deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

CSP improvement-part 4

Browse Source 
This PR contains updates from Policy-CSP and Admx backed Policy article updates. The updates are mostly improvements. Thanks!
This commit is contained in:
Alekhya Jupudi 2022-04-22 10:47:26 +05:30
parent f6fe3a722e
commit 189020cf4d
25 changed files with 266 additions and 214 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
View File

@ -1,6 +1,6 @@
--- ---
title: ADMX-backed policies in Policy CSP title: ADMX-backed policies in Policy CSP
description: ADMX-backed policies in Policy CSP description: Learn about the ADMX-backed policies in Policy CSP.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP supported by Group Policy title: Policies in Policy CSP supported by Group Policy
description: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite title: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite
description: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite description: Learn the policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition title: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition
description: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition description: Learn about the policies in Policy CSP supported by HoloLens (1st gen) Development Edition.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP supported by HoloLens 2 title: Policies in Policy CSP supported by HoloLens 2
description: Policies in Policy CSP supported by HoloLens 2 description: Learn about the policies in Policy CSP supported by HoloLens 2.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP supported by Windows 10 IoT Core title: Policies in Policy CSP supported by Windows 10 IoT Core
description: Policies in Policy CSP supported by Windows 10 IoT Core description: Learn about the policies in Policy CSP supported by Windows 10 IoT Core.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP supported by Microsoft Surface Hub title: Policies in Policy CSP supported by Microsoft Surface Hub
description: Policies in Policy CSP supported by Microsoft Surface Hub description: Learn about the policies in Policy CSP supported by Microsoft Surface Hub.
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

2
windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) title: Policies in Policy CSP that can be set using Exchange Active Sync (EAS)
description: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) description: Learn about the policies in Policy CSP that can be set using Exchange Active Sync (EAS).
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
ms.author: dansimp ms.author: dansimp

65
windows/client-management/mdm/policy-configuration-service-provider.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP title: Policy CSP
description: Learn how the Policy configuration service provider (CSP) enables the enterprise to configure policies on Windows 10. description: Learn how the Policy configuration service provider (CSP) enables the enterprise to configure policies on Windows 10 and Windows 11.
ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F
ms.reviewer: ms.reviewer:
manager: dansimp manager: dansimp
@ -16,7 +16,7 @@ ms.collection: highpri
# Policy CSP # Policy CSP
The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 11. Use this configuration service provider to configure any company policies.
The Policy configuration service provider has the following sub-categories: The Policy configuration service provider has the following sub-categories:
@ -31,10 +31,12 @@ The Policy configuration service provider has the following sub-categories:
> The allowed scope of a specific policy is represented below its table of supported Windows editions. To configure a policy under a specific scope (user vs. device), please use the following paths: > The allowed scope of a specific policy is represented below its table of supported Windows editions. To configure a policy under a specific scope (user vs. device), please use the following paths:
> >
> User scope: > User scope:
>
> - **./User/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. > - **./User/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy.
> - **./User/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. > - **./User/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result.
> >
> Device scope: > Device scope:
>
> - **./Device/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. > - **./Device/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy.
> - **./Device/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. > - **./Device/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result.
> >
@ -65,24 +67,24 @@ Policy
<a href="" id="--vendor-msft-policy"></a>**./Vendor/MSFT/Policy** <a href="" id="--vendor-msft-policy"></a>**./Vendor/MSFT/Policy**
<p>The root node for the Policy configuration service provider. The root node for the Policy configuration service provider.
<p>Supported operation is Get. Supported operation is Get.
<a href="" id="policy-config"></a>**Policy/Config** <a href="" id="policy-config"></a>**Policy/Config**
<p>Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value,) the configuration source can use the Policy/Result path to retrieve the resulting value. Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value,) the configuration source can use the Policy/Result path to retrieve the resulting value.
<p>Supported operation is Get. Supported operation is Get.
<a href="" id="policy-config-areaname"></a>**Policy/Config/_AreaName_** <a href="" id="policy-config-areaname"></a>**Policy/Config/_AreaName_**
<p>The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value. The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value.
<p>Supported operations are Add, Get, and Delete. Supported operations are Add, Get, and Delete.
<a href="" id="policy-config-areaname-policyname"></a>**Policy/Config/_AreaName/PolicyName_** <a href="" id="policy-config-areaname-policyname"></a>**Policy/Config/_AreaName/PolicyName_**
<p>Specifies the name/value pair used in the policy. Specifies the name/value pair used in the policy.
<p>The following list shows some tips to help you when configuring policies: The following list shows some tips to help you when configuring policies:
- Separate substring values by the Unicode &\#xF000; in the XML file. - Separate substring values by the Unicode &\#xF000; in the XML file.
@ -94,60 +96,59 @@ Policy
- Value type is string. - Value type is string.
<a href="" id="policy-result"></a>**Policy/Result** <a href="" id="policy-result"></a>**Policy/Result**
<p>Groups the evaluated policies from all providers that can be configured. Groups the evaluated policies from all providers that can be configured.
<p>Supported operation is Get. Supported operation is Get.
<a href="" id="policy-result-areaname"></a>**Policy/Result/_AreaName_** <a href="" id="policy-result-areaname"></a>**Policy/Result/_AreaName_**
<p>The area group that can be configured by a single technology independent of the providers. The area group that can be configured by a single technology independent of the providers.
<p>Supported operation is Get. Supported operation is Get.
<a href="" id="policy-result-areaname-policyname"></a>**Policy/Result/_AreaName/PolicyName_** <a href="" id="policy-result-areaname-policyname"></a>**Policy/Result/_AreaName/PolicyName_**
<p>Specifies the name/value pair used in the policy. Specifies the name/value pair used in the policy.
<p>Supported operation is Get. Supported operation is Get.
<a href="" id="policy-result"></a>**Policy/ConfigOperations** <a href="" id="policy-result"></a>**Policy/ConfigOperations**
<p>Added in Windows 10, version 1703. The root node for grouping different configuration operations. Added in Windows 10, version 1703. The root node for grouping different configuration operations.
<p>Supported operations are Add, Get, and Delete. Supported operations are Add, Get, and Delete.
<a href="" id="policy-configoperations-admxinstall"></a>**Policy/ConfigOperations/ADMXInstall** <a href="" id="policy-configoperations-admxinstall"></a>**Policy/ConfigOperations/ADMXInstall**
<p>Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: <code>./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall</code>. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see <a href="win32-and-centennial-app-policy-configuration.md" data-raw-source="[Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md)">Win32 and Desktop Bridge app policy configuration</a>. Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: <code>./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall</code>. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md).
> [!NOTE] > [!NOTE]
> The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](/previous-versions/office/office-2013-resource-kit/cc179097(v=office.15)). > The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](/previous-versions/office/office-2013-resource-kit/cc179097(v=office.15)).
<p>ADMX files that have been installed by using **ConfigOperations/ADMXInstall** can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, <code>./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}</code>. ADMX files that have been installed by using **ConfigOperations/ADMXInstall** can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, <code>./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}</code>.
<p>Supported operations are Add, Get, and Delete. Supported operations are Add, Get, and Delete.
<a href="" id="policy-configoperations-admxinstall-appname"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_** <a href="" id="policy-configoperations-admxinstall-appname"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_**
<p>Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file. Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file.
<p>Supported operations are Add, Get, and Delete. Supported operations are Add, Get, and Delete.
<a href="" id="policy-configoperations-admxinstall-appname-policy"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Policy** <a href="" id="policy-configoperations-admxinstall-appname-policy"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Policy**
<p>Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported. Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported.
<p>Supported operations are Add, Get, and Delete. Supported operations are Add, Get, and Delete.
<a href="" id="policy-configoperations-admxinstall-appname-policy-uniqueid"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Policy/_UniqueID_** <a href="" id="policy-configoperations-admxinstall-appname-policy-uniqueid"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Policy/_UniqueID_**
<p>Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the policy to import. Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the policy to import.
<p>Supported operations are Add and Get. Does not support Delete. Supported operations are Add and Get. Does not support Delete.
<a href="" id="policy-configoperations-admxinstall-appname-preference"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Preference** <a href="" id="policy-configoperations-admxinstall-appname-preference"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Preference**
<p>Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported. Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported.
<p>Supported operations are Add, Get, and Delete. Supported operations are Add, Get, and Delete.
<a href="" id="policy-configoperations-admxinstall-appname-preference-uniqueid"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Preference/_UniqueID_** <a href="" id="policy-configoperations-admxinstall-appname-preference-uniqueid"></a>**Policy/ConfigOperations/ADMXInstall/_AppName_/Preference/_UniqueID_**
<p>Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the preference to import. Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the preference to import.
<p>Supported operations are Add and Get. Does not support Delete.
Supported operations are Add and Get. Does not support Delete.
## Policies ## Policies

5
windows/client-management/mdm/policy-csp-abovelock.md
View File

@ -14,8 +14,6 @@ manager: dansimp
# Policy CSP - AboveLock # Policy CSP - AboveLock
<hr/> <hr/>
<!--Policies--> <!--Policies-->
@ -123,3 +121,6 @@ The following list shows the supported values:
<!--/Policies--> <!--/Policies-->
## Related topics
[Policy CSP](policy-configuration-service-provider.md)

6
windows/client-management/mdm/policy-csp-accounts.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - Accounts title: Policy CSP - Accounts
description: Learn about the Policy configuration service provider (CSP). This articles describes account policies. description: Learn about the Accounts policy configuration service provider (CSP). This article describes account policies.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -170,3 +170,7 @@ The following list shows the supported values:
<!--/Policies--> <!--/Policies-->
## Related topics
[Policy CSP](policy-configuration-service-provider.md)

6
windows/client-management/mdm/policy-csp-activexcontrols.md
View File

@ -67,7 +67,8 @@ If you enable this setting, the administrator can create a list of approved Acti
If you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation. If you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation.
Note: Wild card characters cannot be used when specifying the host URLs. >[!Note]
> Wild card characters cannot be used when specifying the host URLs.
<!--/Description--> <!--/Description-->
@ -85,3 +86,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

5
windows/client-management/mdm/policy-csp-admx-activexinstallservice.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_ActiveXInstallService title: Policy CSP - ADMX_ActiveXInstallService
description: Policy CSP - ADMX_ActiveXInstallService description: Learn about the Policy CSP - ADMX_ActiveXInstallService.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -89,3 +89,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

39
windows/client-management/mdm/policy-csp-admx-addremoveprograms.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_AddRemovePrograms title: Policy CSP - ADMX_AddRemovePrograms
description: Policy CSP - ADMX_AddRemovePrograms description: Learn about the Policy CSP - ADMX_AddRemovePrograms.
ms.author: dansimp ms.author: dansimp
ms.topic: article ms.topic: article
ms.prod: w10 ms.prod: w10
@ -93,7 +93,7 @@ The policy setting specifies the category of programs that appears when users op
To use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or Remove Programs. To define a category, use Software Installation. To use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or Remove Programs. To define a category, use Software Installation.
If you disable this setting or do not configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens. You can use this setting to direct users to the programs they are most likely to need. If you disable this setting or don't configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens. You can use this setting to direct users to the programs they're most likely to need.
> [!NOTE] > [!NOTE]
> This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled. > This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled.
@ -150,7 +150,7 @@ ADMX Info:
This policy setting removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media. This policy setting removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media.
If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. This setting does not prevent users from using other tools and methods to add or remove program components. If you disable this setting or don't configure it, the "Add a program from CD-ROM or floppy disk" option will be available to all users. This setting doesn't prevent users from using other tools and methods to add or remove program components.
> [!NOTE] > [!NOTE]
> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows Installer) is enabled, users cannot add programs from removable media, regardless of this setting. > If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows Installer) is enabled, users cannot add programs from removable media, regardless of this setting.
@ -207,7 +207,7 @@ ADMX Info:
This policy setting removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update. This policy setting removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update.
If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. This setting does not prevent users from using other tools and methods to connect to Windows Update. If you disable this setting or don't configure it, "Add programs from Microsoft" is available to all users. This setting doesn't prevent users from using other tools and methods to connect to Windows Update.
> [!NOTE] > [!NOTE]
> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. > If the "Hide Add New Programs page" setting is enabled, this setting is ignored.
@ -265,9 +265,9 @@ ADMX Info:
This policy setting prevents users from viewing or installing published programs. This setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them. Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files. This policy setting prevents users from viewing or installing published programs. This setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them. Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files.
If you enable this setting, users cannot tell which programs have been published by the system administrator, and they cannot use Add or Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu. If you enable this setting, users can't tell which programs have been published by the system administrator, and they can't use Add or Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu.
If you disable this setting or do not configure it, "Add programs from your network" is available to all users. If you disable this setting or don't configure it, "Add programs from your network" is available to all users.
> [!NOTE] > [!NOTE]
> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. > If the "Hide Add New Programs page" setting is enabled, this setting is ignored.
@ -322,9 +322,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Add New Programs button lets users install programs published or assigned by a system administrator. This policy setting removes the Add New Programs button from the Add or Remove Programs bar. As a result, users can't view or change the attached page. The Add New Programs button lets users install programs published or assigned by a system administrator.
If you disable this setting or do not configure it, the Add New Programs button is available to all users. This setting does not prevent users from using other tools and methods to install programs. If you disable this setting or don't configure it, the Add New Programs button will be available to all users. This setting doesn't prevent users from using other tools and methods to install programs.
<!--/Description--> <!--/Description-->
@ -379,7 +379,7 @@ ADMX Info:
This policy setting prevents users from using Add or Remove Programs. This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus. Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs. This policy setting prevents users from using Add or Remove Programs. This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus. Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs.
If you disable this setting or do not configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. This setting does not prevent users from using other tools and methods to install or uninstall programs. If you disable this setting or don't configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. This setting doesn't prevent users from using other tools and methods to install or uninstall programs.
<!--/Description--> <!--/Description-->
@ -432,9 +432,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. This policy setting removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users can't view or change the associated page. The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations.
If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. This setting does not prevent the Set Program Access and Defaults icon from appearing on the Start menu. See the "Remove Set Program Access and Defaults from Start menu" setting. If you disable this setting or don't configure it, the Set Program Access and Defaults button is available to all users. This setting doesn't prevent users from using other tools and methods to change program access or defaults. This setting doesn't prevent the Set Program Access and Defaults icon from appearing on the Start menu. See the "Remove Set Program Access and Defaults from Start menu" setting.
<!--/Description--> <!--/Description-->
@ -488,9 +488,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs. This policy setting removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users can't view or change the attached page. The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs.
If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. This setting does not prevent users from using other tools and methods to delete or uninstall programs. If you disable this setting or don't configure it, the Change or Remove Programs page is available to all users. This setting doesn't prevent users from using other tools and methods to delete or uninstall programs.
<!--/Description--> <!--/Description-->
@ -543,9 +543,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting prevents users from using Add or Remove Programs to configure installed services. This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools. This policy setting prevents users from using Add or Remove Programs to configure installed services. This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that haven't been configured and offers users easy access to the configuration tools.
If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears. This setting does not prevent users from using other methods to configure services. If you disable this setting or don't configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears. This setting doesn't prevent users from using other methods to configure services.
> [!NOTE] > [!NOTE]
> When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed. To remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored. > When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed. To remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored.
@ -603,7 +603,7 @@ ADMX Info:
This policy setting removes links to the Support Info dialog box from programs on the Change or Remove Programs page. Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page. This policy setting removes links to the Support Info dialog box from programs on the Change or Remove Programs page. Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page.
If you disable this setting or do not configure it, the Support Info hyperlink appears. If you disable this setting or don't configure it, the Support Info hyperlink appears.
> [!NOTE] > [!NOTE]
> Not all programs provide a support information hyperlink. > Not all programs provide a support information hyperlink.
@ -658,9 +658,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files. This policy setting removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users can't view or change the associated page. The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files.
If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. If you disable this setting or don't configure it, the Add/Remove Windows Components button is available to all users. This setting doesn't prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard.
<!--/Description--> <!--/Description-->
@ -687,3 +687,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

9
windows/client-management/mdm/policy-csp-admx-admpwd.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_AdmPwd title: Policy CSP - ADMX_AdmPwd
description: Policy CSP - ADMX_AdmPwd description: Learn about the Policy CSP - ADMX_AdmPwd.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -73,7 +73,7 @@ manager: dansimp
When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy. When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy.
When you disable or not configure this setting, password expiration time may be longer than required by "Password Settings" policy. When you disable or don't configure this setting, password expiration time may be longer than required by "Password Settings" policy.
<!--/Description--> <!--/Description-->
<!--ADMXBacked--> <!--ADMXBacked-->
@ -160,7 +160,7 @@ ADMX Info:
When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy. When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy.
When you disable or not configure this setting, password expiration time may be longer than required by "Password Settings" policy. When you disable or don't configure this setting, password expiration time may be longer than required by "Password Settings" policy.
<!--/Description--> <!--/Description-->
<!--ADMXBacked--> <!--ADMXBacked-->
@ -225,3 +225,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

33
windows/client-management/mdm/policy-csp-admx-appcompat.md
View File

@ -98,7 +98,7 @@ This policy setting specifies whether to prevent the MS-DOS subsystem (**ntvdm.e
You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, **ntvdm.exe** must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased. You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, **ntvdm.exe** must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased.
If the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run. If the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components can't run.
If the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer. If the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer.
@ -151,7 +151,7 @@ This policy setting controls the visibility of the Program Compatibility propert
The compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications. The compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications.
Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface. Enabling this policy setting removes the property page from the context-menus, but doesn't affect previous compatibility settings applied to application using this interface.
<!--/Description--> <!--/Description-->
@ -247,13 +247,13 @@ ADMX Info:
<!--Description--> <!--Description-->
The policy setting controls the state of the Switchback compatibility engine in the system. The policy setting controls the state of the Switchback compatibility engine in the system.
Switchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications. Switchback is a mechanism that provides generic compatibility mitigation to older applications by providing older behavior to old applications and new behavior to new applications.
Switchback is on by default. Switchback is on by default.
If you enable this policy setting, Switchback will be turned off. Turning Switchback off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using. If you enable this policy setting, Switchback will be turned off. Turning off Switchback may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they're using.
If you disable or do not configure this policy setting, the Switchback will be turned on. If you disable or don't configure this policy setting, the Switchback will be turned on.
Reboot the system after changing the setting to ensure that your system accurately reflects those changes. Reboot the system after changing the setting to ensure that your system accurately reflects those changes.
<!--/Description--> <!--/Description-->
@ -298,13 +298,13 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting controls the state of the application compatibility engine in the system. This policy setting controls the state of the application compatibility engine in the system.
The engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem. The engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a known problem.
Turning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing. For example, this may result in a blue screen if an old anti-virus application is installed. Turning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and won't block known incompatible applications from installing. For example, this may result in a blue screen if an old anti-virus application is installed.
The Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly. The Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations won't be applied to applications and their installers and these applications may fail to install or run properly.
This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential. This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they're using. It's particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential.
> [!NOTE] > [!NOTE]
> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, reboot to ensure that your system accurately reflects those changes. > Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, reboot to ensure that your system accurately reflects those changes.
@ -350,7 +350,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\Administrative Templates\Windows Components\Application Compatibility. This policy setting exists only for backward compatibility, and isn't valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\Administrative Templates\Windows Components\Application Compatibility.
<!--/Description--> <!--/Description-->
@ -395,9 +395,9 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting controls the state of the Program Compatibility Assistant (PCA). The PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. This policy setting controls the state of the Program Compatibility Assistant (PCA). The PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics.
If you enable this policy setting, the PCA will be turned off. The user will not be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues. If you enable this policy setting, the PCA will be turned off. The user won't be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues.
If you disable or do not configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. If you disable or don't configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics.
> [!NOTE] > [!NOTE]
> The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console. > The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console.
@ -449,7 +449,7 @@ Steps Recorder keeps a record of steps taken by the user. The data generated by
If you enable this policy setting, Steps Recorder will be disabled. If you enable this policy setting, Steps Recorder will be disabled.
If you disable or do not configure this policy setting, Steps Recorder will be enabled. If you disable or don't configure this policy setting, Steps Recorder will be enabled.
<!--/Description--> <!--/Description-->
@ -496,9 +496,9 @@ This policy setting controls the state of the Inventory Collector.
The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems. The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems.
If you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled. If you enable this policy setting, the Inventory Collector will be turned off and data won't be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled.
If you disable or do not configure this policy setting, the Inventory Collector will be turned on. If you disable or don't configure this policy setting, the Inventory Collector will be turned on.
> [!NOTE] > [!NOTE]
> This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off. > This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off.
@ -519,3 +519,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

18
windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_AppxPackageManager title: Policy CSP - ADMX_AppxPackageManager
description: Policy CSP - ADMX_AppxPackageManager description: Learn about the Policy CSP - ADMX_AppxPackageManager.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -63,16 +63,16 @@ manager: dansimp
<!--Description--> <!--Description-->
This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile.
Special profiles are the following user profiles, where changes are discarded after the user signs off: Special profiles are the following user profiles where changes are discarded after the user signs off:
- Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies - Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies.
- Mandatory user profiles and super-mandatory profiles, which are created by an administrator - Mandatory user profiles and super-mandatory profiles, which are created by an administrator.
- Temporary user profiles, which are created when an error prevents the correct profile from loading - Temporary user profiles, which are created when an error prevents the correct profile from loading.
- User profiles for the Guest account and members of the Guests group - User profiles for the Guest account and members of the Guests group.
If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile. If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile.
If you disable or do not configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile. If you disable or don't configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile.
<!--/Description--> <!--/Description-->
@ -90,3 +90,7 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

23
windows/client-management/mdm/policy-csp-admx-appxruntime.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_AppXRuntime title: Policy CSP - ADMX_AppXRuntime
description: Policy CSP - ADMX_AppXRuntime description: Learn about the Policy CSP - ADMX_AppXRuntime.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -72,7 +72,7 @@ manager: dansimp
<!--Description--> <!--Description-->
This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer. This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer.
If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use. If you enable this policy setting, you can define more Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use.
If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules. If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules.
@ -117,11 +117,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type. This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there's a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type.
If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps. If you enable this policy setting, Windows Store apps can't open files in the default desktop app for a file type; they can open files only in other Windows Store apps.
If you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type. If you disable or don't configure this policy setting, Windows Store apps can open files in the default desktop app for a file type.
<!--/Description--> <!--/Description-->
@ -164,9 +164,9 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched. This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched.
If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected. If you enable this policy setting, Universal Windows apps that declare Windows Runtime API access in ApplicationContentUriRules section of the manifest can't be launched; Universal Windows apps that haven't declared Windows Runtime API access in the manifest aren't affected.
If you disable or do not configure this policy setting, all Universal Windows apps can be launched. If you disable or don't configure this policy setting, all Universal Windows apps can be launched.
> [!WARNING] > [!WARNING]
> This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues. > This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.
@ -211,11 +211,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app. This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there's a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app.
If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps. If you enable this policy setting, Windows Store apps can't open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps.
If you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme. If you disable or don't configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme.
> [!NOTE] > [!NOTE]
> Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk. > Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.
@ -236,3 +236,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

29
windows/client-management/mdm/policy-csp-admx-attachmentmanager.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_AttachmentManager title: Policy CSP - ADMX_AttachmentManager
description: Policy CSP - ADMX_AttachmentManager description: Learn about the Policy CSP - ADMX_AttachmentManager.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -77,13 +77,13 @@ This policy setting allows you to configure the logic that Windows uses to deter
Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files. Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files.
Preferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler. Using both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation which will cause users to see more trust prompts than choosing the other options. Preferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler. Using both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation that will cause users to see more trust prompts than choosing the other options.
If you enable this policy setting, you can choose the order in which Windows processes risk assessment data. If you enable this policy setting, you can choose the order in which Windows processes risk assessment data.
If you disable this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type. If you disable this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type.
If you do not configure this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type. If you don't configure this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type.
<!--/Description--> <!--/Description-->
@ -126,17 +126,15 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments. This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments.
High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. - High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file.
- Moderate Risk: If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file.
Moderate Risk: If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. - Low Risk: If the attachment is in the list of low-risk file types, Windows won't prompt the user before accessing the file, regardless of the file's zone information.
Low Risk: If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information.
If you enable this policy setting, you can specify the default risk level for file types. If you enable this policy setting, you can specify the default risk level for file types.
If you disable this policy setting, Windows sets the default risk level to moderate. If you disable this policy setting, Windows sets the default risk level to moderate.
If you do not configure this policy setting, Windows sets the default risk level to moderate. If you don't configure this policy setting, Windows sets the default risk level to moderate.
<!--/Description--> <!--/Description-->
@ -183,7 +181,7 @@ If you enable this policy setting, you can create a custom list of high-risk fil
If you disable this policy setting, Windows uses its built-in list of file types that pose a high risk. If you disable this policy setting, Windows uses its built-in list of file types that pose a high risk.
If you do not configure this policy setting, Windows uses its built-in list of high-risk file types. If you don't configure this policy setting, Windows uses its built-in list of high-risk file types.
<!--/Description--> <!--/Description-->
@ -224,13 +222,13 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list). This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows won't prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list).
If you enable this policy setting, you can specify file types that pose a low risk. If you enable this policy setting, you can specify file types that pose a low risk.
If you disable this policy setting, Windows uses its default trust logic. If you disable this policy setting, Windows uses its default trust logic.
If you do not configure this policy setting, Windows uses its default trust logic. If you don't configure this policy setting, Windows uses its default trust logic.
<!--/Description--> <!--/Description-->
@ -273,11 +271,11 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list). This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list).
If you enable this policy setting, you can specify file types which pose a moderate risk. If you enable this policy setting, you can specify file types that pose a moderate risk.
If you disable this policy setting, Windows uses its default trust logic. If you disable this policy setting, Windows uses its default trust logic.
If you do not configure this policy setting, Windows uses its default trust logic. If you don't configure this policy setting, Windows uses its default trust logic.
<!--/Description--> <!--/Description-->
@ -294,3 +292,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

7
windows/client-management/mdm/policy-csp-admx-auditsettings.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_AuditSettings title: Policy CSP - ADMX_AuditSettings
description: Policy CSP - ADMX_AuditSettings description: Learn about the Policy CSP - ADMX_AuditSettings.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -65,7 +65,7 @@ This policy setting determines what information is logged in security audit even
If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied.
If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. If you disable or don't configure this policy setting, the process's command line information will not be included in Audit Process Creation events.
Default is Not configured. Default is Not configured.
@ -88,3 +88,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

47
windows/client-management/mdm/policy-csp-admx-bits.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_Bits title: Policy CSP - ADMX_Bits
description: Policy CSP - ADMX_Bits description: Learn about the Policy CSP - ADMX_Bits.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -102,9 +102,9 @@ manager: dansimp
<!--Description--> <!--Description-->
This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default. This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default.
If you enable this policy setting, the BITS client does not use Windows Branch Cache. If you enable this policy setting, the BITS client doesn't use Windows Branch Cache.
If you disable or do not configure this policy setting, the BITS client uses Windows Branch Cache. If you disable or don't configure this policy setting, the BITS client uses Windows Branch Cache.
> [!NOTE] > [!NOTE]
> This policy setting does not affect the use of Windows Branch Cache by applications other than BITS. This policy setting does not apply to BITS transfers over SMB. This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely. > This policy setting does not affect the use of Windows Branch Cache by applications other than BITS. This policy setting does not apply to BITS transfers over SMB. This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely.
@ -152,7 +152,7 @@ This policy setting specifies whether the computer will act as a BITS peer cachi
If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers. If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers.
If you disable or do not configure this policy setting, the computer attempts to download peer-enabled BITS jobs from peer computers before reverting to the origin server. If you disable or don't configure this policy setting, the computer attempts to download peer-enabled BITS jobs from peer computers before reverting to the origin server.
> [!NOTE] > [!NOTE]
> This policy setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured. > This policy setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured.
@ -201,7 +201,7 @@ This policy setting specifies whether the computer will act as a BITS peer cachi
If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers. If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers.
If you disable or do not configure this policy setting, the computer will offer downloaded and cached files to its peers. If you disable or don't configure this policy setting, the computer will offer downloaded and cached files to its peers.
> [!NOTE] > [!NOTE]
> This setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured. > This setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured.
@ -251,9 +251,9 @@ This policy setting determines if the Background Intelligent Transfer Service (B
If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server. If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server.
If you enable this policy setting, BITS downloads files from peers, caches the files, and responds to content requests from peers. Using the "Do not allow the computer to act as a BITS peer caching server" and "Do not allow the computer to act as a BITS peer caching client" policy settings, it is possible to control BITS peer caching functionality at a more detailed level. However, it should be noted that the "Allow BITS peer caching" policy setting must be enabled for the other two policy settings to have any effect. If you enable this policy setting, BITS downloads files from peers, caches the files, and responds to content requests from peers. Using the "Do not allow the computer to act as a BITS peer caching server" and "Do not allow the computer to act as a BITS peer caching client" policy settings, it's possible to control BITS peer caching functionality at a more detailed level. However, it should be noted that the "Allow BITS peer caching" policy setting must be enabled for the other two policy settings to have any effect.
If you disable or do not configure this policy setting, the BITS peer caching feature will be disabled, and BITS will download files directly from the origin server. If you disable or don't configure this policy setting, the BITS peer caching feature will be disabled, and BITS will download files directly from the origin server.
<!--/Description--> <!--/Description-->
@ -296,15 +296,15 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server). This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting doesn't affect transfers from the origin server).
To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100 Mbps network card and a 56 Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps. To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100-Mbps network card and a 56-Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps.
You can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for peer caching. You can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for peer caching.
If you enable this policy setting, you can enter a value in bits per second (bps) between 1048576 and 4294967200 to use as the maximum network bandwidth used for peer caching. If you enable this policy setting, you can enter a value in bits per second (bps) between 1048576 and 4294967200 to use as the maximum network bandwidth used for peer caching.
If you disable this policy setting or do not configure it, the default value of 30 percent of the slowest active network interface will be used. If you disable this policy setting or don't configure it, the default value of 30 percent of the slowest active network interface will be used.
> [!NOTE] > [!NOTE]
> This setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured. > This setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured.
@ -354,7 +354,7 @@ If you enable this policy setting, you can define a separate set of network band
You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule. You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule.
If you disable or do not configure this policy setting, the limits defined for work or non-work schedules will be used. If you disable or don't configure this policy setting, the limits defined for work or non-work schedules will be used.
> [!NOTE] > [!NOTE]
> The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules. > The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules.
@ -399,13 +399,13 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that aren't defined in a work schedule are considered non-work hours.
If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and non-work hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low. If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and non-work hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low.
You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for non-work hours. You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for non-work hours.
If you disable or do not configure this policy setting, BITS uses all available unused bandwidth for background job transfers. If you disable or don't configure this policy setting, BITS uses all available unused bandwidth for background job transfers.
<!--/Description--> <!--/Description-->
@ -451,7 +451,7 @@ This policy setting limits the maximum amount of disk space that can be used for
If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent. If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent.
If you disable or do not configure this policy setting, the default size of the BITS peer cache is 1 percent of the total system disk size. If you disable or don't configure this policy setting, the default size of the BITS peer cache is 1 percent of the total system disk size.
> [!NOTE] > [!NOTE]
> This policy setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured. > This policy setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured.
@ -495,11 +495,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) peer cache. In order to make the most efficient use of disk space, by default BITS removes any files in the peer cache that have not been accessed in the past 90 days. Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) peer cache. In order to make the most efficient use of disk space, by default BITS removes any files in the peer cache that haven't been accessed in the past 90 days.
If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days. If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days.
If you disable or do not configure this policy setting, files that have not been accessed for the past 90 days will be removed from the peer cache. If you disable or don't configure this policy setting, files that haven't been accessed for the past 90 days will be removed from the peer cache.
> [!NOTE] > [!NOTE]
> This policy setting has no effect if the "Allow BITS Peercaching" policy setting is disabled or not configured. > This policy setting has no effect if the "Allow BITS Peercaching" policy setting is disabled or not configured.
@ -551,7 +551,7 @@ By default BITS uses a maximum download time of 90 days (7,776,000 seconds).
If you enable this policy setting, you can set the maximum job download time to a specified number of seconds. If you enable this policy setting, you can set the maximum job download time to a specified number of seconds.
If you disable or do not configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used. If you disable or don't configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used.
<!--/Description--> <!--/Description-->
@ -593,11 +593,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain. This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS job can contain.
If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number. If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number.
If you disable or do not configure this policy setting, BITS will use the default value of 200 for the maximum number of files a job can contain. If you disable or don't configure this policy setting, BITS will use the default value of 200 for the maximum number of files a job can contain.
> [!NOTE] > [!NOTE]
> BITS Jobs created by services and the local administrator account do not count toward this limit. > BITS Jobs created by services and the local administrator account do not count toward this limit.
@ -646,7 +646,7 @@ This policy setting limits the number of BITS jobs that can be created for all u
If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number. If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number.
If you disable or do not configure this policy setting, BITS will use the default BITS job limit of 300 jobs. If you disable or don't configure this policy setting, BITS will use the default BITS job limit of 300 jobs.
> [!NOTE] > [!NOTE]
> BITS jobs created by services and the local administrator account do not count toward this limit. > BITS jobs created by services and the local administrator account do not count toward this limit.
@ -695,7 +695,7 @@ This policy setting limits the number of BITS jobs that can be created by a user
If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number. If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number.
If you disable or do not configure this policy setting, BITS will use the default user BITS job limit of 300 jobs. If you disable or don't configure this policy setting, BITS will use the default user BITS job limit of 300 jobs.
> [!NOTE] > [!NOTE]
> This limit must be lower than the setting specified in the "Maximum number of BITS jobs for this computer" policy setting, or 300 if the "Maximum number of BITS jobs for this computer" policy setting is not configured. BITS jobs created by services and the local administrator account do not count toward this limit. > This limit must be lower than the setting specified in the "Maximum number of BITS jobs for this computer" policy setting, or 300 if the "Maximum number of BITS jobs for this computer" policy setting is not configured. BITS jobs created by services and the local administrator account do not count toward this limit.
@ -744,7 +744,7 @@ This policy setting limits the number of ranges that can be added to a file in a
If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number. If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number.
If you disable or do not configure this policy setting, BITS will limit ranges to 500 ranges per file. If you disable or don't configure this policy setting, BITS will limit ranges to 500 ranges per file.
> [!NOTE] > [!NOTE]
> BITS Jobs created by services and the local administrator account do not count toward this limit. > BITS Jobs created by services and the local administrator account do not count toward this limit.
@ -766,3 +766,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

6
windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_CipherSuiteOrder title: Policy CSP - ADMX_CipherSuiteOrder
description: Policy CSP - ADMX_CipherSuiteOrder description: Learn about the Policy CSP - ADMX_CipherSuiteOrder.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -147,3 +147,7 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

17
windows/client-management/mdm/policy-csp-admx-com.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_COM title: Policy CSP - ADMX_COM
description: Policy CSP - ADMX_COM description: Learn about the Policy CSP - ADMX_COM.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -66,11 +66,11 @@ manager: dansimp
<!--Description--> <!--Description-->
This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.
Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs can't perform all their functions unless Windows has internally registered the required components.
If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it's found, downloads it. The resulting searches might make some programs start or run slowly.
If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. If you disable or don't configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop.
This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.
@ -118,11 +118,11 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.
Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs can't perform all their functions unless Windows has internally registered the required components.
If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it's found, downloads it. The resulting searches might make some programs start or run slowly.
If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. If you disable or don't configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop.
This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.
@ -141,3 +141,6 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

14
windows/client-management/mdm/policy-csp-admx-controlpanel.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_ControlPanel title: Policy CSP - ADMX_ControlPanel
description: Policy CSP - ADMX_ControlPanel description: Learn about the Policy CSP - ADMX_ControlPanel.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -82,7 +82,9 @@ To hide a Control Panel item, enable this policy setting and click Show to acces
If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored. If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.
> [!NOTE] > [!NOTE]
> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration. > The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead.
>
>To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration.
<!--/Description--> <!--/Description-->
@ -130,7 +132,7 @@ If this policy setting is enabled, the Control Panel opens to the icon view.
If this policy setting is disabled, the Control Panel opens to the category view. If this policy setting is disabled, the Control Panel opens to the category view.
If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session. If this policy setting isn't configured, the Control Panel opens to the view used in the last Control Panel session.
> [!NOTE] > [!NOTE]
> Icon size is dependent upon what the user has set it to in the previous session. > Icon size is dependent upon what the user has set it to in the previous session.
@ -177,7 +179,7 @@ ADMX Info:
<!--Description--> <!--Description-->
Available in the latest Windows 10 Insider Preview Build. Disables all Control Panel programs and the PC settings app. Available in the latest Windows 10 Insider Preview Build. Disables all Control Panel programs and the PC settings app.
This setting prevents Control.exe and SystemSettings.exe, the program files for Control Panel and PC settings, from starting. As a result, users cannot start Control Panel or PC settings, or run any of their items. This setting prevents Control.exe and SystemSettings.exe, the program files for Control Panel and PC settings, from starting. As a result, users can't start Control Panel or PC settings, or run any of their items.
This setting removes Control Panel from: This setting removes Control Panel from:
@ -261,3 +263,7 @@ ADMX Info:
<hr/> <hr/>
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)

97
windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - ADMX_ControlPanelDisplay title: Policy CSP - ADMX_ControlPanelDisplay
description: Policy CSP - ADMX_ControlPanelDisplay description: Learn about the Policy CSP - ADMX_ControlPanelDisplay.
ms.author: dansimp ms.author: dansimp
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
@ -130,9 +130,9 @@ manager: dansimp
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Disables the Display Control Panel. This policy setting disables the Display Control Panel.
If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. If you enable this setting, the Display Control Panel doesn't run. When users try to start Display, a message appears explaining that a setting prevents the action.
Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings. Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings.
@ -176,7 +176,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Removes the Settings tab from Display in Control Panel. This setting removes the Settings tab from Display in Control Panel.
This setting prevents users from using Control Panel to add, configure, or change the display settings on the computer. This setting prevents users from using Control Panel to add, configure, or change the display settings on the computer.
@ -222,9 +222,9 @@ ADMX Info:
<!--Description--> <!--Description-->
This setting forces the theme color scheme to be the default color scheme. This setting forces the theme color scheme to be the default color scheme.
If you enable this setting, a user cannot change the color scheme of the current desktop theme. If you enable this setting, a user can't change the color scheme of the current desktop theme.
If you disable or do not configure this setting, a user may change the color scheme of the current desktop theme. If you disable or don't configure this setting, a user may change the color scheme of the current desktop theme.
For Windows 7 and later, use the "Prevent changing color and appearance" setting. For Windows 7 and later, use the "Prevent changing color and appearance" setting.
@ -269,9 +269,9 @@ ADMX Info:
<!--Description--> <!--Description-->
This setting disables the theme gallery in the Personalization Control Panel. This setting disables the theme gallery in the Personalization Control Panel.
If you enable this setting, users cannot change or save a theme. Elements of a theme such as the desktop background, color, sounds, and screen saver can still be changed (unless policies are set to turn them off). If you enable this setting, users can't change or save a theme. Elements of a theme such as the desktop background, color, sounds, and screen saver can still be changed (unless policies are set to turn them off).
If you disable or do not configure this setting, there is no effect. If you disable or don't configure this setting, there's no effect.
> [!NOTE] > [!NOTE]
> If you enable this setting but do not specify a theme using the "load a specific theme" setting, the theme defaults to whatever the user previously set or the system default. > If you enable this setting but do not specify a theme using the "load a specific theme" setting, the theme defaults to whatever the user previously set or the system default.
@ -315,7 +315,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens. This policy setting prevents users or applications from changing the visual style of the windows and buttons displayed on their screens.
When enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties. When enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties.
@ -360,11 +360,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Enables desktop screen savers. This policy setting enables desktop screen savers.
If you disable this setting, screen savers do not run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users cannot change the screen saver options. If you disable this setting, screen savers don't run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users can't change the screen saver options.
If you do not configure it, this setting has no effect on the system. If you don't configure it, this setting has no effect on the system.
If you enable it, a screen saver runs, provided the following two conditions hold: First, a valid screen saver on the client is specified through the "Screen Saver executable name" setting or through Control Panel on the client computer. Second, the screen saver timeout is set to a nonzero value through the setting or Control Panel. If you enable it, a screen saver runs, provided the following two conditions hold: First, a valid screen saver on the client is specified through the "Screen Saver executable name" setting or through Control Panel on the client computer. Second, the screen saver timeout is set to a nonzero value through the setting or Control Panel.
@ -415,9 +415,10 @@ This setting lets you specify the default lock screen and logon image shown when
To use this setting, type the fully qualified path and name of the file that stores the default lock screen and logon image. You can type a local path, such as C:\Windows\Web\Screen\img104.jpg or a UNC path, such as `\\Server\Share\Corp.jpg`. To use this setting, type the fully qualified path and name of the file that stores the default lock screen and logon image. You can type a local path, such as C:\Windows\Web\Screen\img104.jpg or a UNC path, such as `\\Server\Share\Corp.jpg`.
This can be used in conjunction with the "Prevent changing lock screen and logon image" setting to always force the specified lock screen and logon image to be shown. This can be used with the "Prevent changing lock screen and logon image" setting to always force the specified lock screen and logon image to be shown.
Note: This setting only applies to Enterprise, Education, and Server SKUs. >[!NOTE]
> This setting only applies to Enterprise, Education, and Server SKUs.
<!--/Description--> <!--/Description-->
@ -459,11 +460,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users from changing the size of the font in the windows and buttons displayed on their screens. This setting prevents users from changing the size of the font in the windows and buttons displayed on their screens.
If this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled. If this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled.
If you disable or do not configure this setting, a user may change the font size using the "Font size" drop-down list on the Appearance tab. If you disable or don't configure this setting, a user may change the font size using the "Font size" drop-down list on the Appearance tab.
<!--/Description--> <!--/Description-->
@ -504,11 +505,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users from changing the background image shown when the machine is locked or when on the logon screen. This setting prevents users from changing the background image shown when the machine is locked or when on the logon screen.
By default, users can change the background image shown when the machine is locked or displaying the logon screen. By default, users can change the background image shown when the machine is locked or displaying the logon screen.
If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. If you enable this setting, the user won't be able to change their lock screen and logon image, and they'll instead see the default image.
<!--/Description--> <!--/Description-->
@ -549,11 +550,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users from changing the look of their start menu background, such as its color or accent. This setting prevents users from changing the look of their start menu background, such as its color or accent.
By default, users can change the look of their start menu background, such as its color or accent. By default, users can change the look of their start menu background, such as its color or accent.
If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. If you enable this setting, the user will be assigned the default start menu background and colors and won't be allowed to change them.
If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy. If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy.
@ -598,9 +599,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available. This setting disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature isn't available.
This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows. This setting also prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows.
If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel.
@ -645,7 +646,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users from adding or changing the background design of the desktop. This setting prevents users from adding or changing the background design of the desktop.
By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop. By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop.
@ -653,7 +654,8 @@ If you enable this setting, none of the Desktop Background settings can be chang
To specify wallpaper for a group, use the "Desktop Wallpaper" setting. To specify wallpaper for a group, use the "Desktop Wallpaper" setting.
Note: You must also enable the "Desktop Wallpaper" setting to prevent users from changing the desktop wallpaper. Refer to KB article: Q327998 for more information. >[!NOTE]
>You must also enable the "Desktop Wallpaper" setting to prevent users from changing the desktop wallpaper. Refer to KB article: Q327998 for more information.
Also, see the "Allow only bitmapped wallpaper" setting. Also, see the "Allow only bitmapped wallpaper" setting.
@ -696,7 +698,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users from changing the desktop icons. This setting prevents users from changing the desktop icons.
By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons. By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons.
@ -745,9 +747,9 @@ ADMX Info:
<!--Description--> <!--Description-->
Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the lock screen appears for users. Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the lock screen appears for users.
If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC. If you enable this policy setting, users that aren't required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC.
If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse. If you disable or don't configure this policy setting, users that aren't required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse.
<!--/Description--> <!--/Description-->
@ -788,7 +790,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the mouse pointers. Available in the latest Windows 10 Insider Preview Build. This setting prevents users from changing the mouse pointers.
By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers. By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers.
@ -833,9 +835,9 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel. This setting prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel.
This setting prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It does not prevent a screen saver from running. This setting also prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It doesn't prevent a screen saver from running.
<!--/Description--> <!--/Description-->
@ -876,7 +878,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Prevents users from changing the sound scheme. This setting prevents users from changing the sound scheme.
By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme. By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme.
@ -921,11 +923,11 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB. This setting forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB.
By default, users can change the background and accent colors. By default, users can change the background and accent colors.
If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users can't change those colors. This setting won't be applied if the specified colors don't meet a contrast ratio of 2:1 with white text.
<!--/Description--> <!--/Description-->
@ -966,13 +968,13 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Determines whether screen savers used on the computer are password protected. This setting determines whether screen savers used on the computer are password protected.
If you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver. If you enable this setting, all screen savers are password protected. If you disable this setting, password protection can't be set on any screen saver.
This setting also disables the "Password protected" checkbox on the Screen Saver dialog in the Personalization or Display Control Panel, preventing users from changing the password protection setting. This setting also disables the "Password protected" checkbox on the Screen Saver dialog in the Personalization or Display Control Panel, preventing users from changing the password protection setting.
If you do not configure this setting, users can choose whether or not to set password protection on each screen saver. If you don't configure this setting, users can choose whether or not to set password protection on each screen saver.
To ensure that a computer will be password protected, enable the "Enable Screen Saver" setting and specify a timeout via the "Screen Saver timeout" setting. To ensure that a computer will be password protected, enable the "Enable Screen Saver" setting and specify a timeout via the "Screen Saver timeout" setting.
@ -1020,16 +1022,13 @@ ADMX Info:
<!--Description--> <!--Description-->
Specifies how much user idle time must elapse before the screen saver is launched. Specifies how much user idle time must elapse before the screen saver is launched.
When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started. When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver won't be started.
This setting has no effect under any of the following circumstances: This setting has no effect under any of the following circumstances:
- The setting is disabled or not configured. - The setting is disabled or not configured.
- The wait time is set to zero. - The wait time is set to zero.
- The "Enable Screen Saver" setting is disabled. - The "Enable Screen Saver" setting is disabled.
- Neither the "Screen saver executable name" setting nor the Screen Saver dialog of the client computer's Personalization or Display Control Panel specifies a valid existing screen saver program on the client. - Neither the "Screen saver executable name" setting nor the Screen Saver dialog of the client computer's Personalization or Display Control Panel specifies a valid existing screen saver program on the client.
When not configured, whatever wait time is set on the client through the Screen Saver dialog in the Personalization or Display Control Panel is used. The default is 15 minutes. When not configured, whatever wait time is set on the client through the Screen Saver dialog in the Personalization or Display Control Panel is used. The default is 15 minutes.
@ -1073,15 +1072,15 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Specifies the screen saver for the user's desktop. This setting specifies the screen saver for the user's desktop.
If you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver. If you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver.
If you disable this setting or do not configure it, users can select any screen saver. If you disable this setting or don't configure it, users can select any screen saver.
If you enable this setting, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file is not in the %Systemroot%\System32 directory, type the fully qualified path to the file. If you enable this setting, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file isn't in the %Systemroot%\System32 directory, type the fully qualified path to the file.
If the specified screen saver is not installed on a computer to which this setting applies, the setting is ignored. If the specified screen saver isn't installed on a computer to which this setting applies, the setting is ignored.
> [!NOTE] > [!NOTE]
> This setting can be superseded by the "Enable Screen Saver" setting. If the "Enable Screen Saver" setting is disabled, this setting is ignored, and screen savers do not run. > This setting can be superseded by the "Enable Screen Saver" setting. If the "Enable Screen Saver" setting is disabled, this setting is ignored, and screen savers do not run.
@ -1127,7 +1126,7 @@ ADMX Info:
<!--Description--> <!--Description-->
Available in the latest Windows 10 Insider Preview Build. Specifies which theme file is applied to the computer the first time a user logs on. Available in the latest Windows 10 Insider Preview Build. Specifies which theme file is applied to the computer the first time a user logs on.
If you enable this setting, the theme that you specify will be applied when a new user logs on for the first time. This policy does not prevent the user from changing the theme or any of the theme elements such as the desktop background, color, sounds, or screen saver after the first logon. If you enable this setting, the theme that you specify will be applied when a new user logs on for the first time. This policy doesn't prevent the user from changing the theme or any of the theme elements such as the desktop background, color, sounds, or screen saver after the first logon.
If you disable or do not configure this setting, the default theme will be applied at the first logon. If you disable or do not configure this setting, the default theme will be applied at the first logon.
@ -1176,7 +1175,7 @@ This can be a local computer visual style (aero.msstyles), or a file located on
If you enable this setting, the visual style file that you specify will be used. Also, a user may not apply a different visual style when changing themes. If you enable this setting, the visual style file that you specify will be used. Also, a user may not apply a different visual style when changing themes.
If you disable or do not configure this setting, the users can select the visual style that they want to use by changing themes (if the Personalization Control Panel is available). If you disable or don't configure this setting, the users can select the visual style that they want to use by changing themes (if the Personalization Control Panel is available).
> [!NOTE] > [!NOTE]
> If this setting is enabled and the file is not available at user logon, the default visual style is loaded. > If this setting is enabled and the file is not available at user logon, the default visual style is loaded.
@ -1228,7 +1227,7 @@ Forces the Start screen to use one of the available backgrounds, 1 through 20, a
If this setting is set to zero or not configured, then Start uses the default background, and users can change it. If this setting is set to zero or not configured, then Start uses the default background, and users can change it.
If this setting is set to a nonzero value, then Start uses the specified background, and users cannot change it. If the specified background is not supported, the default background is used. If this setting is set to a nonzero value, then Start uses the specified background, and users can't change it. If the specified background isn't supported, the default background is used.
<!--/Description--> <!--/Description-->
@ -1245,3 +1244,7 @@ ADMX Info:
<!--/Policies--> <!--/Policies-->
## Related topics
[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md)