deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

exploitguard federatedauthentication fileexplorer

Browse Source
This commit is contained in:
Liz Long 2022-12-30 16:37:14 -05:00
parent 141f6913c5
commit 192c548ef5
3 changed files with 501 additions and 481 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

175
windows/client-management/mdm/policy-csp-exploitguard.md
View File

File diff suppressed because one or more lines are too long

124
windows/client-management/mdm/policy-csp-federatedauthentication.md
View File

@ -1,81 +1,83 @@
--- ---
title: Policy CSP - FederatedAuthentication title: FederatedAuthentication Policy CSP
description: Use the Policy CSP - Represents the enablement state of the Web Sign-in Credential Provider for device sign-in. description: Learn more about the FederatedAuthentication Area in Policy CSP
ms.author: v-nsatapathy author: vinaypamnani-msft
ms.topic: article manager: aaroncz
ms.author: vinpa
ms.date: 12/30/2022
ms.localizationpriority: medium
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
author: nimishasatapathy ms.topic: reference
ms.localizationpriority: medium
ms.date: 09/07/2022
ms.reviewer:
manager: dansimp
--- ---
<!-- Auto-Generated CSP Document -->
<!-- FederatedAuthentication-Begin -->
# Policy CSP - FederatedAuthentication # Policy CSP - FederatedAuthentication
<!-- FederatedAuthentication-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- FederatedAuthentication-Editable-End -->
<hr/> <!-- EnableWebSignInForPrimaryUser-Begin -->
## EnableWebSignInForPrimaryUser
<!--Policies--> <!-- EnableWebSignInForPrimaryUser-Applicability-Begin -->
## FederatedAuthentication policies | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
<!-- EnableWebSignInForPrimaryUser-Applicability-End -->
<dl> <!-- EnableWebSignInForPrimaryUser-OmaUri-Begin -->
<dd> ```Device
<a href="#federatedauthentication-enablewebsigninforprimaryuser">FederatedAuthentication/EnableWebSignInForPrimaryUser</a> ./Device/Vendor/MSFT/Policy/Config/FederatedAuthentication/EnableWebSignInForPrimaryUser
</dd> ```
</dl> <!-- EnableWebSignInForPrimaryUser-OmaUri-End -->
<!-- EnableWebSignInForPrimaryUser-Description-Begin -->
<!-- Description-Source-DDF -->
Specifies whether web-based sign-in is enabled with the Primary User experience
<!-- EnableWebSignInForPrimaryUser-Description-End -->
<hr/> <!-- EnableWebSignInForPrimaryUser-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!--Policy-->
<a href="" id="federatedauthentication-enablewebsigninforprimaryuser"></a>**FederatedAuthentication/EnableWebSignInForPrimaryUser**
<!--SupportedSKUs-->
|Edition|Windows 10|Windows 11|
|--- |--- |--- |
|Home|No|No|
|Pro|No|No|
|Business|No|No|
|Enterprise|No|No|
|Education|No|No|
|Windows SE|Yes|No|
> [!NOTE]
> Only available on Windows SE edition when Education/IsEducationEnvironment policy is also set to "1".
<!--/SupportedSKUs-->
<hr/>
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
> * Machine
<hr/>
<!--/Scope-->
<!--Description-->
This policy specifies whether Web Sign-in can be used for device sign-in in a single-user environment.​
> [!NOTE] > [!NOTE]
> Web Sign-in is only supported on Azure AD Joined PCs. > Web Sign-in is only supported on Azure AD Joined PCs.
<!-- EnableWebSignInForPrimaryUser-Editable-End -->
<!--/Description--> <!-- EnableWebSignInForPrimaryUser-DFProperties-Begin -->
**Description framework properties**:
<!--SupportedValues--> | Property name | Property value |
Value type is integer: |:--|:--|
- 0 - (default): Feature defaults as appropriate for edition and device capabilities. | Format | int |
- 1 - Enabled: Web Sign-in Credential Provider will be enabled for device sign-in. | Access Type | Add, Delete, Get, Replace |
- 2 - Disabled: Web Sign-in Credential Provider won't be enabled for device sign-in. | Default Value | 0 |
<!-- EnableWebSignInForPrimaryUser-DFProperties-End -->
<!--/SupportedValues--> <!-- EnableWebSignInForPrimaryUser-AllowedValues-Begin -->
**Allowed values**:
<!--/Policy--> | Value | Description |
|:--|:--|
| 0 (Default) | Feature defaults as appropriate for edition and device capabilities. As of now, all editions/devices exhibit Disabled behavior by default. However, this may change for future editions/devices. |
| 1 | Enabled. Web Sign-in Credential Provider will be enabled for device sign-in. |
| 2 | Disabled. Web Sign-in Credential Provider will be not be enabled for device sign-in. |
<!-- EnableWebSignInForPrimaryUser-AllowedValues-End -->
<!--/Policies--> <!-- EnableWebSignInForPrimaryUser-Examples-Begin -->
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- EnableWebSignInForPrimaryUser-Examples-End -->
<!-- EnableWebSignInForPrimaryUser-End -->
<!-- FederatedAuthentication-CspMoreInfo-Begin -->
<!-- Add any additional information about this CSP here. Anything outside this section will get overwritten. -->
<!-- FederatedAuthentication-CspMoreInfo-End -->
<!-- FederatedAuthentication-End -->
## Related articles
[Policy configuration service provider](policy-configuration-service-provider.md)

681
windows/client-management/mdm/policy-csp-fileexplorer.md
View File

@ -1,416 +1,435 @@
--- ---
title: Policy CSP - FileExplorer title: FileExplorer Policy CSP
description: Use the Policy CSP - FileExplorer setting so you can allow certain legacy plug-in applications to function without terminating Explorer. description: Learn more about the FileExplorer Area in Policy CSP
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.topic: article ms.date: 12/30/2022
ms.localizationpriority: medium
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
author: vinaypamnani-msft ms.topic: reference
ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: aaroncz
--- ---
<!-- Auto-Generated CSP Document -->
<!-- FileExplorer-Begin -->
# Policy CSP - FileExplorer # Policy CSP - FileExplorer
> [!TIP] > [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). > Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
> >
> You must specify the data type in the SyncML as &lt;Format&gt;chr&lt;/Format&gt;. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). > You must specify the data type in the SyncML as &lt;Format&gt;chr&lt;/Format&gt;. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
> >
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!-- FileExplorer-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- FileExplorer-Editable-End -->
<hr/> <!-- AllowOptionToShowNetwork-Begin -->
## AllowOptionToShowNetwork
<!--Policies--> <!-- AllowOptionToShowNetwork-Applicability-Begin -->
## FileExplorer policies | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<!-- AllowOptionToShowNetwork-Applicability-End -->
<dl> <!-- AllowOptionToShowNetwork-OmaUri-Begin -->
<dd> ```User
<a href="#fileexplorer-allowoptiontoshownetwork">FileExplorer/AllowOptionToShowNetwork</a> ./User/Vendor/MSFT/Policy/Config/FileExplorer/AllowOptionToShowNetwork
</dd> ```
<dd>
<a href="#fileexplorer-allowoptiontoshowthispc">FileExplorer/AllowOptionToShowThisPC</a>
</dd>
<dd>
<a href="#fileexplorer-turnoffdataexecutionpreventionforexplorer">FileExplorer/TurnOffDataExecutionPreventionForExplorer</a>
</dd>
<dd>
<a href="#fileexplorer-turnoffheapterminationoncorruption">FileExplorer/TurnOffHeapTerminationOnCorruption</a>
</dd>
<dd>
<a href="#fileexplorer-setallowedfolderlocations">FileExplorer/SetAllowedFolderLocations</a>
</dd>
<dd>
<a href="#fileexplorer-setallowedstoragelocations">FileExplorer/SetAllowedStorageLocations</a>
</dd>
<dd>
<a href="#fileexplorer-disablegraphrecentitems">FileExplorer/DisableGraphRecentItems</a>
</dd>
</dl>
```Device
./Device/Vendor/MSFT/Policy/Config/FileExplorer/AllowOptionToShowNetwork
```
<!-- AllowOptionToShowNetwork-OmaUri-End -->
<!-- AllowOptionToShowNetwork-Description-Begin -->
<!-- Description-Source-DDF -->
When the Network folder is restricted, give the user the option to enumerate and navigate into it.
<!-- AllowOptionToShowNetwork-Description-End -->
<hr/> <!-- AllowOptionToShowNetwork-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- AllowOptionToShowNetwork-Editable-End -->
<!--Policy--> <!-- AllowOptionToShowNetwork-DFProperties-Begin -->
<a href="" id="fileexplorer-allowoptiontoshownetwork"></a>**FileExplorer/AllowOptionToShowNetwork** **Description framework properties**:
<!--SupportedSKUs--> | Property name | Property value |
|:--|:--|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
<!-- AllowOptionToShowNetwork-DFProperties-End -->
|Edition|Windows 10|Windows 11| <!-- AllowOptionToShowNetwork-AllowedValues-Begin -->
|--- |--- |--- | **Allowed values**:
|Home|No|No|
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs--> | Value | Description |
<hr/> |:--|:--|
| 0 (Default) | Not Allowed. |
| 1 | Allowed. |
<!-- AllowOptionToShowNetwork-AllowedValues-End -->
<!--Scope--> <!-- AllowOptionToShowNetwork-Examples-Begin -->
[Scope](./policy-configuration-service-provider.md#policy-scope): <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- AllowOptionToShowNetwork-Examples-End -->
> [!div class = "checklist"] <!-- AllowOptionToShowNetwork-End -->
> * Device
<hr/> <!-- AllowOptionToShowThisPC-Begin -->
## AllowOptionToShowThisPC
<!--/Scope--> <!-- AllowOptionToShowThisPC-Applicability-Begin -->
<!--Description--> | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<!-- AllowOptionToShowThisPC-Applicability-End -->
This policy allows the user with an option to show the network folder when restricted. <!-- AllowOptionToShowThisPC-OmaUri-Begin -->
```User
./User/Vendor/MSFT/Policy/Config/FileExplorer/AllowOptionToShowThisPC
```
<!--/Description--> ```Device
./Device/Vendor/MSFT/Policy/Config/FileExplorer/AllowOptionToShowThisPC
```
<!-- AllowOptionToShowThisPC-OmaUri-End -->
<!--SupportedValues--> <!-- AllowOptionToShowThisPC-Description-Begin -->
The following list shows the supported values: <!-- Description-Source-DDF -->
When This PC location is restricted, give the user the option to enumerate and navigate into it.
<!-- AllowOptionToShowThisPC-Description-End -->
- 0 - Disabled <!-- AllowOptionToShowThisPC-Editable-Begin -->
- 1 (default) - Enabled <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- AllowOptionToShowThisPC-Editable-End -->
<!--/SupportedValues--> <!-- AllowOptionToShowThisPC-DFProperties-Begin -->
**Description framework properties**:
<!--ADMXBacked--> | Property name | Property value |
ADMX Info: |:--|:--|
- GP Friendly name: *Allow the user the option to show Network folder when restricted* | Format | int |
- GP name: *AllowOptionToShowNetwork* | Access Type | Add, Delete, Get, Replace |
- GP path: *File Explorer* | Default Value | 0 |
- GP ADMX file name: *Explorer.admx* <!-- AllowOptionToShowThisPC-DFProperties-End -->
<!--/ADMXBacked--> <!-- AllowOptionToShowThisPC-AllowedValues-Begin -->
<!--/Policy--> **Allowed values**:
<hr/> | Value | Description |
|:--|:--|
| 0 (Default) | Not Allowed. |
| 1 | Allowed. |
<!-- AllowOptionToShowThisPC-AllowedValues-End -->
<!--Policy--> <!-- AllowOptionToShowThisPC-Examples-Begin -->
<a href="" id="fileexplorer-allowoptiontoshowthispc"></a>**FileExplorer/AllowOptionToShowThisPC** <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- AllowOptionToShowThisPC-Examples-End -->
<!--SupportedSKUs--> <!-- AllowOptionToShowThisPC-End -->
|Edition|Windows 10|Windows 11| <!-- DisableGraphRecentItems-Begin -->
|--- |--- |--- | ## DisableGraphRecentItems
|Home|No|No|
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs--> <!-- DisableGraphRecentItems-Applicability-Begin -->
<hr/> | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
<!-- DisableGraphRecentItems-Applicability-End -->
<!--Scope--> <!-- DisableGraphRecentItems-OmaUri-Begin -->
[Scope](./policy-configuration-service-provider.md#policy-scope): ```Device
./Device/Vendor/MSFT/Policy/Config/FileExplorer/DisableGraphRecentItems
```
<!-- DisableGraphRecentItems-OmaUri-End -->
> [!div class = "checklist"] <!-- DisableGraphRecentItems-Description-Begin -->
> * User <!-- Description-Source-ADMX -->
Turning off files from Office.com will prevent File Explorer from requesting recent cloud file metadata and displaying it in the Quick access view.
<!-- DisableGraphRecentItems-Description-End -->
<hr/> <!-- DisableGraphRecentItems-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- DisableGraphRecentItems-Editable-End -->
<!--/Scope--> <!-- DisableGraphRecentItems-DFProperties-Begin -->
<!--Description--> **Description framework properties**:
This policy allows the user with an option to show this PC location when restricted. | Property name | Property value |
|:--|:--|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
<!-- DisableGraphRecentItems-DFProperties-End -->
<!--/Description--> <!-- DisableGraphRecentItems-AllowedValues-Begin -->
**Allowed values**:
<!--SupportedValues--> | Value | Description |
The following list shows the supported values: |:--|:--|
| 0 (Default) | File Explorer will request cloud file metadata and display it in the Quick access view. |
| 1 | File Explorer will not request cloud file metadata or display it in the Quick access view. |
<!-- DisableGraphRecentItems-AllowedValues-End -->
- 0 - Disabled <!-- DisableGraphRecentItems-GpMapping-Begin -->
- 1 (default) - Enabled **Group policy mapping**:
<!--/SupportedValues--> | Name | Value |
|:--|:--|
| Name | DisableGraphRecentItems |
| Friendly Name | Turn off files from Office.com in Quick access view |
| Location | Computer Configuration |
| Path | WindowsComponents > File Explorer |
| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer |
| Registry Value Name | DisableGraphRecentItems |
| ADMX File Name | Explorer.admx |
<!-- DisableGraphRecentItems-GpMapping-End -->
<!--ADMXBacked--> <!-- DisableGraphRecentItems-Examples-Begin -->
ADMX Info: <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
- GP Friendly name: *Allow the user the option to show Network folder when restricted* <!-- DisableGraphRecentItems-Examples-End -->
- GP name: *AllowOptionToShowThisPC*
- GP path: *File Explorer*
- GP ADMX file name: *Explorer.admx*
<!--/ADMXBacked--> <!-- DisableGraphRecentItems-End -->
<!--/Policy-->
<hr/> <!-- SetAllowedFolderLocations-Begin -->
## SetAllowedFolderLocations
<!--Policy--> <!-- SetAllowedFolderLocations-Applicability-Begin -->
<a href="" id="fileexplorer-turnoffdataexecutionpreventionforexplorer"></a>**FileExplorer/TurnOffDataExecutionPreventionForExplorer** | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<!-- SetAllowedFolderLocations-Applicability-End -->
<!--SupportedSKUs--> <!-- SetAllowedFolderLocations-OmaUri-Begin -->
```User
./User/Vendor/MSFT/Policy/Config/FileExplorer/SetAllowedFolderLocations
```
|Edition|Windows 10|Windows 11| ```Device
|--- |--- |--- | ./Device/Vendor/MSFT/Policy/Config/FileExplorer/SetAllowedFolderLocations
|Home|No|No| ```
|Pro|Yes|Yes| <!-- SetAllowedFolderLocations-OmaUri-End -->
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs--> <!-- SetAllowedFolderLocations-Description-Begin -->
<hr/> <!-- Description-Source-DDF -->
A value that can represent one or more folder locations in File Explorer. If not specified, the default is access to all folder locations.
<!-- SetAllowedFolderLocations-Description-End -->
<!--Scope--> <!-- SetAllowedFolderLocations-Editable-Begin -->
[Scope](./policy-configuration-service-provider.md#policy-scope): <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- SetAllowedFolderLocations-Editable-End -->
> [!div class = "checklist"] <!-- SetAllowedFolderLocations-DFProperties-Begin -->
> * Device **Description framework properties**:
<hr/> | Property name | Property value |
|:--|:--|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
<!-- SetAllowedFolderLocations-DFProperties-End -->
<!--/Scope--> <!-- SetAllowedFolderLocations-AllowedValues-Begin -->
<!--Description--> **Allowed values**:
| Value | Description |
|:--|:--|
| 0 (Default) | Access to all folder locations. |
| 13 | Documents, Pictures, Downloads |
| 15 | Desktop, Documents, Pictures, Downloads |
| 31 | Desktop, Documents, Pictures, Downloads, Network |
| 47 | This PC, Desktop, Documents, Pictures, Downloads |
| 63 | This PC, Desktop, Documents, Pictures, Downloads, Network |
<!-- SetAllowedFolderLocations-AllowedValues-End -->
<!-- SetAllowedFolderLocations-Examples-Begin -->
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- SetAllowedFolderLocations-Examples-End -->
<!-- SetAllowedFolderLocations-End -->
<!-- SetAllowedStorageLocations-Begin -->
## SetAllowedStorageLocations
<!-- SetAllowedStorageLocations-Applicability-Begin -->
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
<!-- SetAllowedStorageLocations-Applicability-End -->
<!-- SetAllowedStorageLocations-OmaUri-Begin -->
```User
./User/Vendor/MSFT/Policy/Config/FileExplorer/SetAllowedStorageLocations
```
```Device
./Device/Vendor/MSFT/Policy/Config/FileExplorer/SetAllowedStorageLocations
```
<!-- SetAllowedStorageLocations-OmaUri-End -->
<!-- SetAllowedStorageLocations-Description-Begin -->
<!-- Description-Source-DDF -->
A value that can represent one or more storage locations in File Explorer. If not specified, the default is access to all storage locations.
<!-- SetAllowedStorageLocations-Description-End -->
<!-- SetAllowedStorageLocations-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- SetAllowedStorageLocations-Editable-End -->
<!-- SetAllowedStorageLocations-DFProperties-Begin -->
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
<!-- SetAllowedStorageLocations-DFProperties-End -->
<!-- SetAllowedStorageLocations-AllowedValues-Begin -->
**Allowed values**:
| Value | Description |
|:--|:--|
| 0 (Default) | Access to all storage locations. |
| 1 | Removable Drives |
| 2 | Sync roots |
| 3 | Removable Drives, Sync roots |
| 4 | Local Drives |
| 5 | Removable Drives, Local Drives |
| 6 | Sync Roots, Local Drives |
| 7 | Removable Drives, Sync Roots, Local Drives |
<!-- SetAllowedStorageLocations-AllowedValues-End -->
<!-- SetAllowedStorageLocations-Examples-Begin -->
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- SetAllowedStorageLocations-Examples-End -->
<!-- SetAllowedStorageLocations-End -->
<!-- TurnOffDataExecutionPreventionForExplorer-Begin -->
## TurnOffDataExecutionPreventionForExplorer
<!-- TurnOffDataExecutionPreventionForExplorer-Applicability-Begin -->
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
<!-- TurnOffDataExecutionPreventionForExplorer-Applicability-End -->
<!-- TurnOffDataExecutionPreventionForExplorer-OmaUri-Begin -->
```Device
./Device/Vendor/MSFT/Policy/Config/FileExplorer/TurnOffDataExecutionPreventionForExplorer
```
<!-- TurnOffDataExecutionPreventionForExplorer-OmaUri-End -->
<!-- TurnOffDataExecutionPreventionForExplorer-Description-Begin -->
<!-- Description-Source-ADMX -->
Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer. Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer.
<!-- TurnOffDataExecutionPreventionForExplorer-Description-End -->
<!--/Description--> <!-- TurnOffDataExecutionPreventionForExplorer-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- TurnOffDataExecutionPreventionForExplorer-Editable-End -->
<!--ADMXBacked--> <!-- TurnOffDataExecutionPreventionForExplorer-DFProperties-Begin -->
ADMX Info: **Description framework properties**:
- GP Friendly name: *Turn off Data Execution Prevention for Explorer*
- GP name: *NoDataExecutionPrevention*
- GP path: *File Explorer*
- GP ADMX file name: *Explorer.admx*
<!--/ADMXBacked--> | Property name | Property value |
<!--/Policy--> |:--|:--|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
<!-- TurnOffDataExecutionPreventionForExplorer-DFProperties-End -->
<hr/> <!-- TurnOffDataExecutionPreventionForExplorer-AdmxBacked-Begin -->
> [!TIP]
> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
<!--Policy--> **ADMX mapping**:
<a href="" id="fileexplorer-turnoffheapterminationoncorruption"></a>**FileExplorer/TurnOffHeapTerminationOnCorruption**
<!--SupportedSKUs--> | Name | Value |
|:--|:--|
| Name | NoDataExecutionPrevention |
| Friendly Name | Turn off Data Execution Prevention for Explorer |
| Location | Computer Configuration |
| Path | WindowsComponents > File Explorer |
| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer |
| Registry Value Name | NoDataExecutionPrevention |
| ADMX File Name | Explorer.admx |
<!-- TurnOffDataExecutionPreventionForExplorer-AdmxBacked-End -->
|Edition|Windows 10|Windows 11| <!-- TurnOffDataExecutionPreventionForExplorer-Examples-Begin -->
|--- |--- |--- | <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|Home|No|No| <!-- TurnOffDataExecutionPreventionForExplorer-Examples-End -->
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs--> <!-- TurnOffDataExecutionPreventionForExplorer-End -->
<hr/>
<!--Scope--> <!-- TurnOffHeapTerminationOnCorruption-Begin -->
[Scope](./policy-configuration-service-provider.md#policy-scope): ## TurnOffHeapTerminationOnCorruption
> [!div class = "checklist"] <!-- TurnOffHeapTerminationOnCorruption-Applicability-Begin -->
> * Device | Scope | Editions | Applicable OS |
|:--|:--|:--|
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
<!-- TurnOffHeapTerminationOnCorruption-Applicability-End -->
<hr/> <!-- TurnOffHeapTerminationOnCorruption-OmaUri-Begin -->
```Device
./Device/Vendor/MSFT/Policy/Config/FileExplorer/TurnOffHeapTerminationOnCorruption
```
<!-- TurnOffHeapTerminationOnCorruption-OmaUri-End -->
<!--/Scope--> <!-- TurnOffHeapTerminationOnCorruption-Description-Begin -->
<!--Description--> <!-- Description-Source-ADMX -->
Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating Explorer immediately, although Explorer may still terminate unexpectedly later. Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating Explorer immediately, although Explorer may still terminate unexpectedly later.
<!-- TurnOffHeapTerminationOnCorruption-Description-End -->
<!--/Description--> <!-- TurnOffHeapTerminationOnCorruption-Editable-Begin -->
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
<!-- TurnOffHeapTerminationOnCorruption-Editable-End -->
<!--ADMXBacked--> <!-- TurnOffHeapTerminationOnCorruption-DFProperties-Begin -->
ADMX Info: **Description framework properties**:
- GP Friendly name: *Turn off heap termination on corruption*
- GP name: *NoHeapTerminationOnCorruption*
- GP path: *File Explorer*
- GP ADMX file name: *Explorer.admx*
<!--/ADMXBacked--> | Property name | Property value |
<!--/Policy--> |:--|:--|
<hr/> | Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
<!-- TurnOffHeapTerminationOnCorruption-DFProperties-End -->
<!--Policy--> <!-- TurnOffHeapTerminationOnCorruption-AdmxBacked-Begin -->
<a href="" id="fileexplorer-setallowedfolderlocations"></a>**FileExplorer/SetAllowedFolderLocations** > [!TIP]
> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
<!--SupportedSKUs--> **ADMX mapping**:
|Edition|Windows 10|Windows 11| | Name | Value |
|--- |--- |--- | |:--|:--|
|Home|No|No| | Name | NoHeapTerminationOnCorruption |
|Pro|Yes|Yes| | Friendly Name | Turn off heap termination on corruption |
|Windows SE|No|Yes| | Location | Computer Configuration |
|Business|Yes|Yes| | Path | WindowsComponents > File Explorer |
|Enterprise|Yes|Yes| | Registry Key Name | Software\Policies\Microsoft\Windows\Explorer |
|Education|Yes|Yes| | Registry Value Name | NoHeapTerminationOnCorruption |
| ADMX File Name | Explorer.admx |
<!-- TurnOffHeapTerminationOnCorruption-AdmxBacked-End -->
<!--/SupportedSKUs--> <!-- TurnOffHeapTerminationOnCorruption-Examples-Begin -->
<hr/> <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
<!-- TurnOffHeapTerminationOnCorruption-Examples-End -->
<!--Scope--> <!-- TurnOffHeapTerminationOnCorruption-End -->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"] <!-- FileExplorer-CspMoreInfo-Begin -->
> * User <!-- Add any additional information about this CSP here. Anything outside this section will get overwritten. -->
<!-- FileExplorer-CspMoreInfo-End -->
<hr/> <!-- FileExplorer-End -->
<!--/Scope--> ## Related articles
<!--Description-->
This policy configures the folders that the user can enumerate and access in the File Explorer.
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0: All folders
- 15: Desktop, Documents, Pictures, and Downloads
- 31: Desktop, Documents, Pictures, Downloads, and Network
- 47: This PC (local drive), [Desktop, Documents, Pictures], and Downloads
- 63: This PC, [Desktop, Documents, Pictures], Downloads, and Network
<!--/SupportedValues-->
<!--ADMXBacked-->
ADMX Info:
- GP Friendly name: *Configure which folders the user can enumerate and access to in File Explorer*
- GP name: *SetAllowedFolderLocations*
- GP path: *File Explorer*
- GP ADMX file name: *Explorer.admx*
<!--/ADMXBacked-->
<!--/Policy-->
<hr/>
<!--Policy-->
<a href="" id="fileexplorer-setallowedstoragelocations"></a>**FileExplorer/SetAllowedStorageLocations**
<!--SupportedSKUs-->
|Edition|Windows 10|Windows 11|
|--- |--- |--- |
|Home|No|No|
|Pro|Yes|Yes|
|Windows SE|No|Yes|
|Business|Yes|Yes|
|Enterprise|Yes|Yes|
|Education|Yes|Yes|
<!--/SupportedSKUs-->
<hr/>
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
> * User
<hr/>
<!--/Scope-->
<!--Description-->
This policy configures the folders that the user can enumerate and access in the File Explorer.
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0: All storage locations
- 1: Removable Drives
- 2: Sync roots
- 3: Removable Drives, Sync roots, local drive
<!--/SupportedValues-->
<!--ADMXBacked-->
ADMX Info:
- GP Friendly name: *Configure which folders the user can enumerate and access to in File Explorer*
- GP name: *SetAllowedStorageLocations*
- GP path: *File Explorer*
- GP ADMX file name: *Explorer.admx*
<!--/ADMXBacked-->
<!--/Policy-->
<hr/>
<!--Policy-->
<a href="" id="fileexplorer-disablegraphrecentitems"></a>**FileExplorer/DisableGraphRecentItems**
<!--SupportedSKUs-->
|Edition|Windows 10|Windows 11|
|--- |--- |--- |
|Home|No|No|
|Pro|No|Yes|
|Windows SE|No|Yes|
|Business|No|No|
|Enterprise|No|Yes|
|Education|No|Yes|
<!--/SupportedSKUs-->
<hr/>
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
> * User
<hr/>
<!--/Scope-->
<!--Description-->
This policy changes whether files from Office.com will be shown in the Recents and Favorites sections on the Home node (previously known as Quick Access) in File Explorer.
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0: Files from Office.com will display in the Home node
- 1: No files from Office.com will be retrieved or displayed
<!--/SupportedValues-->
<!--ADMXBacked-->
ADMX Info:
- GP Friendly name: *Turn off files from Office.com in Quick access view*
- GP name: *DisableGraphRecentItems*
- GP path: *File Explorer*
- GP ADMX file name: *Explorer.admx*
<!--/ADMXBacked-->
<!--/Policy-->
<hr/>
<!--/Policies-->
## Related topics
[Policy configuration service provider](policy-configuration-service-provider.md) [Policy configuration service provider](policy-configuration-service-provider.md)