Delete at disk space threshold will start deleting accounts when available disk space falls below the threshold you set for DiskLevelDeletion, and it will stop deleting accounts when the available disk space reaches the threshold you set for DiskLevelCaching. Accounts are deleted in order of oldest accessed to most recently accessed.</br>- Delete at disk space threshold and inactive threshold will apply the same disk space checks as noted above, but also delete accounts if they have not signed in within the number of days specified by InactiveThreshold |
|
||||
| AccountModel | - Only guest</br>- Domain-joined only</br>- Domain-joined and guest | This option controls how users can sign in on the PC. Choosing domain-joined will enable any user in the domain to sign in. Specifying the guest option will add the Guest option to the sign in screen and enable anonymous guest access to the PC. </br></br>- Only guest allows anyone to use the PC as a local standard (non-admin) account.</br>- Domain-joined only allows users to sign in with an Active Directory or Azure AD account.</br>- Domain-joined and guest allows users to sign in with an Active Directory, Azure AD, or local standard account. |
|
||||
| DeletionPolicy | - Delete immediately </br>- Delete at disk space threshold</br>- Delete at disk space threshold and inactive threshold | - **Delete immediately** deletes the account on sign out.</br>- **Delete at disk space threshold** starts deleting accounts when available disk space falls below the threshold you set for `DiskLevelDeletion`. It stops deleting accounts when the available disk space reaches the threshold you set for `DiskLevelCaching`. Accounts are deleted in order of oldest accessed to most recently accessed.</br>- **Delete at disk space threshold and inactive threshold** applies the same disk space checks as noted above. It also deletes accounts if they haven't signed in within the number of days in `InactiveThreshold`. |
|
||||
| DiskLevelCaching | A number between 0 and 100 | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account caching. |
|
||||
| DiskLevelDeletion | A number between 0 and 100 | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account deletion. |
|
||||
| EnableAccountManager | True or false | Set as **True** to enable automatic account management. If this is not set to true, no automatic account management will be done. |
|
||||
| InactiveThreshold | Number | If you set **DeletionPolicy** to **Delete at disk space threshold and inactive threshold**, set the number of days after which an account that has not signed in will be deleted. |
|
||||
| KioskModeAUMID | String | Set an Application User Model ID (AUMID) to enable the kiosk account on the sign-in screen. A new account will be created and will use assigned access to only run the app specified by the AUMID. Note that the app must be installed on the PC. Set the name of the account using **KioskModeUserTileDisplayText**, or a default name will be used. [Find the Application User Model ID of an installed app](/previous-versions/windows/embedded/dn449300(v=winembedded.82)) |
|
||||
| EnableAccountManager | True or false | Set as **True** to enable automatic account management. When set to **False**, no automatic account management will be done. |
|
||||
| InactiveThreshold | Number | If you set **DeletionPolicy** to **Delete at disk space threshold and inactive threshold**, set the number of days after which an account that hasn't signed in will be deleted. |
|
||||
| KioskModeAUMID | String | Set an Application User Model ID (AUMID) to enable the kiosk account on the sign in screen. A new account will be created and will use assigned access to only run the app specified by the AUMID. The app must be installed on the PC. Set the name of the account using **KioskModeUserTileDisplayText**, or a default name will be used. [Find the Application User Model ID of an installed app](/previous-versions/windows/embedded/dn449300(v=winembedded.82)) |
|
||||
| KioskModeUserTileDisplayText | String | Sets the display text on the kiosk account if **KioskModeAUMID** has been set. |
|
||||
|
||||
|
||||
## EnableSharedPCMode
|
||||
|
||||
Set as **True**. If this is not set to **True**, shared PC mode is not turned on and none of the other settings apply. This setting controls this API: [IsEnabled](/uwp/api/windows.system.profile.sharedmodesettings).
|
||||
Set as **True**. When set to **False**, shared PC mode isn't turned on and none of the other settings apply. This setting controls this API: [IsEnabled](/uwp/api/windows.system.profile.sharedmodesettings).
|
||||
|
||||
Some of the remaining settings in SharedPC are optional, but we strongly recommend that you also set **EnableAccountManager** to **True**.
|
||||
|
||||
@ -53,13 +53,13 @@ Use these settings to configure policies for shared PC mode.
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| MaintenanceStartTime | A number between 0 and 1440 | By default, the maintenance start time (which is when automatic maintenance tasks run, such as Windows Update) is midnight. You can adjust the start time in this setting by entering a new start time in minutes from midnight. For example, if you want maintenance to begin at 2 AM, enter `120` as the value. |
|
||||
| MaxPageFileSizeMB | A number between 1024 and 2048 | Adjusts the maximum page file size in MB. This can be used to fine-tune page file behavior, especially on low end PCs. |
|
||||
| MaxPageFileSizeMB | A number between 1024 and 2048 | Adjusts the maximum page file size in MB. This setting can be used to fine-tune page file behavior, especially on low end PCs. |
|
||||
| RestrictLocalStorage | True or false | Set as **True** to restrict the user from saving or viewing local storage when using File Explorer. This setting controls this API: [ShouldAvoidLocalStorage](/uwp/api/windows.system.profile.sharedmodesettings) |
|
||||
| SetEduPolicies | True or false | Set to **True** for PCs that will be used in a school. For more information, see [Windows 10 configuration recommendations for education customers](/education/windows/configure-windows-for-education). This setting controls this API: [IsEducationEnvironment](/uwp/api/windows.system.profile.educationsettings) |
|
||||
| SetPowerPolicies | True or false | When set as **True**:</br></br>- Prevents users from changing power settings</br>- Turns off hibernate</br>- Overrides all power state transitions to sleep (e.g. lid close) |
|
||||
| SetPowerPolicies | True or false | When set as **True**:</br></br>- Prevents users from changing power settings</br>- Turns off hibernate</br>- Overrides all power state transitions to sleep, such as a lid close. |
|
||||
| SignInOnResume | True or false | This setting specifies if the user is required to sign in with a password when the PC wakes from sleep. |
|
||||
| SleepTimeout | Number | Specifies all timeouts for when the PC should sleep. Enter the amount of idle time in seconds. If you don't set sleep timeout, the default of 1 hour applies. |
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Set up shared or guest PC](../set-up-shared-or-guest-pc.md)
|
||||
@ -1,26 +0,0 @@
|
||||
---
|
||||
title: Shell (Windows 10)
|
||||
description: This section describes the Shell settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/06/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Shell (Windows Configuration Designer reference)
|
||||
|
||||
Do not use. Use [Start > StartLayout](wcd-start.md#startlayout)
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
|
||||
@ -21,19 +21,19 @@ Use SMISettings settings to customize the device with custom shell, suppress Win
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
## All settings in SMISettings
|
||||
|
||||
The following table describes the settings in SMISettings. Some settings have additional details in sections after the table.
|
||||
The following table describes the settings in SMISettings. Some settings have more details in sections after the table.
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| AutoLogon | Enable</br>Domain name</br>Password</br>UserName | Allows automatic sign-in at startup so that the user does not need to enter a user name and password. |
|
||||
| AutoLogon | Enable</br>Domain name</br>Password</br>UserName | Allows automatic sign-in at startup. Users don't need to enter a user name and password. |
|
||||
| BrandingNeutral | See [BrandingNeutral values](#brandingneutral-values) | Specifies which UI elements display on the Welcome screen. |
|
||||
| CrashDumpEnabled | See [CrashDumpEnabled values](#crashdumpenabled-values) | Specifies the type of information to be saved in the event of a crash. |
|
||||
| CrashDumpEnabled | See [CrashDumpEnabled values](#crashdumpenabled-values) | Specifies the type of information to be saved if there's a crash. |
|
||||
| DisableBootMenu | True or false | Disables the F8 and F10 keys during startup to prevent access to the **Advanced Startup Options** menu. |
|
||||
| DisplayDisabled | True or false | Configures the device to display a blank screen when the OS encounters an error that it cannot recover from. |
|
||||
| DisplayDisabled | True or false | Configures the device to display a blank screen if the OS has an error that it can't recover from. |
|
||||
| HideAllBootUI | True or false | Suppresses all Windows UI elements (logo, status indicator, and status message) during startup. |
|
||||
| HideAutologonUI | True or false | Hides the Welcome screen when automatic sign-in (AutoLogon) is enabled. |
|
||||
| HideBootLogo | True or false | Suppresses the default Windows logo that displays during the OS loading phase. |
|
||||
@ -43,7 +43,7 @@ The following table describes the settings in SMISettings. Some settings have ad
|
||||
| KeyboardFilter | See [KeyboardFilter settings](#keyboardfilter-settings) | Use these settings to configure devices to suppress key presses or key combinations. |
|
||||
| NoLockScreen | True or false | Disables the lock screen functionality and UI elements |
|
||||
| ShellLauncher | See [ShellLauncher settings](#shelllauncher-settings) | Settings used to specify the application or executable to use as the default custom shell. |
|
||||
| UIVerbosityLevel | Suppress or do not suppress | Disables the Windows status messages during device startup, sign-in, and shut down. |
|
||||
| UIVerbosityLevel | Suppress or don't suppress | Disables the Windows status messages during device startup, sign-in, and shut down. |
|
||||
|
||||
## BrandingNeutral values
|
||||
|
||||
@ -58,11 +58,11 @@ The default value is **17**, which disables all Welcome screen UI elements and t
|
||||
| 4 | Disables the Language button |
|
||||
| 8 | Disables the Ease of access button |
|
||||
| 16 | Disables the Switch user button |
|
||||
| 32 | Disables the blocked shutdown resolver (BSDR) screen so that restarting or shutting down the system causes the OS to immediately force close any applications that are blocking system shut down. No UI is displayed and users are not given a chance to cancel the shutdown process. This can result in a loss of data if any open applications have unsaved data. |
|
||||
| 32 | Disables the blocked shutdown resolver (BSDR) screen. Restarting or shutting down the system causes the OS to immediately force close any applications that are blocking the system shutdown. No UI is displayed, and users aren't given a chance to cancel the shutdown process. This value can result in a loss of data if any open applications have unsaved data. |
|
||||
|
||||
## CrashDumpEnabled values
|
||||
|
||||
Contains an integer that specifies the type of information to capture in a dump (.dmp) file that is generated when the system stops unexpectedly.
|
||||
If the system stops unexpectedly, choose the type of information to capture in a dump (.dmp) file.
|
||||
|
||||
The .dmp file is typically saved in %SystemRoot% as Memory.dmp.
|
||||
|
||||
@ -71,22 +71,22 @@ Set CrashDumpEnabled to one of the following values:
|
||||
| Value | Description |
|
||||
| --- | --- |
|
||||
| 1 | Records all the contents of system memory. This dump file may contain data from processes that were running when the information was collected. |
|
||||
| 2 | Records only the kernel memory. This dump file includes only memory that is allocated to the kernel, kernel-mode drivers, and other kernel-mode programs. It does not include unallocated memory or any memory that is allocated to user-mode programs.</br></br>For most purposes, this kind of dump file is the most useful because it is significantly smaller than the complete memory dump file, but it contains information that is most likely to have been involved in the issue.</br></br>If a second problem occurs, the dump file is overwritten with new information. |
|
||||
| 3 | Records the smallest amount of useful information that may help identify why the device stopped unexpectedly. This type of dump file includes the following information:</br></br>- A list of loaded drivers</br></br>- The processor context (PRCB) for the processor that stopped</br></br>- The process information and kernel context (EPROCESS) for the process that stopped</br></br>- The process information and kernel context (ETHREAD) for the thread that stopped</br></br>- The kernel-mode call stack for the thread that stopped</br></br></br>This kind of dump file can be useful when space is limited. However, because of the limited information included, errors that were not directly caused by the thread that was running at the time of the problem may not be discovered by analyzing this file.</br></br>The date is encoded in the file name. If a second problem occurs, the previous file is preserved and the new file is given a distinct name. A list of all small memory dump files is kept in the %SystemRoot%\Minidump folder. |
|
||||
| 2 | Records only the kernel memory. This dump file includes only memory that's allocated to the kernel, kernel-mode drivers, and other kernel-mode programs. It doesn't include unallocated memory, or any memory that's allocated to user-mode programs.</br></br> For most purposes, this kind of dump file is the most useful because it's smaller than the complete memory dump file. It also includes information that's most likely involved in the issue.</br></br> If a second problem occurs, the dump file is overwritten with new information. |
|
||||
| 3 | Records the smallest amount of useful information that may help identify why the device stopped unexpectedly. This type of dump file includes the following information:</br></br>- A list of loaded drivers</br>- The processor context (PRCB) for the processor that stopped</br>- The process information and kernel context (EPROCESS) for the process that stopped</br>- The process information and kernel context (ETHREAD) for the thread that stopped</br>- The kernel-mode call stack for the thread that stopped</br></br>This dump file can be useful when space is limited. Because of the limited information, errors that aren't directly caused by the running thread at the time of the problem may not be discovered by analyzing this file.</br></br> The date is encoded in the file name. If a second problem occurs, the previous file is preserved and the new file is given a distinct name. A list of all small memory dump files is kept in the %SystemRoot%\Minidump folder. |
|
||||
| 4 | Records the smallest amount of useful information. This value produces the same results as entering a value of 3. |
|
||||
| 7 | Records only the kernel memory. This value produces the same results as entering a value of 2. This is the default value. |
|
||||
| Any other value | Disables crash dump and does not record anything. |
|
||||
| Any other value | Disables crash dump and doesn't record anything. |
|
||||
|
||||
## KeyboardFilter settings
|
||||
|
||||
You can use KeyboardFilter to suppress undesirable key presses or key combinations. KeyboardFilter works with physical keyboards, the Windows on-screen keyboard, and the touch keyboard.
|
||||
Use these settings to suppress undesirable key presses or key combinations. KeyboardFilter works with physical keyboards, the Windows on-screen keyboard, and the touch keyboard.
|
||||
|
||||
When you **enable** KeyboardFilter, a number of other settings become available for configuration.
|
||||
When you **enable** KeyboardFilter, many other settings become available for configuration.
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| CustomKeyFilters | Allow or block | Add your own key filters to meet any special requirements that you may have that are not included in the predefined key filters. </br></br>Enter a custom key combination in **CustomKeyFilter**, and then select it to allow or block it. The format to add custom filter combinations is "Alt+F9." This also appears as the CustomKey name, which is specified without "+". For more information, see [WEKF_CustomKey](/windows-hardware/customize/enterprise/wekf-customkey). |
|
||||
| CustomScancodeFilters | Allow or block | Blocks the list of custom scan codes. When a key is pressed on a physical keyboard, the keyboard sends a scan code to the keyboard driver. The driver then sends the scan code to the OS and the OS converts the scan code into a virtual key based on the current active layout.</br></br>Enter a custom scancode in **CustomScancodeFilter**, and then select it to allow or block it. For more information, see [WEKF_Scancode](/windows-hardware/customize/enterprise/wekf-scancode). |
|
||||
| CustomKeyFilters | Allow or block | Add your own key filters to meet any special requirements that aren't included in the predefined key filters. </br></br>Enter a custom key combination in **CustomKeyFilter**, and then select it to allow or block it. The format to add custom filter combinations is "Alt+F9." This also appears as the CustomKey name, which is specified without "+". For more information, see [WEKF_CustomKey](/windows-hardware/customize/enterprise/wekf-customkey). |
|
||||
| CustomScancodeFilters | Allow or block | Blocks the list of custom scan codes. When a key is pressed on a physical keyboard, the keyboard sends a scan code to the keyboard driver. The driver then sends the scan code to the OS and the OS converts the scan code into a virtual key based on the current active layout.</br></br>Enter a custom scan code in **CustomScancodeFilter**, and then select it to allow or block it. For more information, see [WEKF_Scancode](/windows-hardware/customize/enterprise/wekf-scancode). |
|
||||
| DisableKeyboardFilterForAdministrators | True or false | Disables the keyboard filter for administrators. |
|
||||
| ForceOffAccessibility | True or false | Disables all Ease of Access features and prevents users from enabling them. |
|
||||
| PredefinedKeyFilters | Allow or block | Specifies the list of predefined keys. For each key, the value will default to **Allow**. Specifying **Block** will suppress the key combination. |
|
||||
@ -107,7 +107,7 @@ You can also configure ShellLauncher to launch different shell applications for
|
||||
>
|
||||
>You cannot use ShellLauncher to launch a Windows app as a custom shell. However, you can use Windows 10 application launcher to launch a Windows app at startup.
|
||||
|
||||
ShellLauncher processes the Run and RunOnce registry keys before starting the custom shell, so your custom shell doesn't need to handle the automatic startup of other applications or services. ShellLauncher also handles the behavior of the system when your custom shell exits. You can configure the shell exit behavior if the default behavior does not meet your needs.
|
||||
ShellLauncher processes the Run and RunOnce registry keys before starting the custom shell. So, your custom shell doesn't need to handle the automatic startup of other applications or services. ShellLauncher also handles the behavior of the system when your custom shell exits. You can configure the shell exit behavior if the default behavior doesn't meet your needs.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>A custom shell is launched with the same level of user rights as the account that is signed in. This means that a user with administrator rights can perform any system action that requires administrator rights, including launching other applications with administrator rights, while a user without administrator rights cannot. If your shell application requires administrator rights and needs to be elevated, and User Account Control (UAC) is present on your device, you must disable UAC in order for ShellLauncher to launch the shell application.
|
||||
@ -21,10 +21,10 @@ Use Start settings to apply a customized Start screen to devices.
|
||||
|
||||
| Setting | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| StartLayout | X | | | |
|
||||
| StartLayout | ✔️ | | | |
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The StartLayout setting is available in the advanced provisioning for Windows 10 desktop editions, but should only be used to apply a layout to Windows 10 Mobile devices. For desktop editions, use [Policies > StartLayout](wcd-policies.md#start).
|
||||
>The StartLayout setting is available in the advanced provisioning for Windows 10 desktop editions, but shouldn't be used. For desktop editions, use [Policies > StartLayout](wcd-policies.md#start).
|
||||
|
||||
## StartLayout
|
||||
|
||||
|
||||
@ -21,6 +21,6 @@ Use StartupApp settings to configure the default app that will run on start for
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| Default | | | | | X |
|
||||
| Default | | | | | ✔️ |
|
||||
|
||||
Enter the [Application User Model ID (AUMID)](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the default app.
|
||||
@ -21,5 +21,5 @@ Documentation not available at this time.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | | X |
|
||||
| All settings | | | | | ✔️ |
|
||||
|
||||
|
||||
@ -13,7 +13,10 @@ manager: dansimp
|
||||
|
||||
# StorageD3InModernStandby (Windows Configuration Designer reference)
|
||||
|
||||
Use **StorageD3InModernStandby** to enable or disable low power state (D3) during standby. When this setting is configured to **Enable Storage Device D3**, SATA and NVMe devices will be able to enter the D3 state when the system transits to modern standby state, if they are using a Microsoft inbox driver such as StorAHCI, StorNVMe.
|
||||
Use **StorageD3InModernStandby** to enable or disable low-power state (D3) during standby. When set to **Enable Storage Device D3**, SATA and NVMe devices can enter the D3 state when:
|
||||
|
||||
- The system transits to modern standby state.
|
||||
- If they're using a Microsoft inbox driver such as StorAHCI, StorNVMe
|
||||
|
||||
[Learn more about device power states.](/windows-hardware/drivers/kernel/device-power-states)
|
||||
|
||||
@ -21,4 +24,4 @@ Use **StorageD3InModernStandby** to enable or disable low power state (D3) durin
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | X | X | | X |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
@ -26,7 +26,7 @@ Use SurfaceHubManagement settings to set the administrator group that will manag
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | X | | |
|
||||
| All settings | | | ✔️ | | |
|
||||
|
||||
|
||||
## GroupName
|
||||
|
||||
@ -21,7 +21,7 @@ Use TabletMode to configure settings related to tablet mode.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | X | X | | |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
## ConvertibleSlateModePromptPreference
|
||||
|
||||
|
||||
@ -21,11 +21,11 @@ Use TakeATest to configure the Take A Test app, a secure browser for test-taking
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | |
|
||||
| All settings | ✔️ | | | | |
|
||||
|
||||
## AllowScreenMonitoring
|
||||
|
||||
When set to True, students are able to record and take screen captures in the Take A Test app.
|
||||
When set to True, students can record and take screen captures in the Take A Test app.
|
||||
|
||||
## AllowTextSuggestions
|
||||
|
||||
@ -43,9 +43,8 @@ When set to True, students can print in the Take A Test app.
|
||||
|
||||
Enter the account to use when taking a test.
|
||||
|
||||
To specify a domain account, enter **domain\user**. To specify an AAD account, enter <strong>username@tenant.com</strong>. To specify a local account, enter the username.
|
||||
To specify a domain account, enter **domain\user**. To specify an Azure AD account, enter `username@tenant.com`. To specify a local account, enter the username.
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [SecureAssessment configuration service provider (CSP)](/windows/client-management/mdm/secureassessment-csp)
|
||||
@ -1,209 +0,0 @@
|
||||
---
|
||||
title: TextInput (Windows 10)
|
||||
description: This section describes the TextInput settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.date: 09/15/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# TextInput (Windows Configuration Designer reference)
|
||||
|
||||
Use TextInput settings to configure text intelligence and keyboard for mobile devices.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| Intelligence > DisablePredictions | | X | | | |
|
||||
| PreEnabledKeyboard | | X | | | |
|
||||
|
||||
## Intelligence
|
||||
|
||||
Set **DisablePredictions** to the locale or alternative input language that must have the text intelligence features disabled. For example, to disable text correction and suggestions for English (UK), set the value of **DisablePredictions** to `en-gb`.
|
||||
|
||||
## PreEnabledKeyboard
|
||||
|
||||
In addition to the automatically-enabled default keyboard, OEMs may choose to pre-enable more keyboards for a particular market.
|
||||
|
||||
During phone bring-up, OEMs must set the boot locale, or default locale, for the phone. During first boot, Windows Phone reads the locale setting and automatically enables a default keyboard based on the locale to keyboard mapping table in Set languages and locales.
|
||||
|
||||
The mapping works for almost all regions and additional customizations are not needed unless specified in the pre-enabled keyboard column in Set languages and locales. If an OEM chooses to pre-enable more keyboards for a particular market, they can do so by specifying the setting. Pre-enabled keyboards will automatically be enabled during boot. Microsoft recommends that partners limit the number of pre-enabled keyboards to those languages that correspond to the languages spoken within the market.
|
||||
|
||||
|
||||
PreEnabledKeyboard must be entered once for each keyboard you want to pre-enable. As shown below, the format to specify a particular keyboard must be: Locale code.Locale value. See the following table for more information on the locale codes and values that you can use. The setting Value must be set to 1 to enable the keyboard.
|
||||
|
||||
The following table shows the values that you can use for the Locale code.Locale value part of the setting name.
|
||||
|
||||
>[!NOTE]
|
||||
>The keyboards for some locales require additional language model files: am-ET, bn-IN, gu-IN, hi-IN, ja-JP, kn-IN, ko-KR, ml-IN, mr-IN, my-MM, or-IN, pa-IN, si-LK, ta-IN, te-IN, zh-TW, zh-CN, and zh-HK.
|
||||
|
||||
|
||||
Name | Locale code | Keyboard layout value
|
||||
--- | --- | ---
|
||||
Afrikaans (South Africa) | af-ZA | 1
|
||||
Albanian | sq-AL | 1
|
||||
Amharic | am-ET | 1
|
||||
Arabic | ar-SA | 1
|
||||
Armenian | hy-AM | 1
|
||||
Assamese - INSCRIPT | as-IN | 1
|
||||
Azerbaijani (Cyrillic) | az-Cyrl-AZ | 1
|
||||
Azerbaijani (Latin) | az-Latn-AZ | 1
|
||||
Bangla (Bangladesh) - 49 key | bn-BD | 1
|
||||
Bangla (India) - INSCRIPT |bn-IN|1
|
||||
Bangla (India) - Phonetic|bn-IN|2
|
||||
Bashkir|ba-RU|1
|
||||
Basque|eu-ES|1
|
||||
Belarusian|be-BY|1
|
||||
Bosnian (Cyrillic)|bs-Cyrl-BA|1
|
||||
Bosnian (Latin)|bs-Latn-BA|1
|
||||
Bulgarian|bg-BG|1
|
||||
Catalan|ca-ES|1
|
||||
Central Kurdish|ku-Arab-IQ|1
|
||||
Cherokee|chr-Cher-US|1
|
||||
Chinese Simplified QWERTY|zh-CN|1
|
||||
Chinese Simplified - 12-key|zh-CN|2
|
||||
Chinese Simplified - Handwriting|zh-CN|3
|
||||
Chinese Simplified - Stroke|zh-CN|4
|
||||
Chinese Traditional (Hong Kong SAR) - Cangjie|zh-HK|1
|
||||
Chinese Traditional (Hong Kong SAR) - Quick|zh-HK|2
|
||||
Chinese Traditional (Hong Kong SAR) - Stroke|zh-HK|3
|
||||
Chinese Traditional (Taiwan) - BoPoMoFo|zh-TW|1
|
||||
Chinese Traditional (Taiwan) - Handwriting|zh-TW|2
|
||||
Croatian|hr-HR|1
|
||||
Czech|cs-CZ|1
|
||||
Danish|da-DK|1
|
||||
Divehi|dv-MV|1
|
||||
Dutch (Belgium)|nl-BE|1
|
||||
Dutch (Netherlands)|nl-NL|1
|
||||
Dzongkha|dz-BT|1
|
||||
English (Australia)|en-AU|1
|
||||
English (Canada)|en-CA|1
|
||||
English (India)|en-IN|1
|
||||
English (Ireland)|en-IE|1
|
||||
English (United Kingdom)|en-GB|1
|
||||
English (United States)|en-US|1
|
||||
Estonian|et-EE|1
|
||||
Faroese|fo-FO|1
|
||||
Filipino|fil-PH|1
|
||||
Finnish|fi-FI|1
|
||||
French (Belgium)|fr-BE|1
|
||||
French (Canada)|fr-CA|1
|
||||
French (France)|fr-FR|1
|
||||
French (Switzerland)|fr-CH|1
|
||||
Galician|gl-ES|1
|
||||
Georgian|ka-GE|1
|
||||
German (Germany)|de-DE|1
|
||||
German (Switzerland)|de-CH|1
|
||||
Greek|el-GR|1
|
||||
Greenlandic|kl-GL|1
|
||||
Guarani|gn-PY|1
|
||||
Gujarati - INSCRIPT|gu-IN|1
|
||||
Gujarati - Phonetic|gu-IN|2
|
||||
Hausa|ha-Latn-NG|1
|
||||
Hebrew|he-IL|1
|
||||
Hindi - 37-key|hi-IN|1
|
||||
Hindi - INSCRIPT|hi-IN|3
|
||||
Hindi - Phonetic|hi-IN|2
|
||||
Hinglish|hi-Latn|1
|
||||
Hungarian|hu-HU|1
|
||||
Icelandic|is-IS|1
|
||||
Igbo|ig-NG|1
|
||||
Indonesian|id-ID|1
|
||||
Inuktitut - Latin|iu-Latn-CA|1
|
||||
Irish|ga-IE|1
|
||||
Italian|it-IT|1
|
||||
Japanese - 12-key|ja-JP|1
|
||||
Japanese - QWERTY|ja-JP|2
|
||||
Kannada - INSCRIPT|kn-IN|1
|
||||
Kannada - Phonetic|kn-IN|2
|
||||
Kazakh|kk-KZ|1
|
||||
Khmer|km-KH|1
|
||||
Kinyarwanda|rw-RW|1
|
||||
Kiswahili|sw-KE|1
|
||||
Konkani|kok-IN|1
|
||||
Korean - 12-key Chunjiin|ko-KR|2
|
||||
Korean - 12-key Naratgeul|ko-KR|3
|
||||
Korean - 12-key Sky|ko-KR|4
|
||||
Korean - QWERTY|ko-KR|1
|
||||
Kyrgyz|ky-KG|1
|
||||
Lao|lo-LA|1
|
||||
Latvian|lv-LV|1
|
||||
Lithuanian|lt-LT|1
|
||||
Luxembourgish|lb-LU|1
|
||||
Macedonian|mk-MK|1
|
||||
Malay (Brunei Darussalam)|ms-BN|1
|
||||
Malay (Malaysia)|ms-MY|1
|
||||
Malayalam - INSCRIPT|ml-IN|1
|
||||
Malayalam - Phonetic|ml-IN|2
|
||||
Maltese|mt-MT|1
|
||||
Maori|mi-NZ|1
|
||||
Marathi - INSCRIPT|mr-IN|1
|
||||
Marathi - Phonetic|mr-IN|2
|
||||
Mongolian - Cyrillic|mn-MN|1
|
||||
Mongolian - Traditional Mongolian|mn-Mong-CN|1
|
||||
Myanmar|my-MM|1
|
||||
Nepali|ne-NP|1
|
||||
Norwegian - Bokmal|nb-NO|1
|
||||
Norwegian - Nynorsk|ny-NO|1
|
||||
Odia - INSCRIPT|or-IN|1
|
||||
Odia - Phonetic|or-IN|2
|
||||
Pashto|ps-AF|1
|
||||
Persian|fa-IR|1
|
||||
Polish|pl-PL|1
|
||||
Portuguese (Brazil)|pt-BR|1
|
||||
Portuguese (Portugal)|pt-PT|1
|
||||
Punjabi - INSCRIPT|pa-IN|1
|
||||
Punjabi - Phonetic|pa-IN|2
|
||||
Romanian|ro-RO|1
|
||||
Romansh|rm-CH|1
|
||||
Russian|ru-RU|1
|
||||
Sakha|sah-RU|1
|
||||
Sami, Northern (Norway)|se-NO|1
|
||||
Sami, Northern (Sweden)|se-NO|1
|
||||
Scottish Gaelic|gd-GB|1
|
||||
Serbian - Cyrillic|sr-Cyrl-RS|1
|
||||
Serbian - Latin|sr-Latn-RS|1
|
||||
Sesotho sa Leboa|nso-ZA|1
|
||||
Setswana|tn-ZA|1
|
||||
Sinhala|si-LK|1
|
||||
Slovak|sk-SK|1
|
||||
Slovenian|sl-SI|1
|
||||
Sorbian, Upper|hsb-DE|1
|
||||
Spanish (Mexico)|es-MX|1
|
||||
Spanish (Spain)|es-ES|1
|
||||
Swedish|sv-SE|1
|
||||
Syriac|syr-SY|1
|
||||
Tajik|tg-Cyrl-TJ|1
|
||||
Tamazight (Central Atlas) - Tifinagh|tzm-Tfng-MA|1
|
||||
Tamazight (Central Atlas) - Latin|tzm-Latn-DZ|1
|
||||
Tamil - INSCRIPT|ta-IN|1
|
||||
Tamil - Phonetic|ta-IN|2
|
||||
Tatar|tt-RU|1
|
||||
Telugu - INSCRIPT|te-IN|1
|
||||
Telugu - Phonetic|te-IN|2
|
||||
Thai|th-TH|1
|
||||
Tibetan|bo-CN|1
|
||||
Turkish|tr-TR|1
|
||||
Turkmen|tk-TM|1
|
||||
Ukrainian|uk-UA|1
|
||||
Urdu|ur-PK|1
|
||||
Uyghur|ug-CN|1
|
||||
Uzbek - Cyrillic|uz-Cyrl-UZ|1
|
||||
Uzbek - Latin|uz-Latn-UZ|1
|
||||
Valencian|ca-ES-valencia|1
|
||||
Vietnamese - QWERTY|vi-VN|1
|
||||
Vietnamese - TELEX|vi-VN|2
|
||||
Vietnamese - VNI|vi-VN|3
|
||||
Welsh|cy-GB|1
|
||||
Wolof|N/A|1
|
||||
Xhosa|xh-ZA|1
|
||||
Yoruba|yo-NG|1
|
||||
Zulu|zu-ZA|1
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
---
|
||||
title: Theme (Windows 10)
|
||||
description: This section describes the Theme settings that you can configure in provisioning packages for Windows 10 using Windows Configuration Designer.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.author: greglin
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Theme (reference)
|
||||
|
||||
Use Theme to configure accent and background colors on Windows 10 Mobile.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | X | | | |
|
||||
|
||||
## DefaultAccentColor
|
||||
|
||||
In the dropdown menu for DefaultAccentColor, select from the list of colors. The accent color is used for the background of the start tiles, some text, the progress indicator, the user’s My Phone web site, and so on.
|
||||
|
||||
|
||||
## DefaultBackgroundColor
|
||||
|
||||
Select between **Light** and **Dark** for theme.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Themes and accent colors](/previous-versions//dn772323(v=vs.85))
|
||||
@ -19,7 +19,7 @@ Use **Time** to configure settings for time zone setup for Windows 10, version (
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ProvisionSetTimeZone](#provisionsettimezone) | X | | | | |
|
||||
| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | | |
|
||||
|
||||
## ProvisionSetTimeZone
|
||||
|
||||
|
||||
@ -15,14 +15,22 @@ manager: dansimp
|
||||
# UnifiedWriteFilter (reference)
|
||||
|
||||
|
||||
Use UnifiedWriteFilter to configure settings for the Unified Write Filter (UWF) in your device to help protect your physical storage media, including most standard writable storage types that are supported by the OS, such as physical hard disks, solidate-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writeable volume.
|
||||
Use UnifiedWriteFilter to configure settings for the Unified Write Filter (UWF). It helps protect your physical storage media, including most standard writable storage types that are supported by the OS, such as:
|
||||
|
||||
- Physical hard disks
|
||||
- Solidate-state drives
|
||||
- Internal USB devices
|
||||
- External SATA devices
|
||||
- And so on
|
||||
|
||||
You can also use UWF to make read-only media appear to the OS as a writeable volume.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You cannot use UWF to protect external USB devices or flash drives.
|
||||
>You can't use UWF to protect external USB devices or flash drives.
|
||||
|
||||
UWF intercepts all write attempts to a protected volume and redirects those write attempts to a virtual overlay. This improves the reliability and stability of your device and reduces the wear on write-sensitive media, such as flash memory media like solid-state drives.
|
||||
UWF intercepts all write attempts to a protected volume and redirects these write attempts to a virtual overlay. This feature improves the reliability and stability of your device. It also reduces the wear on write-sensitive media, such as flash memory media like solid-state drives.
|
||||
|
||||
The overlay does not mirror the entire volume, but dynamically grows to keep track of redirected writes. Generally the overlay is stored in system memory, although you can cache a portion of the overlay on a physical volume.
|
||||
The overlay doesn't mirror the entire volume. It dynamically grows to keep track of redirected writes. Generally, the overlay is stored in system memory. You can cache a portion of the overlay on a physical volume.
|
||||
|
||||
>[!NOTE]
|
||||
>UWF fully supports the NTFS system; however, during device startup, NTFS file system journal files can write to a protected volume before UWF has loaded and started protecting the volume.
|
||||
@ -34,7 +42,7 @@ The overlay does not mirror the entire volume, but dynamically grows to keep tra
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | X | | | | X |
|
||||
| All settings | ✔️ | | | | ✔️ |
|
||||
|
||||
## FilterEnabled
|
||||
|
||||
@ -42,9 +50,9 @@ Set to **True** to enable UWF.
|
||||
|
||||
## OverlayFlags
|
||||
|
||||
OverlayFlags specifies whether to allow writes to unused space on the volume to pass through, and not be redirected to the overlay file. Enabling this setting helps conserve space on the overlay file.
|
||||
OverlayFlags specifies whether to allow writes to unused space on the volume to pass through, and not redirect to the overlay file. Enabling this setting helps conserve space on the overlay file.
|
||||
|
||||
- Value `0` (default value when [OverlayType](#overlaytype) is not **Disk**): writes are redirected to the overlay file
|
||||
- Value `0` (default value when [OverlayType](#overlaytype) isn't **Disk**): writes are redirected to the overlay file
|
||||
- Value `1`(default value when [OverlayType](#overlaytype) is **Disk**): writes to unused space on the volume are allowed to pass through without being redirected to the overlay file.
|
||||
|
||||
## OverlaySize
|
||||
@ -60,7 +68,7 @@ OverlayType specifies where the overlay is stored. Select between **RAM** (defau
|
||||
|
||||
## RegistryExclusions
|
||||
|
||||
You can add or remove registry entries that will be excluded from UWF filtering. When a registry key is in the exclusion list, all writes to that registry key bypass UWF filtering and are written directly to the registry and persist after the device restarts.
|
||||
You can add or remove registry entries that will be excluded from UWF filtering. When a registry key is in the exclusion list, all writes to that registry key bypass UWF filtering. They're written directly to the registry and persist after the device restarts.
|
||||
|
||||
Use **Add** to add a registry entry to the exclusion list after you restart the device.
|
||||
|
||||
|
||||
@ -24,15 +24,15 @@ Use UniversalAppInstall settings to install Windows apps from the Microsoft Stor
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DeviceContextApp](#devicecontextapp) | X | | X | | |
|
||||
| [DeviceContextAppLicense](#devicecontextapplicense) | X | | X | | |
|
||||
| [StoreInstall](#storeinstall) | X | X | X | | X |
|
||||
| [UserContextApp](#usercontextapp) | X | X | X | | X |
|
||||
| [UserContextAppLicense](#usercontextapplicense) | X | X | X | | X |
|
||||
| [DeviceContextApp](#devicecontextapp) | ✔️ | | ✔️ | | |
|
||||
| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | | ✔️ | | |
|
||||
| [StoreInstall](#storeinstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## DeviceContextApp
|
||||
|
||||
Enter an app package family name to install an app for all users of the device. You can use the [Get-AppxPackage cmdlet](/powershell/module/appx/get-appxpackage) to get the package family name for an installed app.
|
||||
Enter an app package family name to install an app for all device users. You can use the [Get-AppxPackage cmdlet](/powershell/module/appx/get-appxpackage) to get the package family name for an installed app.
|
||||
|
||||
>[!NOTE]
|
||||
>For XAP files, enter the product ID.
|
||||
@ -41,11 +41,11 @@ For each app that you add to the package, configure the settings in the followin
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| ApplicationFile | .appx or .appxbundle | Set the value to the app file that you want to install on the device. In addition, you must also enable the [AllowAllTrustedApps setting](wcd-policies.md#applicationmanagement) and add a root certificate or license file. |
|
||||
| DependencyAppxFiles | any required frameworks | In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. |
|
||||
| DeploymentOptions | - None</br>-Force application shutdown: If this package, or any package that depends on this package, is currently in use, the processes associated with the package are shut down forcibly so that registration can continue</br>- Development mode: do not use</br>- Install all resources: When you set ths option, the app is instructed to skip resource applicability checks.</br>- Force target application shutdown: If this package is currently in use, the processes associated with the package are shut down forcibly so that registration can continue | Select a deployment option. |
|
||||
| LaunchAppAtLogin | - Do not launch app</br>- Launch app | Set the value for app behavior when a user signs in. |
|
||||
| OptionalPackageFiles | additional files required by the package | Browse to, select, and add the optional package files. |
|
||||
| ApplicationFile | `.appx` or `.appxbundle` | Set the value to the app file that you want to install on the device. Also enable the [AllowAllTrustedApps setting](wcd-policies.md#applicationmanagement) and add a root certificate or license file. |
|
||||
| DependencyAppxFiles | Any required frameworks | In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. |
|
||||
| DeploymentOptions | - None</br>-Force application shutdown: If this package, or any package that depends on this package is currently in use, then the processes associated with the package are forcibly shut down. The registration can continue. </br>- Development mode: Don't use. </br>- Install all resources: When you set this option, the app is instructed to skip resource applicability checks.</br>- Force target application shutdown: If this package is currently in use, the processes associated with the package are shut down forcibly so that registration can continue | Select a deployment option. |
|
||||
| LaunchAppAtLogin | - Don't launch app</br>- Launch app | Set the value for app behavior when a user signs in. |
|
||||
| OptionalPackageFiles | Additional files required by the package | Browse to, select, and add the optional package files. |
|
||||
|
||||
For more information on deployment options, see [DeploymentOptions Enum](/uwp/api/windows.management.deployment.deploymentoptions).
|
||||
|
||||
@ -53,7 +53,7 @@ For more information on deployment options, see [DeploymentOptions Enum](/uwp/ap
|
||||
|
||||
Use to specify the license file for the provisioned app.
|
||||
|
||||
1. Specify a **LicenseProductId** for the app. You can find the license ID in the root header of the license file. Here is an example, `LicenseID="aaaaaaaa-dddd-8848-f8d0-7d6a93dfcccc"`. Enter it in the LicenseProductId field, and click **Add**.
|
||||
1. Specify a **LicenseProductId** for the app. You can find the license ID in the root header of the license file. For example, enter `LicenseID="aaaaaaaa-dddd-8848-f8d0-7d6a93dfcccc"`. Enter it in the LicenseProductId field, and select **Add**.
|
||||
|
||||
2. Select the LicenseProductId in the Available Customizations pane, and then browse to and select the app license file.
|
||||
|
||||
@ -62,7 +62,7 @@ Use to specify the license file for the provisioned app.
|
||||
|
||||
Use to install an app from the Microsoft Store for Business.
|
||||
|
||||
1. Enter a package family name, and then click **Add**.
|
||||
1. Enter a package family name, and then select **Add**.
|
||||
2. Configure the following required settings for the app package.
|
||||
|
||||
Setting | Description
|
||||
@ -75,21 +75,21 @@ SkuID | Enter the SKU ID. [Learn how to find the SKU ID.](/microsoft-store/micro
|
||||
|
||||
Use to add a new user context app.
|
||||
|
||||
1. Specify a **PackageFamilyName** for the app, and then click **Add**.
|
||||
1. Specify a **PackageFamilyName** for the app, and then select **Add**.
|
||||
2. Select the PackageFamilyName in the Available Customizations pane, and then configure the following settings.
|
||||
|
||||
Setting | Value | Description
|
||||
--- | --- | ---
|
||||
ApplicationFile | app file | Browse to, select, and add the application file,
|
||||
DependencyAppxFiles | additional files required by the app | Browse to, select, and add dependency files.
|
||||
ApplicationFile | App file | Browse to, select, and add the application file,
|
||||
DependencyAppxFiles | Additional files required by the app | Browse to, select, and add dependency files.
|
||||
DeploymentOptions | - None</br></br>- Force application shutdown</br></br>- Development mode</br></br>- Install all resources</br></br>- Force target application shutdown | Select a deployment option.
|
||||
LaunchAppAtLogin | - Do not launch app</br></br>- Launch app | Select whether the app should be started when a user signs in.
|
||||
LaunchAppAtLogin | - Don't launch app</br></br>- Launch app | Select whether the app should be started when a user signs in.
|
||||
|
||||
|
||||
## UserContextAppLicense
|
||||
|
||||
Use to specify the license file for the user context app.
|
||||
|
||||
1. Specify a **LicenseProductId** for the app. You can find the license ID in the root header of the license file. Here is an example, `LicenseID="aaaaaaaa-dddd-8848-f8d0-7d6a93dfcccc"`. Enter it in the LicenseProductId field, and click **Add**.
|
||||
1. Specify a **LicenseProductId** for the app. You can find the license ID in the root header of the license file. For example, enter `LicenseID="aaaaaaaa-dddd-8848-f8d0-7d6a93dfcccc"`. Enter it in the LicenseProductId field, and select **Add**.
|
||||
|
||||
2. Select the LicenseProductId in the Available Customizations pane, and then browse to and select the app license file.
|
||||
@ -22,21 +22,21 @@ Use UniversalAppUninstall settings to uninstall or remove Windows apps.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [RemoveProvisionedApp](#removeprovisionedapp) | X | | | | |
|
||||
| [Uninstall](#uninstall) | X | X | X | | X |
|
||||
| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | | |
|
||||
| [Uninstall](#uninstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## RemoveProvisionedApp
|
||||
|
||||
Universal apps can be *provisioned*, which means that they are available on the device for installation in user context. When a user runs the provisioned app, the app is then installed for that user.
|
||||
Universal apps can be *provisioned*. Provisioned means that they're available on the device for installation in user context. When a user runs the provisioned app, the app is then installed for that user.
|
||||
|
||||
Use **RemoveProvisionedApp** to remove app packages that are available on the device. Any instances of the app that have already been installed by a user are not uninstalled. To uninstall provisioned apps that have been installed by a user, use the [Uninstall](#uninstall) setting.
|
||||
Use **RemoveProvisionedApp** to remove app packages that are available on the device. Any instances of the app that have already been installed by a user aren't uninstalled. To uninstall provisioned apps that have been installed by a user, use the [Uninstall](#uninstall) setting.
|
||||
|
||||
1. Enter the PackageFamilyName for the app package, and then click **Add**.
|
||||
1. Enter the PackageFamilyName for the app package, and then select **Add**.
|
||||
2. Select the PackageFamilyName in the Available Customizations pane, and then select **RemoveProvisionedApp**.
|
||||
|
||||
## Uninstall
|
||||
|
||||
Use **Uninstall** to remove provisioned apps that have been installed by a user.
|
||||
|
||||
1. Enter the PackageFamilyName for the app package, and then click **Add**.
|
||||
1. Enter the PackageFamilyName for the app package, and then select **Add**.
|
||||
2. Select the PackageFamilyName in the Available Customizations pane, and then select **Uninstall**.
|
||||
|
||||
@ -22,7 +22,7 @@ Allows an OEM to hide the USB option UI in Settings and all USB device errors.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | X | X | X | X | |
|
||||
| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
||||
|
||||
## HideUsbErrorNotifyOptionUI
|
||||
|
||||
|
||||
@ -22,8 +22,8 @@ Use WeakCharger settings to configure the charger notification UI.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | X | X | X | | |
|
||||
| [NotifyOnWeakCharger](#notifyonweakcharger) | X | X | X | | |
|
||||
| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
## HideWeakChargerNotifyOptionUI
|
||||
@ -34,12 +34,15 @@ Select between **Show Weak Charger Notifications UI** and **Hide Weak Charger No
|
||||
|
||||
## NotifyOnWeakCharger
|
||||
|
||||
This setting displays a warning when the user connects the device to an incompatible charging source. This warning is intended to notify users that their device may take longer to charge or may not charge at all with the current charging source.
|
||||
This setting shows a warning when the user connects the device to an incompatible charging source. This warning is intended to notify users that their device may take longer to charge. Or, it may not charge at all.
|
||||
|
||||
An incompatible charging source is one that doesn't behave like one of the following port types:
|
||||
|
||||
An incompatible charging source is one that does not behave like one of the following port types as defined by the USB Battery Charging Specification, Revision 1.2, available on the USB.org website:
|
||||
- Charging downstream port
|
||||
- Standard downstream port
|
||||
- Dedicated charging port
|
||||
|
||||
The port types are defined by the USB Battery Charging Specification, Revision 1.2, available at `USB.org`.
|
||||
|
||||
Select between **Disable Weak Charger Notifications UI** and **Enable Weak Charger Notifications UI**.
|
||||
|
||||
|
||||
@ -15,17 +15,17 @@ manager: dansimp
|
||||
# WindowsHelloForBusiness (Windows Configuration Designer reference)
|
||||
|
||||
|
||||
Use WindowsHelloForBusiness settings to specify whether [FIDO2 security keys for Windows Hello](https://blogs.windows.com/business/2018/04/17/windows-hello-fido2-security-keys/) can be used to sign in to Windows on a device configured for [Shared PC mode](wcd-sharedpc.md).
|
||||
Use WindowsHelloForBusiness settings to specify whether [FIDO2 security keys for Windows Hello](https://blogs.windows.com/business/2018/04/17/windows-hello-fido2-security-keys/) can be used to sign in to a Windows device configured for [Shared PC mode](wcd-sharedpc.md).
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [SecurityKeys](#securitykeys) | X | | | | |
|
||||
| [SecurityKeys](#securitykeys) | ✔️ | | | | |
|
||||
|
||||
## SecurityKeys
|
||||
|
||||
Select the desired value:
|
||||
Select the value:
|
||||
|
||||
- `0`: security keys for Windows Hello are disabled.
|
||||
- `1`: security keys for Windows Hello are enabled on [Shared PCs](wcd-sharedpc.md).
|
||||
- `0`: Security keys for Windows Hello are disabled.
|
||||
- `1`: Security keys for Windows Hello are enabled on [Shared PCs](wcd-sharedpc.md).
|
||||
|
||||
@ -22,31 +22,31 @@ Use WindowsTeamSettings settings to configure Surface Hub.
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | X | | |
|
||||
| All settings | | | ✔️ | | |
|
||||
|
||||
## Connect
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| AutoLaunch | True or false | Open the Connect app automatically when someone projects. |
|
||||
| Channel | - 1, 3, 4, 5, 6, 7, 8, 9, 10, 11 (works with all Miracast senders in all regions)</br>- 36, 40, 44, 48 (works with all 5ghz band Miracast senders in all regions)</br>- 149, 153, 157, 161, 165 (works with all 5ghz band Miracast senders in all regions except Japan) | Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification. Integer specifying the channel. The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for). |
|
||||
| Channel | - 1, 3, 4, 5, 6, 7, 8, 9, 10, 11 (works with all Miracast senders in all regions)</br>- 36, 40, 44, 48 (works with all 5ghz band Miracast senders in all regions)</br>- 149, 153, 157, 161, 165 (works with all 5ghz band Miracast senders in all regions except Japan) | Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification. Integer specifying the channel. The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly, the driver won't boot. Or, it will broadcast on the wrong channel, which senders won't be looking for. |
|
||||
| Enabled | True or false | Enables wireless projection to the device. |
|
||||
| PINRequired | True or false | Requires presenters to enter a PIN to connect wirelessly to the device. |
|
||||
|
||||
## DeviceAccount
|
||||
|
||||
A device account is a Microsoft Exchange account that is connected with Skype for Business, which allows people to join scheduled meetings, make Skype for Business calls, and share content from the device.
|
||||
A device account is a Microsoft Exchange account that's connected with Skype for Business. It allows people to join scheduled meetings, make Skype for Business calls, and share content from the device.
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| CalendarSyncEnabled | True or false | Specifies whether calendar sync and other Exchange Server services are enabled. |
|
||||
| DomainName | Domain of the device account when you are using Active Directory | To use a device account from Active Directory, you should specify both **DomainName** and **UserName** for the device account. |
|
||||
| DomainName | Domain of the device account when using Active Directory | To use a device account from Active Directory, you should specify both **DomainName** and **UserName** for the device account. |
|
||||
| Email | Email address | Email address of the device account. |
|
||||
| ExchangeServer | Exchange Server | Normally, the device will try to automatically discover the Exchange server. This field is only required if automatic discovery fails. |
|
||||
| Password | Password | Password for the device account. |
|
||||
| PasswordRotationEnabled | 0 = enabled</br>1 = disabled | Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, use this setting to allow the device to manage its own password by changing it frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory or Azure AD. |
|
||||
| PasswordRotationEnabled | 0 = enabled</br>1 = disabled | Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, then use this setting to allow the device to manage its own password. It can change the password frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory or Azure AD. |
|
||||
| SipAddress | Session Initiation Protocol (SIP) address | Normally, the device will try to automatically discover the SIP. This field is only required if automatic discovery fails. |
|
||||
| UserName | User name | Username of the device account when you are using Active Directory. |
|
||||
| UserName | User name | Username of the device account when using Active Directory. |
|
||||
| UserPrincipalName | User principal name (UPN) | To use a device account from Azure Active Directory or a hybrid deployment, you should specify the UPN of the device account. |
|
||||
| ValidateAndCommit | Any text | Validates the data provided and then commits the changes. This process occurs automatically after the other DeviceAccount settings are applied. The text you enter for the ValidateAndCommit setting doesn't matter. |
|
||||
|
||||
@ -62,11 +62,11 @@ Enter the name that users will see when they want to project wirelessly to the d
|
||||
|
||||
## MaintenanceHours
|
||||
|
||||
Maintenance hours are the period of time during which automatic maintenance tasks are performed.
|
||||
Maintenance hours are the period of time when automatic maintenance tasks are run.
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| Duration | Duration in minutes. For example, to set a 3-hour duration, set this value to 180. | The amount of time the device will be in maintenance, when the device will continue to download or install updates. |
|
||||
| Duration | Duration in minutes. For example, to set a three hour duration, set this value to 180. | The amount of time the device will be in maintenance, when the device will continue to download or install updates. |
|
||||
| StartTime | Start time in minutes from midnight. For example, to set a 2:00 am start time, set this value to 120 | Start time for when device is allowed to start downloading and installing updates. |
|
||||
|
||||
## OMSAgent
|
||||
@ -75,7 +75,7 @@ Configures the Operations Management Suite workspace.
|
||||
|
||||
| Setting | Value | Description |
|
||||
| --- | --- | --- |
|
||||
| WorkspaceID | GUID | GUID identifying the Operations Management Suite workspace ID to collect the data. Set this to an empty string to disable the MOM agent. |
|
||||
| WorkspaceID | GUID | GUID identifying the Operations Management Suite workspace ID to collect the data. Set this value to an empty string to disable the MOM agent. |
|
||||
| WorkspaceKey | Key | Primary key for authenticating with the workspace. |
|
||||
|
||||
## Properties
|
||||
@ -85,7 +85,7 @@ Configures the Operations Management Suite workspace.
|
||||
| AllowAutoProxyAuth | True or false | Specifies if the Surface Hub can use the device account to authenticate into proxy servers requiring authentication. |
|
||||
| AllowSessionResume | True or false | Specifies if users are allowed to resume their session after session timeout. |
|
||||
| DefaultVolume | Numeric value between 0 and 100 | Default speaker volume. Speaker volume will be set to this value at every session startup. |
|
||||
| DisableSigninSuggestions | True or false | Specifies if the Surface Hub will not show suggestions when users try to sign in to see their meetings and files. |
|
||||
| DisableSigninSuggestions | True or false | Specifies if the Surface Hub won't show suggestions when users try to sign in to see their meetings and files. |
|
||||
| DoNotShowMyMeetingsAndFiles | True or false | Specifies if users can sign in and have full access to personal meetings and most recently used documents. |
|
||||
| ScreenTimeout | Select minutes from dropdown menu | The time (in minutes) of inactivity after which the Surface Hub will turn off its screen. |
|
||||
| SessionTimeout | Select minutes from dropdown menu | The time (in minutes) of inactivity after which the Surface Hub will time out the current session and return to the welcome screen. |
|
||||
@ -105,6 +105,6 @@ Configures the Operations Management Suite workspace.
|
||||
| CurrentBackgroundPath | Https URL to a PNG file | Background image for the welcome screen. |
|
||||
| MeetingInfoOption | 0 = organizer and time only</br>1 = organizer, time, and subject (subject is hidden for private meetings) | Specifies whether meeting information is displayed on the welcome screen. |
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [SurfaceHub configuration service provider (CSP)](/windows/client-management/mdm/surfacehub-csp)
|
||||
@ -22,11 +22,11 @@ Use Workplace settings to configure bulk user enrollment to a mobile device mana
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Enrollments](#enrollments) | X | X | X | | X |
|
||||
| [Enrollments](#enrollments) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## Enrollments
|
||||
|
||||
Select **Enrollments**, enter a UPN, and then click **Add** to configure the settings for the enrollment. The UPN is a unique identifier for enrollment. For bulk enrollment, this must a service account that is allowed to enroll multiple users. Example, "generic-device@contoso.com"
|
||||
Select **Enrollments**, enter a UPN, and then select **Add** to configure the settings for the enrollment. The UPN is a unique identifier for enrollment. For bulk enrollment, this value must be a service account that's allowed to enroll multiple users. For example, use `generic-device@contoso.com`.
|
||||
|
||||
| Settings | Value | Description |
|
||||
| --- | --- | --- |
|
||||
@ -34,8 +34,8 @@ Select **Enrollments**, enter a UPN, and then click **Add** to configure the set
|
||||
| DiscoveryServiceFullUrl | URL | The full URL for the discovery service |
|
||||
| EnrollmentServiceFullUrl | URL | The full URL for the enrollment service |
|
||||
| PolicyServiceFullUrl | URL | The full URL for the policy service |
|
||||
| Secret | - Password string for on-premises authentication enrollment</br>- Federated security token for federated enrollment</br>- Certificate thumb print for certificate-based enrollment | Enter the appropriate value for the selected AuthPolicy |
|
||||
| Secret | - Password string for on-premises authentication enrollment</br>- Federated security token for federated enrollment</br>- Certificate thumb print for certificate-based enrollment | Enter the appropriate value for the selected AuthPolicy. |
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [Provisioning configuration service provider (CSP)](/windows/client-management/mdm/provisioning-csp)
|
||||
@ -24,10 +24,7 @@ This section describes the settings that you can configure in [provisioning pack
|
||||
| [Accounts](wcd-accounts.md) | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ADMXIngestion](wcd-admxingestion.md) | ✔️ | | | |
|
||||
| [AssignedAccess](wcd-assignedaccess.md) | ✔️ | | ✔️ | |
|
||||
| [AutomaticTime](wcd-automatictime.md) | | | | |
|
||||
| [Browser](wcd-browser.md) | ✔️ | ✔️ | | |
|
||||
| [CallAndMessagingEnhancement](wcd-callandmessagingenhancement.md) | | | | |
|
||||
| [Calling](wcd-calling.md) | | | | |
|
||||
| [CellCore](wcd-cellcore.md) | ✔️ | | | |
|
||||
| [Cellular](wcd-cellular.md) | ✔️ | | | |
|
||||
| [Certificates](wcd-certificates.md) | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
@ -38,7 +35,6 @@ This section describes the settings that you can configure in [provisioning pack
|
||||
| [DesktopBackgroundAndColors](wcd-desktopbackgroundandcolors.md) | ✔️ | | | |
|
||||
| [DeveloperSetup](wcd-developersetup.md) | | | ✔️ | |
|
||||
| [DeviceFormFactor](wcd-deviceformfactor.md) | ✔️ | ✔️ | | |
|
||||
| [DeviceInfo](wcd-deviceinfo.md) | | | | |
|
||||
| [DeviceManagement](wcd-devicemanagement.md) | ✔️ | ✔️ | ✔️ | |
|
||||
| [DeviceUpdateCenter](wcd-deviceupdatecenter.md) | ✔️ | | | |
|
||||
| [DMClient](wcd-dmclient.md) | ✔️ | ✔️ | | ✔️ |
|
||||
@ -47,27 +43,18 @@ This section describes the settings that you can configure in [provisioning pack
|
||||
| [FirewallConfiguration](wcd-firewallconfiguration.md) | | | | ✔️ |
|
||||
| [FirstExperience](wcd-firstexperience.md) | | | ✔️ | |
|
||||
| [Folders](wcd-folders.md) |✔️ | ✔️ | | |
|
||||
| [InitialSetup](wcd-initialsetup.md) | | | | |
|
||||
| [InternetExplorer](wcd-internetexplorer.md) | | | | |
|
||||
| [KioskBrowser](wcd-kioskbrowser.md) | | | | ✔️ |
|
||||
| [Licensing](wcd-licensing.md) | ✔️ | | | |
|
||||
| [Location](wcd-location.md) | | | | ✔️ |
|
||||
| [Maps](wcd-maps.md) |✔️ | ✔️ | | |
|
||||
| [Messaging](wcd-messaging.md) | | | | |
|
||||
| [ModemConfigurations](wcd-modemconfigurations.md) | | | | |
|
||||
| [Multivariant](wcd-multivariant.md) | | | | |
|
||||
| [NetworkProxy](wcd-networkproxy.md) | | ✔️ | | |
|
||||
| [NetworkQOSPolicy](wcd-networkqospolicy.md) | | ✔️ | | |
|
||||
| [NFC](wcd-nfc.md) | | | | |
|
||||
| [OOBE](wcd-oobe.md) | ✔️ | | | |
|
||||
| [OtherAssets](wcd-otherassets.md) | | | | |
|
||||
| [Personalization](wcd-personalization.md) | ✔️ | | | |
|
||||
| [Policies](wcd-policies.md) | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [Privacy](wcd-folders.md) |✔️ | ✔️ | | ✔️ |
|
||||
| [ProvisioningCommands](wcd-provisioningcommands.md) | ✔️ | | | |
|
||||
| [RcsPresence](wcd-rcspresence.md) | | | | |
|
||||
| [SharedPC](wcd-sharedpc.md) | ✔️ | | | |
|
||||
| [Shell](wcd-shell.md) | | | | |
|
||||
| [SMISettings](wcd-smisettings.md) | ✔️ | | | |
|
||||
| [Start](wcd-start.md) | ✔️ | | | |
|
||||
| [StartupApp](wcd-startupapp.md) | | | | ✔️ |
|
||||
@ -76,8 +63,6 @@ This section describes the settings that you can configure in [provisioning pack
|
||||
| [SurfaceHubManagement](wcd-surfacehubmanagement.md) | | ✔️ | | |
|
||||
| [TabletMode](wcd-tabletmode.md) |✔️ | ✔️ | | |
|
||||
| [TakeATest](wcd-takeatest.md) | ✔️ | | | |
|
||||
| [TextInput](wcd-textinput.md) | | | | |
|
||||
| [Theme](wcd-theme.md) | | | | |
|
||||
| [Time](wcd-time.md) | ✔️ | | | |
|
||||
| [UnifiedWriteFilter](wcd-unifiedwritefilter.md) | ✔️ | | | ✔️ |
|
||||
| [UniversalAppInstall](wcd-universalappinstall.md) | ✔️ | ✔️ | | ✔️ |
|
||||
@ -88,4 +73,3 @@ This section describes the settings that you can configure in [provisioning pack
|
||||
| [WindowsTeamSettings](wcd-windowsteamsettings.md) | | ✔️ | | |
|
||||
| [Workplace](wcd-workplace.md) |✔️ | ✔️ | | ✔️ |
|
||||
|
||||
|
||||
|
||||
@ -208,6 +208,8 @@
|
||||
href: update/update-compliance-security-update-status.md
|
||||
- name: Feature update status report
|
||||
href: update/update-compliance-feature-update-status.md
|
||||
- name: Safeguard holds report
|
||||
href: update/update-compliance-safeguard-holds.md
|
||||
- name: Delivery Optimization in Update Compliance
|
||||
href: update/update-compliance-delivery-optimization.md
|
||||
- name: Data handling and privacy in Update Compliance
|
||||
|
||||
@ -28,7 +28,7 @@ The features described below are no longer being actively developed, and might b
|
||||
|
||||
|Feature | Details and mitigation | Announced in version |
|
||||
| ----------- | --------------------- | ---- |
|
||||
| BitLocker To Go Reader | Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11.<br>The following items might not be available in a future release of Windows client:<br>- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**<br>- Command line parameter: [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv)<br>- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**<br>- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 |
|
||||
| BitLocker To Go Reader | **Note: BitLocker to Go as a feature is still supported.**<br>Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11.<br>The following items might not be available in a future release of Windows client:<br>- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**<br>- Command line parameter: [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv)<br>- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**<br>- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 |
|
||||
| Internet Explorer (IE) 11 | The IE11 desktop application will end support for certain operating systems starting June 15, 2022. For more information, see [Internet Explorer 11](/lifecycle/products/internet-explorer-11). | 21H1 |
|
||||
| Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 |
|
||||
| Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](/powershell/scripting/learn/ps101/07-working-with-wmi). Note: This deprecation only applies to the [command-line management tool](/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 |
|
||||
|
||||
@ -64,7 +64,6 @@ The following features and functionalities have been removed from the installed
|
||||
|TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| 1709 |
|
||||
|Tile Data Layer |To be replaced by the Tile Store.| 1709 |
|
||||
|Resilient File System (ReFS) (added: August 17, 2017)| Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability. | 1709 |
|
||||
|Apps Corner| This Windows 10 mobile application is removed in the version 1703 release. | 1703 |
|
||||
|By default, Flash autorun in Edge is turned off. | Use the Click-to-Run (C2R) option instead. (This setting can be changed by the user.) | 1703 |
|
||||
|Interactive Service Detection Service| See [Interactive Services](/windows/win32/services/interactive-services) for guidance on how to keep software up to date. | 1703 |
|
||||
|Microsoft Paint | This application will not be available for languages that are not on the [full localization list](https://www.microsoft.com/windows/windows-10-specifications#Windows-10-localization). | 1703 |
|
||||
|
||||
@ -29,6 +29,7 @@ The deployment service is designed for IT Pros who are looking for more control
|
||||
- You can stage deployments over a period of days or weeks by using rich expressions (for example, deploy 20H2 to 500 devices per day, beginning on March 14, 2021).
|
||||
- You can bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization when emergencies arise.
|
||||
- You can benefit from deployments with automatic piloting tailored to your unique device population to ensure coverage of hardware and software in your organization.
|
||||
- You can use safeguards against likely update issues that have been identified by Microsoft machine-learning algorithms and automatically hold the deployment for any affected devices.
|
||||
|
||||
The service is privacy focused and backed by leading industry compliance certifications.
|
||||
|
||||
@ -52,7 +53,6 @@ Using the deployment service typically follows a common pattern:
|
||||
2. The chosen tool conveys your approval, scheduling, and device selection information to the deployment service.
|
||||
3. The deployment service processes the content approval and compares it with previously approved content. Final update applicability is determined and conveyed to Windows Update, which then offers approved content to devices on their next check for updates.
|
||||
|
||||
|
||||
The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as Microsoft Endpoint Manager.
|
||||
|
||||
## Prerequisites
|
||||
@ -74,7 +74,6 @@ Additionally, your organization must have one of the following subscriptions:
|
||||
- Windows Virtual Desktop Access E3 or E5
|
||||
- Microsoft 365 Business Premium
|
||||
|
||||
|
||||
## Getting started
|
||||
|
||||
To use the deployment service, you use a management tool built on the platform, script common actions using PowerShell, or build your own application.
|
||||
@ -87,7 +86,6 @@ Microsoft Endpoint Manager integrates with the deployment service to provide Win
|
||||
|
||||
The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started).
|
||||
|
||||
|
||||
### Building your own application
|
||||
|
||||
Microsoft Graph makes deployment service APIs available through. Get started with these learning paths:
|
||||
@ -113,14 +111,19 @@ This built-in piloting capability complements your existing ring structure and p
|
||||
|
||||
You should continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and additional protections within each ring.
|
||||
|
||||
### Safeguard holds against likely and known issues
|
||||
|
||||
Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out.
|
||||
|
||||
To verify whether a device is affected by a safeguard hold, see [Am I affected by a safeguard hold?](/windows/deployment/update/safeguard-holds#am-i-affected-by-a-safeguard-hold)
|
||||
|
||||
### Monitoring deployments to detect rollback issues
|
||||
|
||||
During deployments of Windows 11 or Windows 10 feature updates, driver combinations can sometimes result in an unexpected update failure that makes the device revert to the previously installed operating system version. The deployment service can monitor devices for such issues and automatically pause deployments when this happens, giving you time to detect and mitigate issues.
|
||||
|
||||
|
||||
### How to enable deployment protections
|
||||
|
||||
Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your organization, devices must share diagnostic data with Microsoft.
|
||||
Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your population, devices must share diagnostic data with Microsoft.
|
||||
|
||||
#### Device prerequisites
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 27 KiB |
@ -17,27 +17,27 @@ ms.topic: article
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
|
||||
Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
|
||||
|
||||
Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows client.
|
||||
|
||||
The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices.
|
||||
The lifespan of safeguard holds varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update will resume offering new operating system versions to devices.
|
||||
|
||||
Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments.
|
||||
Safeguard holds only affect devices that use the Windows Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments.
|
||||
|
||||
IT admins managing updates using the [Windows Update for Business deployment service](/windows/deployment/update/deployment-service-overview) also benefit from safeguard holds on devices that are likely to be affected by an issue. To learn more, see [Safeguard holds against likely and known issues](/windows/deployment/update/deployment-service-overview#safeguard-holds-against-likely-and-known-issues).
|
||||
|
||||
## Am I affected by a safeguard hold?
|
||||
|
||||
IT admins can use [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) to monitor various update health metrics for devices in their organization, including ones affected by a safeguard hold that prevents them from updating to a newer operating system version.
|
||||
IT admins can use [Update Compliance](update-compliance-monitor.md) to monitor various update health metrics for devices in their organization. Update Compliance provides a [Safeguard Holds report](/windows/deployment/update/update-compliance-safeguard-holds), as well as [queries in the Feature Update Status report](/windows/deployment/update/update-compliance-feature-update-status), to provide you insight into the safeguard holds that are preventing devices from updating or upgrading.
|
||||
|
||||
Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the [Windows release health](/windows/release-health/) dashboard, where you can easily find information related to publicly available safeguards.
|
||||
The Update Compliance reports identify safeguard holds by their 8-digit identifiers. For safeguard holds associated with publicly discussed known issues, you can find additional details about the issue on the [Windows release health](/windows/release-health/) dashboard by searching for the safeguard hold ID on the **Known issues** page for the relevant release.
|
||||
|
||||
On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message:
|
||||
|
||||
|
||||
|
||||
|
||||
If you see this message, it means one or more holds affect your device. When the issue is fixed and the update is safe to install, we’ll release the hold and the update can resume safely.
|
||||
This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we will release the safeguard hold and the update can resume safely.
|
||||
|
||||
## What can I do?
|
||||
|
||||
@ -46,4 +46,4 @@ We recommend that you do not attempt to manually update until issues have been r
|
||||
> [!CAUTION]
|
||||
> Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out.
|
||||
|
||||
With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows release health](/windows/release-health/) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, the protection of safeguard holds is reinstated automatically.
|
||||
With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows release health](/windows/release-health/) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, the protection of safeguard holds is reinstated automatically.
|
||||
|
||||
@ -43,18 +43,21 @@ Refer to the following list for what each state means:
|
||||
|
||||
## Safeguard holds
|
||||
|
||||
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
|
||||
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Safeguard holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
|
||||
|
||||
### Queries for safeguard holds
|
||||
|
||||
Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included.
|
||||
> [!TIP]
|
||||
> For a new Update Compliance report with additional information on safeguard holds, try the [Safeguard Holds report](/windows/deployment/update/update-compliance-safeguard-holds).
|
||||
|
||||
The Feature Update Status report offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included.
|
||||
|
||||
The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build.
|
||||
|
||||
|
||||
|
||||
Update Compliance reporting will display the Safeguard IDs for known issues affecting a device in the **DeploymentErrorCode** column. Safeguard IDs for publicly discussed known issues are also included in the Windows Release Health dashboard, where you can easily find information related to publicly available safeguards.
|
||||
Update Compliance reporting will display the safeguard hold IDs for known issues affecting a device in the **DeploymentErrorCode** column. Safeguard hold IDs for publicly discussed known issues are also included in the Windows Release Health dashboard, where you can easily find information related to publicly available safeguards.
|
||||
|
||||
### Opt out of safeguard hold
|
||||
### Opt out of safeguard holds
|
||||
|
||||
You can [opt out of safeguard protections](safeguard-opt-out.md) by using the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update.
|
||||
You can [opt out of safeguard holds](safeguard-opt-out.md) protecting against known issues by using the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update.
|
||||
|
||||
@ -0,0 +1,61 @@
|
||||
---
|
||||
title: Update Compliance - Safeguard Holds report
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description: Learn how the Safeguard Holds report provides information about safeguard holds in your population.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.author: jaimeo
|
||||
ms.collection: M365-analytics
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
---
|
||||
|
||||
# Safeguard Holds
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
The Safeguard Holds report provides information about devices in your population that are affected by a [safeguard hold](/windows/deployment/update/safeguard-holds).
|
||||
|
||||
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Safeguard holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
|
||||
|
||||
Update Compliance provides two views into the safeguard holds that apply to devices in your population. The report shows data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included.
|
||||
|
||||
The safeguard hold report can be found in a different location from the other Update Compliance reports. To access the safeguard hold report, follow the instructions below.
|
||||
|
||||
1. Navigate to your Log Analytics workspace to which Update Compliance is deployed.
|
||||
2. In the left-hand menu, select **Solutions**.
|
||||
3. Select the solution named **WaaSUpdateInsights(\<your workspace name\>)**. (This summary page is also where the Update Compliance tile is located.)
|
||||
4. In the left-hand menu, select **Workbooks**.
|
||||
5. Under the subsection **WaaSUpdateInsights**, select the workbook named **Safeguard Holds**.
|
||||
|
||||
## Safeguard hold view
|
||||
|
||||
|
||||
|
||||
The safeguard hold view shows which safeguard holds apply to devices in your population, and how many devices are affected by each safeguard hold. You can use the **Safeguard hold ID(s)** dropdown at the top of the report to filter the chart and corresponding table to show only the selected safeguard hold IDs. Note that a device can be affected by more than one safeguard hold.
|
||||
|
||||
## Device view
|
||||
|
||||
|
||||
|
||||
The device view shows which devices are affected by safeguard holds. In the **Safeguard Hold IDs** column of the table, you can find a list of the safeguard holds that apply to each device. You can also use the **Safeguard hold ID(s)** dropdown at the top of the report to filter the table to show only devices affected by the selected safeguard hold IDs.
|
||||
|
||||
## Getting additional information about a safeguard hold
|
||||
|
||||
For safeguard holds protecting devices against publicly discussed known issues, you can find their 8-digit identifier on the [Windows release health](/windows/release-health/) page under **Known issues** corresponding to the relevant release.
|
||||
|
||||
Devices managed by the [Windows Update for Business deployment service](/windows/deployment/update/deployment-service-overview) that are affected by a safeguard hold for a likely issue are listed in the report with the safeguard hold ID value **00000001**.
|
||||
|
||||
## Opt out of safeguard holds
|
||||
|
||||
To opt out of safeguard holds protecting against known issues, see [Opt out of safeguard holds](/windows/deployment/update/safeguard-opt-out).
|
||||
|
||||
To opt out of safeguard holds protecting against likely issues (applicable to devices managed by the deployment service), see [Manage safeguards for a feature update deployment using the Windows Update for Business deployment service](/graph/windowsupdates-manage-safeguards).
|
||||
@ -158,7 +158,7 @@ In the Group Policy editor, you will see a number of policy settings that pertai
|
||||
| Turn off auto-restart for updates during active hours |  | Use this policy to configure active hours, during which the device will not be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. |
|
||||
| Always automatically restart at the scheduled time |  | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. |
|
||||
| Specify deadline before auto-restart for update installation |  | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. |
|
||||
| No auto-restart with logged on users for scheduled automatic updates installations |  | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates. <br>There is no equivalent MDM policy setting for Windows 10 Mobile. |
|
||||
| No auto-restart with logged on users for scheduled automatic updates installations |  | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates. |
|
||||
| Re-prompt for restart with scheduled installations |  | |
|
||||
| Delay Restart for scheduled installations |  | |
|
||||
| Reschedule Automatic Updates scheduled installations |  | |
|
||||
|
||||
@ -12,7 +12,7 @@ manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/23/2021
|
||||
ms.date: 11/02/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
@ -389,7 +389,7 @@ The registry keys for the smart card KSP are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\
|
||||
| **AllowPrivateSignatureKeyImport** | A non-zero value allows RSA signature private keys to be imported for use in key archival scenarios.<br>Default value: 00000000 |
|
||||
| **DefaultPrivateKeyLenBits** | Defines the default length for private keys, if desired.<br>Default value: 00000400<br>Default key generation parameter: 1024-bit keys |
|
||||
| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that don't support on-card key generation or where key escrow is required.<br>Default value: 00000000 |
|
||||
| **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.<br>Default value: 000005dc1500<br>The default timeout for holding transactions to the smart card is 1.5 seconds. |
|
||||
| **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.<br>Default value: 000005dc<br>The default timeout for holding transactions to the smart card is 1.5 seconds. |
|
||||
|
||||
**Additional registry keys for the smart card KSP**
|
||||
|
||||
|
||||
@ -32,9 +32,9 @@ ms.technology: windows-sec
|
||||
|
||||
The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities:
|
||||
<ul>
|
||||
<li>[Configuring policy rules](#configuring-policy-rules)</li>
|
||||
<li>[Adding new allow or block file rules to existing policies](#adding-file-rules)</li>
|
||||
<li>[Removing allow or block file rules on existing policies](#removing-file-rules)</li>
|
||||
<li><a href="#configuring-policy-rules">Configuring policy rules</a></li>
|
||||
<li><a href="#adding-file-rules">Adding new allow or block file rules to existing policies</a></li>
|
||||
<li><a href="#removing-file-rules">Removing allow or block file rules on existing policies</a></li>
|
||||
</ul>
|
||||
|
||||
## Configuring Policy Rules
|
||||
|
||||
@ -42,7 +42,7 @@ Because Windows Sandbox runs the same operating system image as the host, it has
|
||||
|
||||
## Integrated kernel scheduler
|
||||
|
||||
With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles.
|
||||
With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles.
|
||||
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user