deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into FromPrivateRepo

Browse Source
This commit is contained in:
Alma Jenks 2018-01-29 15:35:11 -08:00
commit 1a3c26e672
77 changed files with 8438 additions and 7292 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.openpublishing.publish.config.json
View File

@ -125,6 +125,7 @@
"build_output_subfolder": "microsoft-365",
"locale": "en-us",
"monikers": [],
"moniker_ranges": [],
"open_to_public_contributors": false,
"type_mapping": {
"Conceptual": "Content",

15
.openpublishing.redirection.json
View File

@ -8444,6 +8444,21 @@
"source_path": "windows/deployment/windows-10-auto-pilot.md",
"redirect_url": "/windows/deployment/windows-autopilot/windows-10-autopilot",
"redirect_document_id": true
},
{
"source_path": "bcs/index.md",
"redirect_url": "/microsoft-365/business/index",
"redirect_document_id": true
},
{
"source_path": "bcs/support/microsoft-365-business-faqs.md",
"redirect_url": "/microsoft-365/business/support/microsoft-365-business-faqs",
"redirect_document_id": true
},
{
"source_path": "bcs/support/transition-csp-subscription.md",
"redirect_url": "/microsoft-365/business/support/transition-csp-subscription",
"redirect_document_id": true
}
]
}

44
windows/client-management/mdm/policy-csp-abovelock.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - AboveLock
@ -30,11 +30,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="abovelock-allowactioncenternotifications"></a>**AboveLock/AllowActionCenterNotifications**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,8 +67,8 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -74,7 +76,7 @@ Specifies whether to allow Action Center notifications above the device lock scr
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -83,11 +85,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="abovelock-allowcortanaabovelock"></a>**AboveLock/AllowCortanaAboveLock**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -109,8 +113,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -118,11 +122,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -131,11 +135,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="abovelock-allowtoasts"></a>**AboveLock/AllowToasts**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -157,8 +163,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -166,13 +172,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow toast notifications above the device lock screen.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

71
windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/29/2017
ms.date: 01/29/2018
---
# Policy CSP - AccountPoliciesAccountLockoutPolicy
@ -32,11 +32,13 @@ ms.date: 12/29/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="accountpoliciesaccountlockoutpolicy-accountlockoutduration"></a>**AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -58,8 +60,8 @@ ms.date: 12/29/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -67,30 +69,23 @@ ms.date: 12/29/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major release. This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it.
If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time.
Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="accountpoliciesaccountlockoutpolicy-accountlockoutthreshold"></a>**AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -112,8 +107,8 @@ Default: None, because this policy setting only has meaning when an Account lock
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -121,30 +116,23 @@ Default: None, because this policy setting only has meaning when an Account lock
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major release. This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out.
Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts.
Default: 0.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="accountpoliciesaccountlockoutpolicy-resetaccountlockoutcounterafter"></a>**AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -166,8 +154,8 @@ Default: 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -175,24 +163,15 @@ Default: 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major release. This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes.
If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration.
Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

58
windows/client-management/mdm/policy-csp-accounts.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Accounts
@ -33,11 +33,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="accounts-allowaddingnonmicrosoftaccountsmanually"></a>**Accounts/AllowAddingNonMicrosoftAccountsManually**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -59,8 +61,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -68,8 +70,8 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether user is allowed to add non-MSA email accounts.
Most restricted value is 0.
@ -77,7 +79,7 @@ Most restricted value is 0.
> [!NOTE]
> This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the [EMAIL2 CSP](email2-csp.md).
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -86,11 +88,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="accounts-allowmicrosoftaccountconnection"></a>**Accounts/AllowMicrosoftAccountConnection**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -112,8 +116,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -121,13 +125,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -136,11 +140,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="accounts-allowmicrosoftaccountsigninassistant"></a>**Accounts/AllowMicrosoftAccountSignInAssistant**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -162,8 +168,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -171,11 +177,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -184,11 +190,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="accounts-domainnamesforemailsync"></a>**Accounts/DomainNamesForEmailSync**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -210,8 +218,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -219,15 +227,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies a list of the domains that are allowed to sync email on the device.
The data type is a string.
The default value is an empty string, which allows all email accounts on the device to sync email. Otherwise, the string should contain a pipe-separated list of domains that are allowed to sync email on the device. For example, "contoso.com|fabrikam.net|woodgrove.gov".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

20
windows/client-management/mdm/policy-csp-activexcontrols.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - ActiveXControls
@ -24,11 +24,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="activexcontrols-approvedinstallationsites"></a>**ActiveXControls/ApprovedInstallationSites**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,8 +61,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL.
If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL.
@ -69,7 +71,7 @@ If you disable or do not configure this policy setting, ActiveX controls prompt
Note: Wild card characters cannot be used when specifying the host URLs.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -77,14 +79,14 @@ Note: Wild card characters cannot be used when specifying the host URLs.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Approved Installation Sites for ActiveX Controls*
- GP name: *ApprovedActiveXInstallSites*
- GP path: *Windows Components/ActiveX Installer Service*
- GP ADMX file name: *ActiveXInstallService.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

17
windows/client-management/mdm/policy-csp-applicationdefaults.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/04/2017
ms.date: 01/29/2018
---
# Policy CSP - ApplicationDefaults
@ -24,11 +24,13 @@ ms.date: 12/04/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="applicationdefaults-defaultassociationsconfiguration"></a>**ApplicationDefaults/DefaultAssociationsConfiguration**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/04/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,8 +61,8 @@ ms.date: 12/04/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml), and then needs to be base64 encoded before being added to SyncML.
If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied.
@ -117,7 +119,7 @@ Here is the SyncMl example:
</SyncML>
```
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
@ -129,4 +131,3 @@ Footnote:
<!--EndPolicies-->

156
windows/client-management/mdm/policy-csp-applicationmanagement.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - ApplicationManagement
@ -54,11 +54,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-allowalltrustedapps"></a>**ApplicationManagement/AllowAllTrustedApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -80,8 +82,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -89,13 +91,13 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether non Microsoft Store apps are allowed.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -105,11 +107,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-allowappstoreautoupdate"></a>**ApplicationManagement/AllowAppStoreAutoUpdate**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -131,8 +135,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -140,8 +144,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether automatic update of apps from Microsoft Store are allowed.
The following list shows the supported values:
@ -151,13 +155,15 @@ The following list shows the supported values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-allowdeveloperunlock"></a>**ApplicationManagement/AllowDeveloperUnlock**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -179,8 +185,8 @@ Most restricted value is 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -188,13 +194,13 @@ Most restricted value is 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether developer unlock is allowed.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -204,11 +210,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-allowgamedvr"></a>**ApplicationManagement/AllowGameDVR**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -230,8 +238,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -239,8 +247,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -248,7 +256,7 @@ Specifies whether DVR and broadcasting is allowed.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -257,11 +265,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-allowshareduserappdata"></a>**ApplicationManagement/AllowSharedUserAppData**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -283,8 +293,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -292,13 +302,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether multiple users of the same app can share data.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -307,11 +317,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-allowstore"></a>**ApplicationManagement/AllowStore**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -333,8 +345,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -342,13 +354,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether app store is allowed at the device.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -357,11 +369,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-applicationrestrictions"></a>**ApplicationManagement/ApplicationRestrictions**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -383,8 +397,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -392,8 +406,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead.
@ -418,13 +432,15 @@ Value type is chr.
Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-disablestoreoriginatedapps"></a>**ApplicationManagement/DisableStoreOriginatedApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -446,8 +462,8 @@ Value evaluation rule - The information for PolicyManager is opaque. There is no
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -455,11 +471,11 @@ Value evaluation rule - The information for PolicyManager is opaque. There is no
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -468,11 +484,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-requireprivatestoreonly"></a>**ApplicationManagement/RequirePrivateStoreOnly**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -494,8 +512,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -503,8 +521,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows disabling of the retail catalog and only enables the Private store.
The following list shows the supported values:
@ -514,13 +532,15 @@ The following list shows the supported values:
Most restricted value is 1.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-restrictappdatatosystemvolume"></a>**ApplicationManagement/RestrictAppDataToSystemVolume**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -542,8 +562,8 @@ Most restricted value is 1.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -551,13 +571,13 @@ Most restricted value is 1.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether application data is restricted to the system drive.
Most restricted value is 1.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -566,11 +586,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="applicationmanagement-restrictapptosystemvolume"></a>**ApplicationManagement/RestrictAppToSystemVolume**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -592,8 +614,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -601,13 +623,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether the installation of applications is restricted to the system drive.
Most restricted value is 1.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

506
windows/client-management/mdm/policy-csp-appvirtualization.md
View File

File diff suppressed because it is too large Load Diff

56
windows/client-management/mdm/policy-csp-attachmentmanager.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - AttachmentManager
@ -30,11 +30,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="attachmentmanager-donotpreservezoneinformation"></a>**AttachmentManager/DoNotPreserveZoneInformation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,8 +67,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information, Windows cannot make proper risk assessments.
If you enable this policy setting, Windows does not mark file attachments with their zone information.
@ -75,7 +77,7 @@ If you disable this policy setting, Windows marks file attachments with their zo
If you do not configure this policy setting, Windows marks file attachments with their zone information.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -83,20 +85,22 @@ If you do not configure this policy setting, Windows marks file attachments with
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not preserve zone information in file attachments*
- GP name: *AM_MarkZoneOnSavedAtttachments*
- GP path: *Windows Components/Attachment Manager*
- GP ADMX file name: *AttachmentManager.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="attachmentmanager-hidezoneinfomechanism"></a>**AttachmentManager/HideZoneInfoMechanism**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -118,8 +122,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -127,8 +131,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the file's property sheet or by using a check box in the security warning dialog. Removing the zone information allows users to open potentially dangerous file attachments that Windows has blocked users from opening.
If you enable this policy setting, Windows hides the check box and Unblock button.
@ -137,7 +141,7 @@ If you disable this policy setting, Windows shows the check box and Unblock butt
If you do not configure this policy setting, Windows hides the check box and Unblock button.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -145,20 +149,22 @@ If you do not configure this policy setting, Windows hides the check box and Unb
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Hide mechanisms to remove zone information*
- GP name: *AM_RemoveZoneInfo*
- GP path: *Windows Components/Attachment Manager*
- GP ADMX file name: *AttachmentManager.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="attachmentmanager-notifyantivirusprograms"></a>**AttachmentManager/NotifyAntivirusPrograms**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -180,8 +186,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -189,8 +195,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant.
If you enable this policy setting, Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened.
@ -199,7 +205,7 @@ If you disable this policy setting, Windows does not call the registered antivir
If you do not configure this policy setting, Windows does not call the registered antivirus programs when file attachments are opened.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -207,14 +213,14 @@ If you do not configure this policy setting, Windows does not call the registere
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Notify antivirus programs when opening attachments*
- GP name: *AM_CallIOfficeAntiVirus*
- GP path: *Windows Components/Attachment Manager*
- GP ADMX file name: *AttachmentManager.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

74
windows/client-management/mdm/policy-csp-authentication.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Authentication
@ -36,11 +36,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="authentication-allowaadpasswordreset"></a>**Authentication/AllowAadPasswordReset**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -62,8 +64,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -71,11 +73,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen. 
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -84,11 +86,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="authentication-alloweapcertsso"></a>**Authentication/AllowEAPCertSSO**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -110,8 +114,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -119,11 +123,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -132,11 +136,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="authentication-allowfastreconnect"></a>**Authentication/AllowFastReconnect**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -158,8 +164,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -167,13 +173,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows EAP Fast Reconnect from being attempted for EAP Method TLS.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -182,11 +188,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="authentication-allowfidodevicesignon"></a>**Authentication/AllowFidoDeviceSignon**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -208,8 +216,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -217,15 +225,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0
Value type is integer.
Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -234,11 +242,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="authentication-allowsecondaryauthenticationdevice"></a>**Authentication/AllowSecondaryAuthenticationDevice**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -260,8 +270,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -269,13 +279,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows.
The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premise only environment, cloud domain-joined in a hybrid environment, and BYOD).
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

56
windows/client-management/mdm/policy-csp-autoplay.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Autoplay
@ -30,11 +30,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="autoplay-disallowautoplayfornonvolumedevices"></a>**Autoplay/DisallowAutoplayForNonVolumeDevices**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -66,15 +68,15 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting disallows AutoPlay for MTP devices like cameras or phones.
If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.
If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -82,20 +84,22 @@ If you disable or do not configure this policy setting, AutoPlay is enabled for
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Disallow Autoplay for non-volume devices*
- GP name: *NoAutoplayfornonVolume*
- GP path: *Windows Components/AutoPlay Policies*
- GP ADMX file name: *AutoPlay.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="autoplay-setdefaultautorunbehavior"></a>**Autoplay/SetDefaultAutoRunBehavior**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -117,8 +121,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -127,8 +131,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting sets the default behavior for Autorun commands.
Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.
@ -144,7 +148,7 @@ b) Revert back to pre-Windows Vista behavior of automatically executing the auto
If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -152,20 +156,22 @@ If you disable or not configure this policy setting, Windows Vista or later will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Set the default behavior for AutoRun*
- GP name: *NoAutorun*
- GP path: *Windows Components/AutoPlay Policies*
- GP ADMX file name: *AutoPlay.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="autoplay-turnoffautoplay"></a>**Autoplay/TurnOffAutoPlay**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -187,8 +193,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -197,8 +203,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to turn off the Autoplay feature.
Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.
@ -215,7 +221,7 @@ If you disable or do not configure this policy setting, AutoPlay is enabled.
Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -223,14 +229,14 @@ Note: This policy setting appears in both the Computer Configuration and User Co
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off Autoplay*
- GP name: *Autorun*
- GP path: *Windows Components/AutoPlay Policies*
- GP ADMX file name: *AutoPlay.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

16
windows/client-management/mdm/policy-csp-bitlocker.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Bitlocker
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="bitlocker-encryptionmethod"></a>**Bitlocker/EncryptionMethod**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,8 +61,8 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies the BitLocker Drive Encryption method and cipher strength.
> [!NOTE]
@ -94,7 +96,7 @@ You can find the following policies in BitLocker CSP:
</dd>
</dl>
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

72
windows/client-management/mdm/policy-csp-bluetooth.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Bluetooth
@ -36,11 +36,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="bluetooth-allowadvertising"></a>**Bluetooth/AllowAdvertising**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -62,8 +64,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -71,15 +73,15 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether the device can send out Bluetooth advertisements.
If this is not set or it is deleted, the default value of 1 (Allow) is used.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -88,11 +90,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="bluetooth-allowdiscoverablemode"></a>**Bluetooth/AllowDiscoverableMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -114,8 +118,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -123,15 +127,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether other Bluetooth-enabled devices can discover the device.
If this is not set or it is deleted, the default value of 1 (Allow) is used.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -140,11 +144,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="bluetooth-allowprepairing"></a>**Bluetooth/AllowPrepairing**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -166,8 +172,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -175,11 +181,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -188,11 +194,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="bluetooth-localdevicename"></a>**Bluetooth/LocalDeviceName**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -214,8 +222,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -223,21 +231,23 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Sets the local Bluetooth device name.
If this is set, the value that it is set to will be used as the Bluetooth device name. To verify the policy is set, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that the value that was specified.
If this policy is not set or it is deleted, the default local radio name is used.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="bluetooth-servicesallowedlist"></a>**Bluetooth/ServicesAllowedList**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -259,8 +269,8 @@ If this policy is not set or it is deleted, the default local radio name is used
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -268,13 +278,13 @@ If this policy is not set or it is deleted, the default local radio name is used
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}.
The default value is an empty string.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

553
windows/client-management/mdm/policy-csp-browser.md
View File

File diff suppressed because it is too large Load Diff

16
windows/client-management/mdm/policy-csp-camera.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Camera
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="camera-allowcamera"></a>**Camera/AllowCamera**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,13 +61,13 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Disables or enables the camera.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

76
windows/client-management/mdm/policy-csp-cellular.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/13/2017
ms.date: 01/29/2018
---
# Policy CSP - Cellular
@ -36,11 +36,13 @@ ms.date: 12/13/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="cellular-letappsaccesscellulardata"></a>**Cellular/LetAppsAccessCellularData**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -62,8 +64,8 @@ ms.date: 12/13/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -71,8 +73,8 @@ ms.date: 12/13/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. This policy setting specifies whether Windows apps can access cellular data.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
@ -87,7 +89,7 @@ If you disable or do not configure this policy setting, employees in your organi
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.”
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -97,11 +99,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="cellular-letappsaccesscellulardata_forceallowtheseapps"></a>**Cellular/LetAppsAccessCellularData_ForceAllowTheseApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -123,8 +127,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -132,17 +136,19 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="cellular-letappsaccesscellulardata_forcedenytheseapps"></a>**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -164,8 +170,8 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -173,17 +179,19 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="cellular-letappsaccesscellulardata_userincontroloftheseapps"></a>**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -205,8 +213,8 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -214,17 +222,19 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="cellular-showappcellularaccessui"></a>**Cellular/ShowAppCellularAccessUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -246,8 +256,8 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -255,8 +265,8 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX.
If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page.
@ -268,7 +278,7 @@ Supported values:
- 0 - Hide
- 1 - Show
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -276,14 +286,14 @@ Supported values:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Set Per-App Cellular Access UI Visibility*
- GP name: *ShowAppCellularAccessUI*
- GP path: *Network/WWAN Service/WWAN UI Settings*
- GP ADMX file name: *wwansvc.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

218
windows/client-management/mdm/policy-csp-connectivity.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Connectivity
@ -63,11 +63,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowbluetooth"></a>**Connectivity/AllowBluetooth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -89,8 +91,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -98,8 +100,8 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows the user to enable Bluetooth or restrict access.
> [!NOTE]
@ -109,7 +111,7 @@ If this is not set or it is deleted, the default value of 2 (Allow) is used.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -119,11 +121,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowcellulardata"></a>**Connectivity/AllowCellularData**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -145,8 +149,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -154,11 +158,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows the cellular data channel on the device. Device reboot is not required to enforce the policy.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -168,11 +172,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowcellulardataroaming"></a>**Connectivity/AllowCellularDataRoaming**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -194,8 +200,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -203,13 +209,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -229,11 +235,13 @@ To validate on mobile devices, do the following:
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowconnecteddevices"></a>**Connectivity/AllowConnectedDevices**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -255,8 +263,8 @@ To validate on mobile devices, do the following:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -264,14 +272,14 @@ To validate on mobile devices, do the following:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy requires reboot to take effect.
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -280,11 +288,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allownfc"></a>**Connectivity/AllowNFC**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -306,8 +316,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -315,8 +325,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -325,7 +335,7 @@ Allows or disallows near field communication (NFC) on the device.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -334,11 +344,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowusbconnection"></a>**Connectivity/AllowUSBConnection**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -360,8 +372,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -369,8 +381,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -381,7 +393,7 @@ Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -390,11 +402,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowvpnovercellular"></a>**Connectivity/AllowVPNOverCellular**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -416,8 +430,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -425,13 +439,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies what type of underlying connections VPN is allowed to use.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -440,11 +454,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-allowvpnroamingovercellular"></a>**Connectivity/AllowVPNRoamingOverCellular**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -466,8 +482,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -475,13 +491,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Prevents the device from connecting to VPN when the device roams over cellular networks.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -490,11 +506,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-diableprintingoverhttp"></a>**Connectivity/DiablePrintingOverHTTP**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -516,8 +534,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -525,10 +543,10 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -536,20 +554,22 @@ The following list shows the supported values:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off printing over HTTP*
- GP name: *DisableHTTPPrinting_2*
- GP path: *Internet Communication settings*
- GP ADMX file name: *ICM.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-disabledownloadingofprintdriversoverhttp"></a>**Connectivity/DisableDownloadingOfPrintDriversOverHTTP**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -571,8 +591,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -580,10 +600,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -591,20 +611,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off downloading of print drivers over HTTP*
- GP name: *DisableWebPnPDownload_2*
- GP path: *Internet Communication settings*
- GP ADMX file name: *ICM.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards"></a>**Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -626,8 +648,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -635,10 +657,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -646,20 +668,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off Internet download for Web publishing and online ordering wizards*
- GP name: *ShellPreventWPWDownload_2*
- GP path: *Internet Communication settings*
- GP ADMX file name: *ICM.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-disallownetworkconnectivityactivetests"></a>**Connectivity/DisallowNetworkConnectivityActiveTests**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -681,8 +705,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -690,19 +714,21 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com.
Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-hardeneduncpaths"></a>**Connectivity/HardenedUNCPaths**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -724,8 +750,8 @@ Value type is integer.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -733,13 +759,13 @@ Value type is integer.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting configures secure access to UNC paths.
If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -747,20 +773,22 @@ If you enable this policy, Windows only allows access to the specified UNC paths
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Hardened UNC Paths*
- GP name: *Pol_HardenedPaths*
- GP path: *Network/Network Provider*
- GP ADMX file name: *networkprovider.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="connectivity-prohibitinstallationandconfigurationofnetworkbridge"></a>**Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -782,8 +810,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -791,10 +819,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -802,14 +830,14 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Prohibit installation and configuration of Network Bridge on your DNS domain network*
- GP name: *NC_AllowNetBridge_NLA*
- GP path: *Network/Network Connections*
- GP ADMX file name: *NetworkConnections.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

23
windows/client-management/mdm/policy-csp-controlpolicyconflict.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/11/2018
ms.date: 01/29/2018
---
# Policy CSP - ControlPolicyConflict
@ -26,11 +26,13 @@ ms.date: 01/11/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="controlpolicyconflict-mdmwinsovergp"></a>**ControlPolicyConflict/MDMWinsOverGP**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -52,8 +54,8 @@ ms.date: 01/11/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -61,8 +63,8 @@ ms.date: 01/11/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device.
This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. In next major update, the MDM policies in Policy CSP will behave as described if this policy value is set 1.
@ -73,21 +75,14 @@ The policy should be set at every sync to ensure the device removes any settings
- The current Policy Manager policies are refreshed from what MDM has set
- Any values set by scripts/user outside of GP that conflict with MDM are removed
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 (default)
- 1 - The MDM policy is used and the GP policy is blocked.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>

52
windows/client-management/mdm/policy-csp-credentialproviders.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - CredentialProviders
@ -30,11 +30,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="credentialproviders-allowpinlogon"></a>**CredentialProviders/AllowPINLogon**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,8 +67,8 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to control whether a domain user can sign in using a convenience PIN.
If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.
@ -77,7 +79,7 @@ Note: The user's domain password will be cached in the system vault when using t
To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -85,20 +87,22 @@ To configure Windows Hello for Business, use the Administrative Template policie
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn on convenience PIN sign-in*
- GP name: *AllowDomainPINLogon*
- GP path: *System/Logon*
- GP ADMX file name: *credentialproviders.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="credentialproviders-blockpicturepassword"></a>**CredentialProviders/BlockPicturePassword**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -120,8 +124,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -129,8 +133,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to control whether a domain user can sign in using a picture password.
If you enable this policy setting, a domain user can't set up or sign in with a picture password.
@ -139,7 +143,7 @@ If you disable or don't configure this policy setting, a domain user can set up
Note that the user's domain password will be cached in the system vault when using this feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -147,20 +151,22 @@ Note that the user's domain password will be cached in the system vault when usi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off picture password sign-in*
- GP name: *BlockDomainPicturePassword*
- GP path: *System/Logon*
- GP ADMX file name: *credentialproviders.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="credentialproviders-disableautomaticredeploymentcredentials"></a>**CredentialProviders/DisableAutomaticReDeploymentCredentials**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -182,8 +188,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -191,13 +197,13 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Boolean policy to disable the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device.
The Windows 10 Automatic ReDeployment feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

38
windows/client-management/mdm/policy-csp-credentialsui.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - CredentialsUI
@ -27,11 +27,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="credentialsui-disablepasswordreveal"></a>**CredentialsUI/DisablePasswordReveal**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -63,8 +65,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to configure the display of the password reveal button in password entry user experiences.
If you enable this policy setting, the password reveal button will not be displayed after a user types a password in the password entry text box.
@ -75,7 +77,7 @@ By default, the password reveal button is displayed after a user types a passwor
The policy applies to all Windows components and applications that use the Windows system controls, including Internet Explorer.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -83,20 +85,22 @@ The policy applies to all Windows components and applications that use the Windo
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not display the password reveal button*
- GP name: *DisablePasswordReveal*
- GP path: *Windows Components/Credential User Interface*
- GP ADMX file name: *credui.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="credentialsui-enumerateadministrators"></a>**CredentialsUI/EnumerateAdministrators**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -118,8 +122,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -127,15 +131,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application.
If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.
If you disable this policy setting, users will always be required to type a user name and password to elevate.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -143,14 +147,14 @@ If you disable this policy setting, users will always be required to type a user
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Enumerate administrator accounts on elevation*
- GP name: *EnumerateAdministrators*
- GP path: *Windows Components/Credential User Interface*
- GP ADMX file name: *credui.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

30
windows/client-management/mdm/policy-csp-cryptography.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Cryptography
@ -27,11 +27,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="cryptography-allowfipsalgorithmpolicy"></a>**Cryptography/AllowFipsAlgorithmPolicy**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,8 +64,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows or disallows the Federal Information Processing Standard (FIPS) policy.
The following list shows the supported values:
@ -71,13 +73,15 @@ The following list shows the supported values:
- 0 (default) – Not allowed.
- 1– Allowed.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="cryptography-tlsciphersuites"></a>**Cryptography/TLSCipherSuites**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -99,8 +103,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -108,11 +112,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

30
windows/client-management/mdm/policy-csp-dataprotection.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - DataProtection
@ -27,11 +27,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="dataprotection-allowdirectmemoryaccess"></a>**DataProtection/AllowDirectMemoryAccess**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,13 +64,13 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host plug PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug PCI ports with no children devices until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged. This policy setting is only enforced when BitLocker or device encryption is enabled.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -77,11 +79,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="dataprotection-legacyselectivewipeid"></a>**DataProtection/LegacySelectiveWipeID**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -103,8 +107,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -112,8 +116,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!IMPORTANT]
> This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time.
@ -123,7 +127,7 @@ Setting used by Windows 8.1 Selective Wipe.
> [!NOTE]
> This policy is not recommended for use in Windows 10.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

38
windows/client-management/mdm/policy-csp-datausage.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - DataUsage
@ -27,11 +27,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="datausage-setcost3g"></a>**DataUsage/SetCost3G**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,8 +64,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting configures the cost of 3G connections on the local machine.
If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine:
@ -76,7 +78,7 @@ If this policy setting is enabled, a drop-down list box presenting possible cost
If this policy setting is disabled or is not configured, the cost of 3G connections is Fixed by default.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -84,20 +86,22 @@ If this policy setting is disabled or is not configured, the cost of 3G connecti
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Set 3G Cost*
- GP name: *SetCost3G*
- GP path: *Network/WWAN Service/WWAN Media Cost*
- GP ADMX file name: *wwansvc.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="datausage-setcost4g"></a>**DataUsage/SetCost4G**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -119,8 +123,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -128,8 +132,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting configures the cost of 4G connections on the local machine.
If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 4G connections on the local machine:
@ -142,7 +146,7 @@ If this policy setting is enabled, a drop-down list box presenting possible cost
If this policy setting is disabled or is not configured, the cost of 4G connections is Fixed by default.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -150,14 +154,14 @@ If this policy setting is disabled or is not configured, the cost of 4G connecti
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Set 4G Cost*
- GP name: *SetCost4G*
- GP path: *Network/WWAN Service/WWAN Media Cost*
- GP ADMX file name: *wwansvc.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

492
windows/client-management/mdm/policy-csp-defender.md
View File

File diff suppressed because it is too large Load Diff

391
windows/client-management/mdm/policy-csp-deliveryoptimization.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/03/2018
ms.date: 01/29/2018
---
# Policy CSP - DeliveryOptimization
@ -95,11 +95,13 @@ ms.date: 01/03/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-doabsolutemaxcachesize"></a>**DeliveryOptimization/DOAbsoluteMaxCacheSize**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -121,8 +123,8 @@ ms.date: 01/03/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -130,8 +132,8 @@ ms.date: 01/03/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -140,13 +142,15 @@ Added in Windows 10, version 1607. Specifies the maximum size in GB of Delivery
The default value is 10.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-doallowvpnpeercaching"></a>**DeliveryOptimization/DOAllowVPNPeerCaching**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -168,8 +172,8 @@ The default value is 10.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -177,15 +181,15 @@ The default value is 10.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
Added in Windows 10, version 1703. Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -194,11 +198,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dodelaybackgrounddownloadfromhttp"></a>**DeliveryOptimization/DODelayBackgroundDownloadFromHttp**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -220,8 +226,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -229,28 +235,21 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This policy allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer.
After the max delay is reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from peers. Note that a download that is waiting for peer sources, will appear to be stuck for the end user. The recommended value is 1 hour (3600).
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dodelayforegrounddownloadfromhttp"></a>**DeliveryOptimization/DODelayForegroundDownloadFromHttp**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -272,8 +271,8 @@ After the max delay is reached, the download will resume using HTTP, either down
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -281,8 +280,8 @@ After the max delay is reached, the download will resume using HTTP, either down
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer.
After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from Peers.
@ -291,26 +290,23 @@ Note that a download that is waiting for peer sources, will appear to be stuck f
The recommended value is 1 minute (60).
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values as number of seconds:
- 0 to 86400 (1 day)
- 0 - managed by the cloud service
- Default is not configured.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dodownloadmode"></a>**DeliveryOptimization/DODownloadMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -332,8 +328,8 @@ The following list shows the supported values as number of seconds:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -341,15 +337,15 @@ The following list shows the supported values as number of seconds:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -362,11 +358,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dogroupid"></a>**DeliveryOptimization/DOGroupId**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -388,8 +386,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -397,8 +395,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -408,13 +406,15 @@ This Policy specifies an arbitrary group ID that the device belongs to. Use this
> [!NOTE]
> You must use a GUID as the group ID.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dogroupidsource"></a>**DeliveryOptimization/DOGroupIdSource**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -436,8 +436,8 @@ This Policy specifies an arbitrary group ID that the device belongs to. Use this
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -445,8 +445,8 @@ This Policy specifies an arbitrary group ID that the device belongs to. Use this
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Set this policy to restrict peer selection to a specific source. Options available are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix
When set, the Group ID will be assigned automatically from the selected source.
@ -457,7 +457,7 @@ The options set in this policy only apply to Group (2) download mode. If Group (
For option 4 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -465,19 +465,16 @@ The following list shows the supported values:
- 2 - Authenticated domain SID
- 3 - DHCP user option
- 4 - DNS suffix
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domaxcacheage"></a>**DeliveryOptimization/DOMaxCacheAge**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -499,8 +496,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -508,8 +505,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -518,13 +515,15 @@ Specifies the maximum time in seconds that each file is held in the Delivery Opt
The default value is 259200 seconds (3 days).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domaxcachesize"></a>**DeliveryOptimization/DOMaxCacheSize**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -546,8 +545,8 @@ The default value is 259200 seconds (3 days).
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -555,8 +554,8 @@ The default value is 259200 seconds (3 days).
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -565,13 +564,15 @@ Specifies the maximum cache size that Delivery Optimization can utilize, as a pe
The default value is 20.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domaxdownloadbandwidth"></a>**DeliveryOptimization/DOMaxDownloadBandwidth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -593,8 +594,8 @@ The default value is 20.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -602,8 +603,8 @@ The default value is 20.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
 
@ -612,13 +613,15 @@ Added in Windows 10, version 1607. Specifies the maximum download bandwidth in
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domaxuploadbandwidth"></a>**DeliveryOptimization/DOMaxUploadBandwidth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -640,8 +643,8 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -649,8 +652,8 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -659,13 +662,15 @@ Specifies the maximum upload bandwidth in KiloBytes/second that a device will us
The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dominbackgroundqos"></a>**DeliveryOptimization/DOMinBackgroundQos**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -687,8 +692,8 @@ The default value is 0, which permits unlimited possible bandwidth (optimized fo
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -696,8 +701,8 @@ The default value is 0, which permits unlimited possible bandwidth (optimized fo
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -706,13 +711,15 @@ Added in Windows 10, version 1607. Specifies the minimum download QoS (Quality
The default value is 500.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dominbatterypercentageallowedtoupload"></a>**DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -734,8 +741,8 @@ The default value is 500.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -743,8 +750,8 @@ The default value is 500.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -752,13 +759,15 @@ Added in Windows 10, version 1703. Specifies any value between 1 and 100 (in pe
The default value is 0. The value 0 (zero) means "not limited" and the cloud service default value will be used.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domindisksizeallowedtopeer"></a>**DeliveryOptimization/DOMinDiskSizeAllowedToPeer**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -780,8 +789,8 @@ The default value is 0. The value 0 (zero) means "not limited" and the cloud ser
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -789,8 +798,8 @@ The default value is 0. The value 0 (zero) means "not limited" and the cloud ser
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -802,13 +811,15 @@ Added in Windows 10, version 1703. Specifies the required minimum disk size (cap
The default value is 32 GB.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dominfilesizetocache"></a>**DeliveryOptimization/DOMinFileSizeToCache**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -830,8 +841,8 @@ The default value is 32 GB.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -839,8 +850,8 @@ The default value is 32 GB.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -849,13 +860,15 @@ Added in Windows 10, version 1703. Specifies the minimum content file size in MB
The default value is 100 MB.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dominramallowedtopeer"></a>**DeliveryOptimization/DOMinRAMAllowedToPeer**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -877,8 +890,8 @@ The default value is 100 MB.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -886,8 +899,8 @@ The default value is 100 MB.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -896,13 +909,15 @@ Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required
The default value is 4 GB.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domodifycachedrive"></a>**DeliveryOptimization/DOModifyCacheDrive**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -924,8 +939,8 @@ The default value is 4 GB.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -933,8 +948,8 @@ The default value is 4 GB.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -943,13 +958,15 @@ Added in Windows 10, version 1607. Specifies the drive that Delivery Optimizati
By default, %SystemDrive% is used to store the cache.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-domonthlyuploaddatacap"></a>**DeliveryOptimization/DOMonthlyUploadDataCap**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -971,8 +988,8 @@ By default, %SystemDrive% is used to store the cache.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -980,8 +997,8 @@ By default, %SystemDrive% is used to store the cache.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
@ -992,13 +1009,15 @@ The value 0 (zero) means "unlimited"; No monthly upload limit is applied if 0 is
The default value is 20.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dopercentagemaxbackdownloadbandwidth"></a>**DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1020,8 +1039,8 @@ The default value is 20.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1029,36 +1048,32 @@ The default value is 20.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads.
Note that downloads from LAN peers will not be throttled even when this policy is set.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dopercentagemaxdownloadbandwidth"></a>**DeliveryOptimization/DOPercentageMaxDownloadBandwidth**
<!--StartDescription-->
<!--Description-->
This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryoptimization-dopercentagemaxforedownloadbandwidth) and [DOPercentageMaxBackDownloadBandwidth](#deliveryoptimization-dopercentagemaxbackdownloadbandwidth) policies instead.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dopercentagemaxforedownloadbandwidth"></a>**DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1080,8 +1095,8 @@ This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryo
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1089,27 +1104,21 @@ This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryo
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads.
Note that downloads from LAN peers will not be throttled even when this policy is set.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dorestrictpeerselectionby"></a>**DeliveryOptimization/DORestrictPeerSelectionBy**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1131,8 +1140,8 @@ Note that downloads from LAN peers will not be throttled even when this policy i
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1140,32 +1149,28 @@ Note that downloads from LAN peers will not be throttled even when this policy i
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Set this policy to restrict peer selection via selected option.
Options available are: 1=Subnet mask (more options will be added in a future release).
Option 1 (Subnet mask) applies to both Download Mode LAN (1) and Group (2).
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 1 - Subnet mask.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth"></a>**DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1187,8 +1192,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1196,31 +1201,29 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
Note that downloads from LAN peers will not be throttled even when this policy is set.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
This policy allows an IT Admin to define the following:
- Business hours range (for example 06:00 to 18:00)
- % of throttle for foreground traffic during business hours
- % of throttle for foreground traffic outside of business hours
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth"></a>**DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1242,8 +1245,8 @@ This policy allows an IT Admin to define the following:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1251,25 +1254,21 @@ This policy allows an IT Admin to define the following:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
Note that downloads from LAN peers will not be throttled even when this policy is set.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
This policy allows an IT Admin to define the following:
- Business hours range (for example 06:00 to 18:00)
- % of throttle for foreground traffic during business hours
- % of throttle for foreground traffic outside of business hours
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>

20
windows/client-management/mdm/policy-csp-desktop.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Desktop
@ -24,11 +24,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="desktop-preventuserredirectionofprofilefolders"></a>**Desktop/PreventUserRedirectionOfProfileFolders**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,15 +61,15 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Prevents users from changing the path to their profile folders.
By default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box.
If you enable this setting, users are unable to type a new location in the Target box.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -75,14 +77,14 @@ If you enable this setting, users are unable to type a new location in the Targe
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Prohibit User from manually redirecting Profile Folders*
- GP name: *DisablePersonalDirChange*
- GP path: *Desktop*
- GP ADMX file name: *desktop.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

48
windows/client-management/mdm/policy-csp-deviceguard.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - DeviceGuard
@ -30,11 +30,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="deviceguard-enablevirtualizationbasedsecurity"></a>**DeviceGuard/EnableVirtualizationBasedSecurity**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,12 +67,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
 
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -79,11 +80,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deviceguard-lsacfgflags"></a>**DeviceGuard/LsaCfgFlags**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -105,8 +108,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -114,12 +117,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
 
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -129,11 +131,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deviceguard-requireplatformsecurityfeatures"></a>**DeviceGuard/RequirePlatformSecurityFeatures**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -155,8 +159,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -164,13 +168,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specifies the platform security level at the next reboot. Value type is integer.
 
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

38
windows/client-management/mdm/policy-csp-deviceinstallation.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - DeviceInstallation
@ -27,11 +27,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="deviceinstallation-preventinstallationofmatchingdeviceids"></a>**DeviceInstallation/PreventInstallationOfMatchingDeviceIDs**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,15 +64,15 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -78,20 +80,22 @@ If you disable or do not configure this policy setting, devices can be installed
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Prevent installation of devices that match any of these device IDs*
- GP name: *DeviceInstall_IDs_Deny*
- GP path: *System/Device Installation/Device Installation Restrictions*
- GP ADMX file name: *deviceinstallation.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="deviceinstallation-preventinstallationofmatchingdevicesetupclasses"></a>**DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -113,8 +117,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -122,15 +126,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -138,14 +142,14 @@ If you disable or do not configure this policy setting, Windows can install and
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Prevent installation of devices using drivers that match these device setup classes*
- GP name: *DeviceInstall_Classes_Deny*
- GP path: *System/Device Installation/Device Installation Restrictions*
- GP ADMX file name: *deviceinstallation.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

255
windows/client-management/mdm/policy-csp-devicelock.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/12/2018
ms.date: 01/29/2018
---
# Policy CSP - DeviceLock
@ -74,11 +74,13 @@ ms.date: 01/12/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-allowidlereturnwithoutpassword"></a>**DeviceLock/AllowIdleReturnWithoutPassword**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -100,8 +102,8 @@ ms.date: 01/12/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -109,8 +111,8 @@ ms.date: 01/12/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -120,7 +122,7 @@ Specifies whether the user must input a PIN or password when the device resumes
> [!NOTE]
> This policy must be wrapped in an Atomic command.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -129,11 +131,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-allowscreentimeoutwhilelockeduserconfig"></a>**DeviceLock/AllowScreenTimeoutWhileLockedUserConfig**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -155,8 +159,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -164,8 +168,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -184,13 +188,15 @@ The following list shows the supported values:
> [!IMPORTANT]
> If this policy is set to 1 (Allowed), the value set by **DeviceLock/ScreenTimeOutWhileLocked** is ignored. To ensure enterprise control over the screen timeout, set this policy to 0 (Not allowed) and use **DeviceLock/ScreenTimeOutWhileLocked** to set the screen timeout period.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-allowsimpledevicepassword"></a>**DeviceLock/AllowSimpleDevicePassword**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -212,8 +218,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -221,8 +227,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords.
> [!NOTE]
@ -236,13 +242,15 @@ The following list shows the supported values:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-alphanumericdevicepasswordrequired"></a>**DeviceLock/AlphanumericDevicePasswordRequired**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -264,8 +272,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -273,8 +281,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Determines the type of PIN or password required. This policy only applies if the **DeviceLock/DevicePasswordEnabled** policy is set to 0 (required).
> [!NOTE]
@ -294,15 +302,15 @@ The following list shows the supported values:
>
> If **AlphanumericDevicePasswordRequired** is set to 0, then MinDevicePasswordLength = 4 and MinDevicePasswordComplexCharacters = 2.
 
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-devicepasswordenabled"></a>**DeviceLock/DevicePasswordEnabled**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -324,8 +332,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -333,8 +341,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether device lock is enabled.
> [!NOTE]
@ -382,13 +390,15 @@ The following list shows the supported values:
> - MaxDevicePasswordFailedAttempts
> - MaxInactivityTimeDeviceLock
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-devicepasswordexpiration"></a>**DeviceLock/DevicePasswordExpiration**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -410,8 +420,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -419,8 +429,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies when the password expires (in days).
> [!NOTE]
@ -436,13 +446,15 @@ If all policy values = 0 then 0; otherwise, Min policy value is the most secure
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-devicepasswordhistory"></a>**DeviceLock/DevicePasswordHistory**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -464,8 +476,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -473,8 +485,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies how many passwords can be stored in the history that can’t be used.
> [!NOTE]
@ -492,13 +504,15 @@ Max policy value is the most restricted.
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-enforcelockscreenandlogonimage"></a>**DeviceLock/EnforceLockScreenAndLogonImage**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -520,8 +534,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -529,8 +543,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Specifies the default lock screen and logon image shown when no user is signed in. It also sets the specified image for all users, which replaces the default image. The same image is used for both the lock and logon screens. Users will not be able to change this image.
> [!NOTE]
@ -539,13 +553,15 @@ Added in Windows 10, version 1607. Specifies the default lock screen and logon
Value type is a string, which is the full image filepath and filename.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-enforcelockscreenprovider"></a>**DeviceLock/EnforceLockScreenProvider**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -567,8 +583,8 @@ Value type is a string, which is the full image filepath and filename.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -576,8 +592,8 @@ Value type is a string, which is the full image filepath and filename.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider.
> [!NOTE]
@ -586,13 +602,15 @@ Added in Windows 10, version 1607. Restricts lock screen image to a specific lo
Value type is a string, which is the AppID.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-maxdevicepasswordfailedattempts"></a>**DeviceLock/MaxDevicePasswordFailedAttempts**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -614,8 +632,8 @@ Value type is a string, which is the AppID.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -623,8 +641,8 @@ Value type is a string, which is the AppID.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality.
> [!NOTE]
@ -647,13 +665,15 @@ Most secure value is 0 if all policy values = 0; otherwise, Min policy value is
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-maxinactivitytimedevicelock"></a>**DeviceLock/MaxInactivityTimeDeviceLock**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -675,8 +695,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -684,8 +704,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. Note the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy.
> [!NOTE]
@ -699,13 +719,15 @@ The following list shows the supported values:
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-maxinactivitytimedevicelockwithexternaldisplay"></a>**DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -727,8 +749,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -736,8 +758,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display.
> [!NOTE]
@ -749,13 +771,15 @@ The following list shows the supported values:
- An integer X where 0 &lt;= X &lt;= 999.
- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined."
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-mindevicepasswordcomplexcharacters"></a>**DeviceLock/MinDevicePasswordComplexCharacters**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -777,8 +801,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -786,8 +810,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password.
> [!NOTE]
@ -861,13 +885,15 @@ The enforcement of policies for Microsoft accounts happen on the server, and the
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-mindevicepasswordlength"></a>**DeviceLock/MinDevicePasswordLength**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -889,8 +915,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -898,8 +924,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies the minimum number or characters required in the PIN or password.
> [!NOTE]
@ -918,13 +944,15 @@ Max policy value is the most restricted.
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-minimumpasswordage"></a>**DeviceLock/MinimumPasswordAge**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -946,8 +974,8 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -955,30 +983,23 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0.
The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998.
Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-preventlockscreenslideshow"></a>**DeviceLock/PreventLockScreenSlideShow**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1000,8 +1021,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1009,15 +1030,15 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.
By default, users can enable a slide show that will run after they lock the machine.
If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -1025,20 +1046,22 @@ If you enable this setting, users will no longer be able to modify slide show se
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Prevent enabling lock screen slide show*
- GP name: *CPL_Personalization_NoLockScreenSlideshow*
- GP path: *Control Panel/Personalization*
- GP ADMX file name: *ControlPanelDisplay.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="devicelock-screentimeoutwhilelocked"></a>**DeviceLock/ScreenTimeoutWhileLocked**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1060,8 +1083,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1069,8 +1092,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
 
@ -1084,7 +1107,7 @@ The default value is 10.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

30
windows/client-management/mdm/policy-csp-display.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Display
@ -27,11 +27,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="display-turnoffgdidpiscalingforapps"></a>**Display/TurnOffGdiDPIScalingForApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,8 +64,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off.
@ -79,13 +81,15 @@ To validate on Desktop, do the following:
1. Configure the setting for an app which has GDI DPI scaling enabled via MDM or any other supported mechanisms.
2. Run the app and observe blurry text.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="display-turnongdidpiscalingforapps"></a>**Display/TurnOnGdiDPIScalingForApps**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -107,8 +111,8 @@ To validate on Desktop, do the following:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -116,8 +120,8 @@ To validate on Desktop, do the following:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on.
@ -133,7 +137,7 @@ To validate on Desktop, do the following:
1. Configure the setting for an app which uses GDI.
2. Run the app and observe crisp text.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

44
windows/client-management/mdm/policy-csp-education.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Education
@ -30,11 +30,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="education-defaultprintername"></a>**Education/DefaultPrinterName**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,19 +67,21 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. This policy allows IT Admins to set the user's default printer.
The policy value is expected to be the name (network host name) of an installed printer.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="education-preventaddingnewprinters"></a>**Education/PreventAddingNewPrinters**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -99,8 +103,8 @@ The policy value is expected to be the name (network host name) of an installed
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -108,11 +112,11 @@ The policy value is expected to be the name (network host name) of an installed
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Allows IT Admins to prevent user installation of additional printers from the printers settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -121,11 +125,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="education-printernames"></a>**Education/PrinterNames**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -147,8 +153,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -156,13 +162,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names).
The policy value is expected to be a ```&#xF000;``` seperated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

86
windows/client-management/mdm/policy-csp-enterprisecloudprint.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - EnterpriseCloudPrint
@ -39,11 +39,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="enterprisecloudprint-cloudprintoauthauthority"></a>**EnterpriseCloudPrint/CloudPrintOAuthAuthority**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -65,8 +67,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -74,21 +76,23 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. This policy must target ./User, otherwise it fails.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https:<span></span>//azuretenant.contoso.com/adfs".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="enterprisecloudprint-cloudprintoauthclientid"></a>**EnterpriseCloudPrint/CloudPrintOAuthClientId**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -110,8 +114,8 @@ The default value is an empty string. Otherwise, the value should contain the UR
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -119,21 +123,23 @@ The default value is an empty string. Otherwise, the value should contain the UR
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. This policy must target ./User, otherwise it fails.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain a GUID. For example, "E1CF1107-FF90-4228-93BF-26052DD2C714".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="enterprisecloudprint-cloudprintresourceid"></a>**EnterpriseCloudPrint/CloudPrintResourceId**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -155,8 +161,8 @@ The default value is an empty string. Otherwise, the value should contain a GUID
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -164,21 +170,23 @@ The default value is an empty string. Otherwise, the value should contain a GUID
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. This policy must target ./User, otherwise it fails.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain a URL. For example, "http:<span></span>//MicrosoftEnterpriseCloudPrint/CloudPrint".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="enterprisecloudprint-cloudprinterdiscoveryendpoint"></a>**EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -200,8 +208,8 @@ The default value is an empty string. Otherwise, the value should contain a URL.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -209,21 +217,23 @@ The default value is an empty string. Otherwise, the value should contain a URL.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. This policy must target ./User, otherwise it fails.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https:<span></span>//cloudprinterdiscovery.contoso.com".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="enterprisecloudprint-discoverymaxprinterlimit"></a>**EnterpriseCloudPrint/DiscoveryMaxPrinterLimit**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -245,8 +255,8 @@ The default value is an empty string. Otherwise, the value should contain the UR
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -254,21 +264,23 @@ The default value is an empty string. Otherwise, the value should contain the UR
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. This policy must target ./User, otherwise it fails.
The datatype is an integer.
For Windows Mobile, the default value is 20.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="enterprisecloudprint-mopriadiscoveryresourceid"></a>**EnterpriseCloudPrint/MopriaDiscoveryResourceId**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -290,8 +302,8 @@ For Windows Mobile, the default value is 20.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -299,15 +311,15 @@ For Windows Mobile, the default value is 20.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. This policy must target ./User, otherwise it fails.
The datatype is a string.
The default value is an empty string. Otherwise, the value should contain a URL. For example, "http:<span></span>//MopriaDiscoveryService/CloudPrint".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

92
windows/client-management/mdm/policy-csp-errorreporting.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - ErrorReporting
@ -36,11 +36,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="errorreporting-customizeconsentsettings"></a>**ErrorReporting/CustomizeConsentSettings**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -62,8 +64,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -71,8 +73,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting determines the consent behavior of Windows Error Reporting for specific event types.
If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4.
@ -89,7 +91,7 @@ If you enable this policy setting, you can add specific event types to a list by
If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -97,20 +99,22 @@ If you disable or do not configure this policy setting, then the default consent
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Customize consent settings*
- GP name: *WerConsentCustomize_2*
- GP path: *Windows Components/Windows Error Reporting/Consent*
- GP ADMX file name: *ErrorReporting.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="errorreporting-disablewindowserrorreporting"></a>**ErrorReporting/DisableWindowsErrorReporting**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -132,8 +136,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -141,15 +145,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails.
If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel.
If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -157,20 +161,22 @@ If you disable or do not configure this policy setting, the Turn off Windows Err
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Disable Windows Error Reporting*
- GP name: *WerDisable_2*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="errorreporting-displayerrornotification"></a>**ErrorReporting/DisplayErrorNotification**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -192,8 +198,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -201,8 +207,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls whether users are shown an error dialog box that lets them report an error.
If you enable this policy setting, users are notified in a dialog box that an error has occurred, and can display more details about the error. If the Configure Error Reporting policy setting is also enabled, the user can also report the error.
@ -213,7 +219,7 @@ If you do not configure this policy setting, users can change this setting in Co
See also the Configure Error Reporting policy setting.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -221,20 +227,22 @@ See also the Configure Error Reporting policy setting.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Display Error Notification*
- GP name: *PCH_ShowUI*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="errorreporting-donotsendadditionaldata"></a>**ErrorReporting/DoNotSendAdditionalData**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -256,8 +264,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -265,15 +273,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically.
If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user.
If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -281,20 +289,22 @@ If you disable or do not configure this policy setting, then consent policy sett
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not send additional data*
- GP name: *WerNoSecondLevelData_2*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="errorreporting-preventcriticalerrordisplay"></a>**ErrorReporting/PreventCriticalErrorDisplay**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -316,8 +326,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -325,15 +335,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting prevents the display of the user interface for critical errors.
If you enable this policy setting, Windows Error Reporting does not display any GUI-based error messages or dialog boxes for critical errors.
If you disable or do not configure this policy setting, Windows Error Reporting displays the user interface for critical errors.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -341,14 +351,14 @@ If you disable or do not configure this policy setting, Windows Error Reporting
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Prevent display of the user interface for critical errors*
- GP name: *WerDoNotShowUI*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

74
windows/client-management/mdm/policy-csp-eventlogservice.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - EventLogService
@ -33,11 +33,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="eventlogservice-controleventlogbehavior"></a>**EventLogService/ControlEventLogBehavior**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -59,8 +61,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -68,8 +70,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls Event Log behavior when the log file reaches its maximum size.
If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.
@ -78,7 +80,7 @@ If you disable or do not configure this policy setting and a log file reaches it
Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -86,20 +88,22 @@ Note: Old events may or may not be retained according to the "Backup log automat
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Control Event Log behavior when the log file reaches its maximum size*
- GP name: *Channel_Log_Retention_1*
- GP path: *Windows Components/Event Log Service/Application*
- GP ADMX file name: *eventlog.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="eventlogservice-specifymaximumfilesizeapplicationlog"></a>**EventLogService/SpecifyMaximumFileSizeApplicationLog**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -121,8 +125,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -130,15 +134,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -146,20 +150,22 @@ If you disable or do not configure this policy setting, the maximum size of the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the maximum log file size (KB)*
- GP name: *Channel_LogMaxSize_1*
- GP path: *Windows Components/Event Log Service/Application*
- GP ADMX file name: *eventlog.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="eventlogservice-specifymaximumfilesizesecuritylog"></a>**EventLogService/SpecifyMaximumFileSizeSecurityLog**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -181,8 +187,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -190,15 +196,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -206,20 +212,22 @@ If you disable or do not configure this policy setting, the maximum size of the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the maximum log file size (KB)*
- GP name: *Channel_LogMaxSize_2*
- GP path: *Windows Components/Event Log Service/Security*
- GP ADMX file name: *eventlog.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="eventlogservice-specifymaximumfilesizesystemlog"></a>**EventLogService/SpecifyMaximumFileSizeSystemLog**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -241,8 +249,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -250,15 +258,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -266,14 +274,14 @@ If you disable or do not configure this policy setting, the maximum size of the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the maximum log file size (KB)*
- GP name: *Channel_LogMaxSize_4*
- GP path: *Windows Components/Event Log Service/System*
- GP ADMX file name: *eventlog.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

282
windows/client-management/mdm/policy-csp-experience.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/19/2017
ms.date: 01/29/2018
---
# Policy CSP - Experience
@ -86,11 +86,13 @@ ms.date: 12/19/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowcopypaste"></a>**Experience/AllowCopyPaste**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -112,8 +114,8 @@ ms.date: 12/19/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -121,8 +123,8 @@ ms.date: 12/19/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -130,7 +132,7 @@ Specifies whether copy and paste is allowed.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -139,11 +141,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowcortana"></a>**Experience/AllowCortana**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -165,8 +169,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -174,13 +178,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether Cortana is allowed on the device. If you enable or don’t configure this setting, Cortana is allowed on the device. If you disable this setting, Cortana is turned off. When Cortana is off, users will still be able to use search to find items on the device.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -189,11 +193,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowdevicediscovery"></a>**Experience/AllowDeviceDiscovery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -215,8 +221,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -224,15 +230,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows users to turn on/off device discovery UX.
When set to 0 , the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -241,11 +247,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowfindmydevice"></a>**Experience/AllowFindMyDevice**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -267,8 +275,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -276,15 +284,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. This policy turns on Find My Device.
When Find My Device is on, the device and its location are registered in the cloud so that the device can be located when the user initiates a Find command from account.microsoft.com. In Windows 10, version 1709 devices that are compatible with active digitizers, enabling Find My Device will also allow the user to view the last location of use of their active digitizer on their device; this location is stored locally on the user's device after each use of their active digitizer.
When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. In Windows 10, version 1709 the user will not be able to view the location of the last use of their active digitizer on their device.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -293,11 +301,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowmanualmdmunenrollment"></a>**Experience/AllowManualMDMUnenrollment**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -319,8 +329,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -328,8 +338,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), which is majority of the case for Intune, then disabling the MDM unenrollment has no effect.
> [!NOTE]
@ -338,7 +348,7 @@ Specifies whether to allow the user to delete the workplace account using the wo
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -347,11 +357,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowsimerrordialogpromptwhennosim"></a>**Experience/AllowSIMErrorDialogPromptWhenNoSIM**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -373,8 +385,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -382,15 +394,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
Specifies whether to display dialog prompt when no SIM card is detected.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -399,19 +411,24 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowsaveasofofficefiles"></a>**Experience/AllowSaveAsOfOfficeFiles**
<!--StartDescription-->
<!--Description-->
This policy is deprecated.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowscreencapture"></a>**Experience/AllowScreenCapture**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -433,8 +450,8 @@ This policy is deprecated.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -442,8 +459,8 @@ This policy is deprecated.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -452,7 +469,7 @@ Specifies whether screen capture is allowed.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -461,19 +478,24 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowsharingofofficefiles"></a>**Experience/AllowSharingOfOfficeFiles**
<!--StartDescription-->
<!--Description-->
This policy is deprecated.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowsyncmysettings"></a>**Experience/AllowSyncMySettings**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -495,8 +517,8 @@ This policy is deprecated.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -504,11 +526,11 @@ This policy is deprecated.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices).
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -517,11 +539,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowtailoredexperienceswithdiagnosticdata"></a>**Experience/AllowTailoredExperiencesWithDiagnosticData**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -543,8 +567,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -552,8 +576,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@ -565,7 +589,7 @@ Diagnostic data can include browser, app and feature usage, depending on the "Di
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -574,11 +598,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowtaskswitcher"></a>**Experience/AllowTaskSwitcher**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -600,8 +626,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -609,15 +635,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
Allows or disallows task switching on the device.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -626,11 +652,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowthirdpartysuggestionsinwindowsspotlight"></a>**Experience/AllowThirdPartySuggestionsInWindowsSpotlight**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -652,8 +680,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -661,15 +689,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only available for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education.
Specifies whether to allow app and content suggestions from third-party software publishers in Windows spotlight features like lock screen spotlight, suggested apps in the Start menu, and Windows tips. Users may still see suggestions for Microsoft features, apps, and services.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -678,11 +706,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowvoicerecording"></a>**Experience/AllowVoiceRecording**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -704,8 +734,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -713,8 +743,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -723,7 +753,7 @@ Specifies whether voice recording is allowed for apps.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -732,11 +762,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowwindowsconsumerfeatures"></a>**Experience/AllowWindowsConsumerFeatures**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -758,8 +790,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -767,8 +799,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@ -777,7 +809,7 @@ This policy allows IT admins to turn on experiences that are typically for consu
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -786,11 +818,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowwindowsspotlight"></a>**Experience/AllowWindowsSpotlight**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -812,8 +846,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -821,8 +855,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only available for Windows 10 Enterprise and Windows 10 Education.
@ -831,7 +865,7 @@ Specifies whether to turn off all Windows spotlight features at once. If you ena
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -840,11 +874,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowwindowsspotlightonactioncenter"></a>**Experience/AllowWindowsSpotlightOnActionCenter**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -866,8 +902,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -875,8 +911,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@ -884,7 +920,7 @@ Added in Windows 10, version 1703. This policy allows administrators to prevent
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -893,11 +929,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowwindowsspotlightwindowswelcomeexperience"></a>**Experience/AllowWindowsSpotlightWindowsWelcomeExperience**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -919,8 +957,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -928,8 +966,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@ -938,7 +976,7 @@ The Windows welcome experience feature introduces onboard users to Windows; for
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -947,11 +985,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-allowwindowstips"></a>**Experience/AllowWindowsTips**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -973,8 +1013,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -982,11 +1022,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Enables or disables Windows Tips / soft landing.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -995,11 +1035,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-configurewindowsspotlightonlockscreen"></a>**Experience/ConfigureWindowsSpotlightOnLockScreen**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1021,8 +1063,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1030,8 +1072,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only available for Windows 10 Enterprise and Windows 10 Education.
@ -1044,13 +1086,15 @@ The following list shows the supported values:
- 1 (default) – Windows spotlight enabled.
- 2 – placeholder only for future extension. Using this value has no effect.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="experience-donotshowfeedbacknotifications"></a>**Experience/DoNotShowFeedbackNotifications**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1072,8 +1116,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1081,8 +1125,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Prevents devices from showing feedback questions from Microsoft.
If you enable this policy setting, users will no longer see feedback notifications through the Feedback hub app. If you disable or do not configure this policy setting, users may see notifications through the Feedback hub app asking users for feedback.
@ -1094,7 +1138,7 @@ The following list shows the supported values:
- 0 (default) – Feedback notifications are not disabled. The actual state of feedback notifications on the device will then depend on what GP has configured or what the user has configured locally.
- 1 – Feedback notifications are disabled.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

16
windows/client-management/mdm/policy-csp-exploitguard.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - ExploitGuard
@ -24,11 +24,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="exploitguard-exploitprotectionsettings"></a>**ExploitGuard/ExploitProtectionSettings**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,8 +61,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml).
The system settings require a reboot; the application settings do not require a reboot.
@ -90,7 +92,7 @@ Here is an example:
```
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

16
windows/client-management/mdm/policy-csp-games.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Games
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="games-allowadvancedgamingservices"></a>**Games/AllowAdvancedGamingServices**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,11 +61,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

16
windows/client-management/mdm/policy-csp-handwriting.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Handwriting
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="handwriting-paneldefaultmodedocked"></a>**Handwriting/PanelDefaultModeDocked**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,8 +61,8 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10. version 1709. This policy allows an enterprise to configure the default mode for the handwriting panel.
The handwriting panel has 2 modes - floats near the text box, or docked to the bottom of the screen. The default configuration to is floating near text box. If you want the panel to be fixed or docked, use this policy to fix it to the bottom of the screen.
@ -69,7 +71,7 @@ In floating mode, the content is hidden behind a flying-in panel and results in
The docked mode is especially useful in Kiosk mode where you do not expect the end-user to drag the flying-in panel out of the way.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

4460
windows/client-management/mdm/policy-csp-internetexplorer.md
View File

File diff suppressed because it is too large Load Diff

92
windows/client-management/mdm/policy-csp-kerberos.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Kerberos
@ -36,11 +36,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="kerberos-allowforestsearchorder"></a>**Kerberos/AllowForestSearchOrder**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -62,8 +64,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -71,15 +73,15 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).
If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain.
If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -87,20 +89,22 @@ If you disable or do not configure this policy setting, the Kerberos client does
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Use forest search order*
- GP name: *ForestSearch*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kerberos-kerberosclientsupportsclaimscompoundarmor"></a>**Kerberos/KerberosClientSupportsClaimsCompoundArmor**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -122,8 +126,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -131,14 +135,14 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features.
If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.
If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -146,20 +150,22 @@ If you disable or do not configure this policy setting, the client devices will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Kerberos client support for claims, compound authentication and Kerberos armoring*
- GP name: *EnableCbacAndArmor*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kerberos-requirekerberosarmoring"></a>**Kerberos/RequireKerberosArmoring**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -181,8 +187,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -190,8 +196,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller.
Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled.
@ -202,7 +208,7 @@ Note: The Kerberos Group Policy "Kerberos client support for claims, compound au
If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -210,20 +216,22 @@ If you disable or do not configure this policy setting, the client computers in
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Fail authentication requests when Kerberos armoring is not available*
- GP name: *ClientRequireFast*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kerberos-requirestrictkdcvalidation"></a>**Kerberos/RequireStrictKDCValidation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -245,8 +253,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -254,15 +262,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon.
If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate.
If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -270,20 +278,22 @@ If you disable or do not configure this policy setting, the Kerberos client requ
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Require strict KDC validation*
- GP name: *ValidateKDC*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kerberos-setmaximumcontexttokensize"></a>**Kerberos/SetMaximumContextTokenSize**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -305,8 +315,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -314,8 +324,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size.
The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token.
@ -326,7 +336,7 @@ If you disable or do not configure this policy setting, the Kerberos client or s
Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -334,14 +344,14 @@ Note: This policy setting configures the existing MaxTokenSize registry value in
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Set maximum Kerberos SSPI context token buffer size*
- GP name: *MaxTokenSize*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

140
windows/client-management/mdm/policy-csp-kioskbrowser.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/03/2018
ms.date: 01/29/2018
---
# Policy CSP - KioskBrowser
@ -41,11 +41,13 @@ ms.date: 01/03/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="kioskbrowser-blockedurlexceptions"></a>**KioskBrowser/BlockedUrlExceptions**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -67,8 +69,8 @@ ms.date: 01/03/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -77,26 +79,19 @@ ms.date: 01/03/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kioskbrowser-blockedurls"></a>**KioskBrowser/BlockedUrls**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -118,8 +113,8 @@ Added in Windows 10, next major update. List of exceptions to the blocked websit
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -128,26 +123,19 @@ Added in Windows 10, next major update. List of exceptions to the blocked websit
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kioskbrowser-defaulturl"></a>**KioskBrowser/DefaultURL**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -169,8 +157,8 @@ Added in Windows 10, next major update. List of blocked website URLs (with wildc
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -179,26 +167,19 @@ Added in Windows 10, next major update. List of blocked website URLs (with wildc
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Configures the default URL kiosk browsers to navigate on launch and restart.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kioskbrowser-enablehomebutton"></a>**KioskBrowser/EnableHomeButton**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -220,8 +201,8 @@ Added in Windows 10, next major update. Configures the default URL kiosk browser
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -230,26 +211,19 @@ Added in Windows 10, next major update. Configures the default URL kiosk browser
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Enable/disable kiosk browser's home button.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kioskbrowser-enablenavigationbuttons"></a>**KioskBrowser/EnableNavigationButtons**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -271,8 +245,8 @@ Added in Windows 10, next major update. Enable/disable kiosk browser's home butt
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -281,26 +255,19 @@ Added in Windows 10, next major update. Enable/disable kiosk browser's home butt
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Enable/disable kiosk browser's navigation buttons (forward/back).
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="kioskbrowser-restartonidletime"></a>**KioskBrowser/RestartOnIdleTime**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -322,8 +289,8 @@ Added in Windows 10, next major update. Enable/disable kiosk browser's navigatio
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -332,22 +299,13 @@ Added in Windows 10, next major update. Enable/disable kiosk browser's navigatio
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state.
The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

30
windows/client-management/mdm/policy-csp-licensing.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Licensing
@ -27,11 +27,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="licensing-allowwindowsentitlementreactivation"></a>**Licensing/AllowWindowsEntitlementReactivation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,11 +64,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Enables or Disable Windows license reactivation on managed devices.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -75,11 +77,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="licensing-disallowkmsclientonlineavsvalidation"></a>**Licensing/DisallowKMSClientOnlineAVSValidation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -101,8 +105,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -110,11 +114,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

1047
windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
View File

File diff suppressed because it is too large Load Diff

16
windows/client-management/mdm/policy-csp-location.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Location
@ -24,11 +24,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="location-enablelocation"></a>**Location/EnableLocation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,8 +61,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Optional policy that allows for IT admin to preconfigure whether or not Location Service's Device Switch is enabled or disabled for the device. Setting this policy is not required for Location Services to function. This policy controls a device wide state that affects all users, apps, and services ability to find the device's latitude and longitude on a map. There is a separate user switch that defines whether the location service is allowed to retrieve a position for the current user. In order to retrieve a position for a specific user, both the Device Switch and the User Switch must be enabled. If either is disabled, positions cannot be retrieved for the user. The user can later change both the User Switch and the Device Switch through the user interface on the Settings -> Privacy -> Location page.
> [!IMPORTANT]
@ -76,7 +78,7 @@ To validate on Desktop, do the following:
1. Verify that Settings -> Privacy -> Location -> Location for this device is On/Off as expected.
2. Use Windows Maps Application (or similar) to see if a location can or cannot be obtained.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

16
windows/client-management/mdm/policy-csp-lockdown.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - LockDown
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="lockdown-allowedgeswipe"></a>**LockDown/AllowEdgeSwipe**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,13 +61,13 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch.
The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

30
windows/client-management/mdm/policy-csp-maps.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Maps
@ -27,11 +27,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="maps-allowofflinemapsdownloadovermeteredconnection"></a>**Maps/AllowOfflineMapsDownloadOverMeteredConnection**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,13 +64,13 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Allows the download and update of map data over metered connections.
After the policy is applied, you can verify the settings in the user interface in **System** &gt; **Offline Maps**.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -78,11 +80,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="maps-enableofflinemapsautoupdate"></a>**Maps/EnableOfflineMapsAutoUpdate**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -104,8 +108,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -113,13 +117,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Disables the automatic download and update of map data.
After the policy is applied, you can verify the settings in the user interface in **System** &gt; **Offline Maps**.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

44
windows/client-management/mdm/policy-csp-messaging.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Messaging
@ -30,11 +30,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="messaging-allowmms"></a>**Messaging/AllowMMS**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,8 +67,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -77,13 +79,15 @@ The following list shows the supported values:
- 0 - Disabled.
- 1 (default) - Enabled.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="messaging-allowmessagesync"></a>**Messaging/AllowMessageSync**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -105,8 +109,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -114,8 +118,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Enables text message back up and restore and Messaging Everywhere. This policy allows an organization to disable these features to avoid information being stored on servers outside of their control.
The following list shows the supported values:
@ -123,13 +127,15 @@ The following list shows the supported values:
- 0 - message sync is not allowed and cannot be changed by the user.
- 1 - message sync is allowed. The user can change this setting.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="messaging-allowrcs"></a>**Messaging/AllowRCS**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -151,8 +157,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -160,8 +166,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -172,7 +178,7 @@ The following list shows the supported values:
- 0 - Disabled.
- 1 (default) - Enabled.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

114
windows/client-management/mdm/policy-csp-networkisolation.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - NetworkIsolation
@ -45,11 +45,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterprisecloudresources"></a>**NetworkIsolation/EnterpriseCloudResources**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -71,8 +73,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -80,17 +82,19 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the **EnterpriseInternalProxyServers** policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, **&lt;*cloudresource*&gt;|&lt;*cloudresource*&gt;|&lt;*cloudresource*&gt;,&lt;*proxy*&gt;|&lt;*cloudresource*&gt;|&lt;*cloudresource*&gt;,&lt;*proxy*&gt;|**.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterpriseiprange"></a>**NetworkIsolation/EnterpriseIPRange**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -112,8 +116,8 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -121,11 +125,11 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges.
<!--EndDescription-->
<!--/Description-->
<!--Example-->
For example:
@ -140,11 +144,13 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
<!--/Example-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterpriseiprangesareauthoritative"></a>**NetworkIsolation/EnterpriseIPRangesAreAuthoritative**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -166,8 +172,8 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -175,17 +181,19 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterpriseinternalproxyservers"></a>**NetworkIsolation/EnterpriseInternalProxyServers**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -207,8 +215,8 @@ Boolean value that tells the client to accept the configured list and not to use
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -216,17 +224,19 @@ Boolean value that tells the client to accept the configured list and not to use
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This is the comma-separated list of internal proxy servers. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the **EnterpriseCloudResources** policy to force traffic to the matched cloud resources through these proxies.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterprisenetworkdomainnames"></a>**NetworkIsolation/EnterpriseNetworkDomainNames**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -248,8 +258,8 @@ This is the comma-separated list of internal proxy servers. For example "157.54.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -257,8 +267,8 @@ This is the comma-separated list of internal proxy servers. For example "157.54.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example "contoso.sharepoint.com, Fabrikam.com".
> [!NOTE]
@ -271,13 +281,15 @@ Here are the steps to create canonical domain names:
2. Call [IdnToAscii](https://msdn.microsoft.com/library/windows/desktop/dd318149.aspx) with IDN\_USE\_STD3\_ASCII\_RULES as the flags.
3. Call [IdnToUnicode](https://msdn.microsoft.com/library/windows/desktop/dd318151.aspx) with no flags set (dwFlags = 0).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterpriseproxyservers"></a>**NetworkIsolation/EnterpriseProxyServers**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -299,8 +311,8 @@ Here are the steps to create canonical domain names:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -308,17 +320,19 @@ Here are the steps to create canonical domain names:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59".
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-enterpriseproxyserversareauthoritative"></a>**NetworkIsolation/EnterpriseProxyServersAreAuthoritative**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -340,8 +354,8 @@ This is a comma-separated list of proxy servers. Any server on this list is cons
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -349,17 +363,19 @@ This is a comma-separated list of proxy servers. Any server on this list is cons
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="networkisolation-neutralresources"></a>**NetworkIsolation/NeutralResources**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -381,8 +397,8 @@ Boolean value that tells the client to accept the configured list of proxies and
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -390,11 +406,11 @@ Boolean value that tells the client to accept the configured list of proxies and
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
List of domain names that can used for work or personal resource.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

16
windows/client-management/mdm/policy-csp-notifications.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Notifications
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="notifications-disallownotificationmirroring"></a>**Notifications/DisallowNotificationMirroring**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,15 +61,15 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Boolean value that turns off notification mirroring.
For each user logged into the device, if you enable this policy (set value to 1) the app and system notifications received by this user on this device will not get mirrored to other devices of the same logged in user. If you disable or do not configure this policy (set value to 0) the notifications received by this user on this device will be mirrored to other devices of the same logged in user. This feature can be turned off by apps that do not want to participate in Notification Mirroring. This feature can also be turned off by the user in the Cortana setting page.
No reboot or service restart is required for this policy to take effect.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

164
windows/client-management/mdm/policy-csp-power.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Power
@ -48,11 +48,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="power-allowstandbywhensleepingpluggedin"></a>**Power/AllowStandbyWhenSleepingPluggedIn**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -74,8 +76,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -83,15 +85,15 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state.
If you enable or do not configure this policy setting, Windows uses standby states to put the computer in a sleep state.
If you disable this policy setting, standby states (S1-S3) are not allowed.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -99,20 +101,22 @@ If you disable this policy setting, standby states (S1-S3) are not allowed.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow standby states (S1-S3) when sleeping (plugged in)*
- GP name: *AllowStandbyStatesAC_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-displayofftimeoutonbattery"></a>**Power/DisplayOffTimeoutOnBattery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -134,8 +138,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -143,8 +147,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Turn off the display (on battery). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.
@ -153,7 +157,7 @@ If you disable or do not configure this policy setting, users control this setti
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -161,20 +165,22 @@ If the user has configured a slide show to run on the lock screen when the machi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off the display (on battery)*
- GP name: *VideoPowerDownTimeOutDC_2*
- GP path: *System/Power Management/Video and Display Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-displayofftimeoutpluggedin"></a>**Power/DisplayOffTimeoutPluggedIn**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -196,8 +202,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -205,8 +211,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Turn off the display (plugged in). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.
@ -215,7 +221,7 @@ If you disable or do not configure this policy setting, users control this setti
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -223,20 +229,22 @@ If the user has configured a slide show to run on the lock screen when the machi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off the display (plugged in)*
- GP name: *VideoPowerDownTimeOutAC_2*
- GP path: *System/Power Management/Video and Display Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-hibernatetimeoutonbattery"></a>**Power/HibernateTimeoutOnBattery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -258,8 +266,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -267,8 +275,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specify the system hibernate timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.
@ -278,7 +286,7 @@ If you disable or do not configure this policy setting, users control this setti
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -286,20 +294,22 @@ If the user has configured a slide show to run on the lock screen when the machi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the system hibernate timeout (on battery)*
- GP name: *DCHibernateTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-hibernatetimeoutpluggedin"></a>**Power/HibernateTimeoutPluggedIn**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -321,8 +331,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -330,8 +340,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specify the system hibernate timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.
@ -340,7 +350,7 @@ If you disable or do not configure this policy setting, users control this setti
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -348,20 +358,22 @@ If the user has configured a slide show to run on the lock screen when the machi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the system hibernate timeout (plugged in)*
- GP name: *ACHibernateTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-requirepasswordwhencomputerwakesonbattery"></a>**Power/RequirePasswordWhenComputerWakesOnBattery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -383,8 +395,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -392,15 +404,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.
If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -408,20 +420,22 @@ If you disable this policy setting, the user is not prompted for a password when
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Require a password when a computer wakes (on battery)*
- GP name: *DCPromptForPasswordOnResume_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-requirepasswordwhencomputerwakespluggedin"></a>**Power/RequirePasswordWhenComputerWakesPluggedIn**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -443,8 +457,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -452,15 +466,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.
If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -468,20 +482,22 @@ If you disable this policy setting, the user is not prompted for a password when
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Require a password when a computer wakes (plugged in)*
- GP name: *ACPromptForPasswordOnResume_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-standbytimeoutonbattery"></a>**Power/StandbyTimeoutOnBattery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -503,8 +519,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -512,8 +528,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specify the system sleep timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.
@ -522,7 +538,7 @@ If you disable or do not configure this policy setting, users control this setti
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -530,20 +546,22 @@ If the user has configured a slide show to run on the lock screen when the machi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the system sleep timeout (on battery)*
- GP name: *DCStandbyTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="power-standbytimeoutpluggedin"></a>**Power/StandbyTimeoutPluggedIn**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -565,8 +583,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -574,8 +592,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Specify the system sleep timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.
@ -584,7 +602,7 @@ If you disable or do not configure this policy setting, users control this setti
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -592,14 +610,14 @@ If the user has configured a slide show to run on the lock screen when the machi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify the system sleep timeout (plugged in)*
- GP name: *ACStandbyTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

56
windows/client-management/mdm/policy-csp-printers.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - Printers
@ -30,11 +30,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="printers-pointandprintrestrictions"></a>**Printers/PointAndPrintRestrictions**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,8 +67,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
If you enable this policy setting:
@ -86,7 +88,7 @@ If you disable this policy setting:
-Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.
-The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -94,20 +96,22 @@ If you disable this policy setting:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Point and Print Restrictions*
- GP name: *PointAndPrint_Restrictions_Win7*
- GP path: *Printers*
- GP ADMX file name: *Printing.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="printers-pointandprintrestrictions-user"></a>**Printers/PointAndPrintRestrictions_User**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -129,8 +133,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -138,8 +142,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
If you enable this policy setting:
@ -159,7 +163,7 @@ If you disable this policy setting:
-Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.
-The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -167,20 +171,22 @@ If you disable this policy setting:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Point and Print Restrictions*
- GP name: *PointAndPrint_Restrictions*
- GP path: *Control Panel/Printers*
- GP ADMX file name: *Printing.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="printers-publishprinters"></a>**Printers/PublishPrinters**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -202,8 +208,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -211,8 +217,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Determines whether the computer's shared printers can be published in Active Directory.
If you enable this setting or do not configure it, users can use the "List in directory" option in the Printer's Properties' Sharing tab to publish shared printers in Active Directory.
@ -221,7 +227,7 @@ If you disable this setting, this computer's shared printers cannot be published
Note: This settings takes priority over the setting "Automatically publish new printers in the Active Directory".
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -229,14 +235,14 @@ Note: This settings takes priority over the setting "Automatically publish new p
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow printers to be published*
- GP name: *PublishPrinters*
- GP path: *Printers*
- GP ADMX file name: *Printing2.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

1082
windows/client-management/mdm/policy-csp-privacy.md
View File

File diff suppressed because it is too large Load Diff

74
windows/client-management/mdm/policy-csp-remoteassistance.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - RemoteAssistance
@ -33,11 +33,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="remoteassistance-customizewarningmessages"></a>**RemoteAssistance/CustomizeWarningMessages**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -59,8 +61,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -68,8 +70,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting lets you customize warning messages.
The "Display warning message before sharing control" policy setting allows you to specify a custom message to display before a user shares control of his or her computer.
@ -82,7 +84,7 @@ If you disable this policy setting, the user sees the default warning message.
If you do not configure this policy setting, the user sees the default warning message.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -90,20 +92,22 @@ If you do not configure this policy setting, the user sees the default warning m
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Customize warning messages*
- GP name: *RA_Options*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteassistance-sessionlogging"></a>**RemoteAssistance/SessionLogging**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -125,8 +129,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -134,8 +138,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.
If you enable this policy setting, log files are generated.
@ -144,7 +148,7 @@ If you disable this policy setting, log files are not generated.
If you do not configure this setting, application-based settings are used.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -152,20 +156,22 @@ If you do not configure this setting, application-based settings are used.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn on session logging*
- GP name: *RA_Logging*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteassistance-solicitedremoteassistance"></a>**RemoteAssistance/SolicitedRemoteAssistance**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -187,8 +193,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -196,8 +202,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.
If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.
@ -214,7 +220,7 @@ The "Select the method for sending email invitations" setting specifies which em
If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -222,20 +228,22 @@ If you enable this policy setting you should also enable appropriate firewall ex
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Configure Solicited Remote Assistance*
- GP name: *RA_Solicit*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteassistance-unsolicitedremoteassistance"></a>**RemoteAssistance/UnsolicitedRemoteAssistance**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -257,8 +265,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -266,8 +274,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.
If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
@ -307,7 +315,7 @@ Port 135:TCP
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
Allow Remote Desktop Exception
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -315,14 +323,14 @@ Allow Remote Desktop Exception
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Configure Offer Remote Assistance*
- GP name: *RA_Unsolicit*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

110
windows/client-management/mdm/policy-csp-remotedesktopservices.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - RemoteDesktopServices
@ -39,11 +39,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="remotedesktopservices-allowuserstoconnectremotely"></a>**RemoteDesktopServices/AllowUsersToConnectRemotely**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -65,8 +67,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -74,8 +76,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to configure remote access to computers by using Remote Desktop Services.
If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer by using Remote Desktop Services.
@ -88,7 +90,7 @@ Note: You can limit which clients are able to connect remotely by using Remote D
You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -96,20 +98,22 @@ You can limit the number of users who can connect simultaneously by configuring
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow users to connect remotely by using Remote Desktop Services*
- GP name: *TS_DISABLE_CONNECTIONS*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections*
- GP ADMX file name: *terminalserver.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotedesktopservices-clientconnectionencryptionlevel"></a>**RemoteDesktopServices/ClientConnectionEncryptionLevel**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -131,8 +135,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -140,8 +144,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.
If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:
@ -158,7 +162,7 @@ Important
FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -166,20 +170,22 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Set client connection encryption level*
- GP name: *TS_ENCRYPTION_POLICY*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security*
- GP ADMX file name: *terminalserver.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotedesktopservices-donotallowdriveredirection"></a>**RemoteDesktopServices/DoNotAllowDriveRedirection**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -201,8 +207,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -210,8 +216,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).
By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format <driveletter> on <computername>. You can use this policy setting to override this behavior.
@ -222,7 +228,7 @@ If you disable this policy setting, client drive redirection is always allowed.
If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -230,20 +236,22 @@ If you do not configure this policy setting, client drive redirection and Clipbo
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not allow drive redirection*
- GP name: *TS_CLIENT_DRIVE_M*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection*
- GP ADMX file name: *terminalserver.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotedesktopservices-donotallowpasswordsaving"></a>**RemoteDesktopServices/DoNotAllowPasswordSaving**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -265,8 +273,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -274,15 +282,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Controls whether passwords can be saved on this computer from Remote Desktop Connection.
If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.
If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -290,20 +298,22 @@ If you disable this setting or leave it not configured, the user will be able to
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not allow passwords to be saved*
- GP name: *TS_CLIENT_DISABLE_PASSWORD_SAVING_2*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Connection Client*
- GP ADMX file name: *terminalserver.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotedesktopservices-promptforpassworduponconnection"></a>**RemoteDesktopServices/PromptForPasswordUponConnection**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -325,8 +335,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -334,8 +344,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection.
You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.
@ -348,7 +358,7 @@ If you disable this policy setting, users can always log on to Remote Desktop Se
If you do not configure this policy setting, automatic logon is not specified at the Group Policy level.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -356,20 +366,22 @@ If you do not configure this policy setting, automatic logon is not specified at
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Always prompt for password upon connection*
- GP name: *TS_PASSWORD*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security*
- GP ADMX file name: *terminalserver.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotedesktopservices-requiresecurerpccommunication"></a>**RemoteDesktopServices/RequireSecureRPCCommunication**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -391,8 +403,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -400,8 +412,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.
You can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.
@ -414,7 +426,7 @@ If the status is set to Not Configured, unsecured communication is allowed.
Note: The RPC interface is used for administering and configuring Remote Desktop Services.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -422,14 +434,14 @@ Note: The RPC interface is used for administering and configuring Remote Desktop
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Require secure RPC communication*
- GP name: *TS_RPC_ENCRYPTION*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security*
- GP ADMX file name: *terminalserver.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

287
windows/client-management/mdm/policy-csp-remotemanagement.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - RemoteManagement
@ -66,11 +66,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowbasicauthentication-client"></a>**RemoteManagement/AllowBasicAuthentication_Client**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -92,8 +94,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -101,9 +103,10 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -111,20 +114,22 @@ ms.date: 11/01/2017
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow Basic authentication*
- GP name: *AllowBasic_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowbasicauthentication-service"></a>**RemoteManagement/AllowBasicAuthentication_Service**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -146,8 +151,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -155,9 +160,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -165,20 +171,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow Basic authentication*
- GP name: *AllowBasic_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowcredsspauthenticationclient"></a>**RemoteManagement/AllowCredSSPAuthenticationClient**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -200,8 +208,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -209,9 +217,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -219,20 +228,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow CredSSP authentication*
- GP name: *AllowCredSSP_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowcredsspauthenticationservice"></a>**RemoteManagement/AllowCredSSPAuthenticationService**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -254,8 +265,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -263,9 +274,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -273,20 +285,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow CredSSP authentication*
- GP name: *AllowCredSSP_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowremoteservermanagement"></a>**RemoteManagement/AllowRemoteServerManagement**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -308,8 +322,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -317,9 +331,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -327,20 +342,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow remote server management through WinRM*
- GP name: *AllowAutoConfig*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowunencryptedtraffic-client"></a>**RemoteManagement/AllowUnencryptedTraffic_Client**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -362,8 +379,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -371,9 +388,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -381,20 +399,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow unencrypted traffic*
- GP name: *AllowUnencrypted_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-allowunencryptedtraffic-service"></a>**RemoteManagement/AllowUnencryptedTraffic_Service**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -416,8 +436,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -425,9 +445,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -435,20 +456,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow unencrypted traffic*
- GP name: *AllowUnencrypted_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-disallowdigestauthentication"></a>**RemoteManagement/DisallowDigestAuthentication**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -470,8 +493,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -479,9 +502,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -489,20 +513,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Disallow Digest authentication*
- GP name: *DisallowDigest*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-disallownegotiateauthenticationclient"></a>**RemoteManagement/DisallowNegotiateAuthenticationClient**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -524,8 +550,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -533,9 +559,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -543,20 +570,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Disallow Negotiate authentication*
- GP name: *DisallowNegotiate_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-disallownegotiateauthenticationservice"></a>**RemoteManagement/DisallowNegotiateAuthenticationService**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -578,8 +607,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -587,9 +616,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -597,20 +627,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Disallow Negotiate authentication*
- GP name: *DisallowNegotiate_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-disallowstoringofrunascredentials"></a>**RemoteManagement/DisallowStoringOfRunAsCredentials**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -632,8 +664,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -641,9 +673,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -651,20 +684,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Disallow WinRM from storing RunAs credentials*
- GP name: *DisableRunAs*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-specifychannelbindingtokenhardeninglevel"></a>**RemoteManagement/SpecifyChannelBindingTokenHardeningLevel**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -686,8 +721,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -695,9 +730,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -705,20 +741,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify channel binding token hardening level*
- GP name: *CBTHardeningLevel_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-trustedhosts"></a>**RemoteManagement/TrustedHosts**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -740,8 +778,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -749,9 +787,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -759,20 +798,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Trusted Hosts*
- GP name: *TrustedHosts*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-turnoncompatibilityhttplistener"></a>**RemoteManagement/TurnOnCompatibilityHTTPListener**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -794,8 +835,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -803,9 +844,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -813,20 +855,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn On Compatibility HTTP Listener*
- GP name: *HttpCompatibilityListener*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remotemanagement-turnoncompatibilityhttpslistener"></a>**RemoteManagement/TurnOnCompatibilityHTTPSListener**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -848,8 +892,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -857,9 +901,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -867,14 +912,14 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn On Compatibility HTTPS Listener*
- GP name: *HttpsCompatibilityListener*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

38
windows/client-management/mdm/policy-csp-remoteprocedurecall.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - RemoteProcedureCall
@ -27,11 +27,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="remoteprocedurecall-rpcendpointmapperclientauthentication"></a>**RemoteProcedureCall/RPCEndpointMapperClientAuthentication**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,8 +64,8 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner.
If you disable this policy setting, RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Endpoint Mapper Service on Windows NT4 Server.
@ -74,7 +76,7 @@ If you do not configure this policy setting, it remains disabled. RPC clients w
Note: This policy will not be applied until the system is rebooted.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -82,20 +84,22 @@ Note: This policy will not be applied until the system is rebooted.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Enable RPC Endpoint Mapper Client Authentication*
- GP name: *RpcEnableAuthEpResolution*
- GP path: *System/Remote Procedure Call*
- GP ADMX file name: *rpc.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteprocedurecall-restrictunauthenticatedrpcclients"></a>**RemoteProcedureCall/RestrictUnauthenticatedRPCClients**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -117,8 +121,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -126,8 +130,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.
This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself. Reverting a change to this policy setting can require manual intervention on each affected machine. This policy setting should never be applied to a domain controller.
@ -146,7 +150,7 @@ If you enable this policy setting, it directs the RPC server runtime to restrict
Note: This policy setting will not be applied until the system is rebooted.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -154,14 +158,14 @@ Note: This policy setting will not be applied until the system is rebooted.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Restrict Unauthenticated RPC clients*
- GP name: *RpcRestrictRemoteClients*
- GP path: *System/Remote Procedure Call*
- GP ADMX file name: *rpc.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

135
windows/client-management/mdm/policy-csp-remoteshell.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 11/01/2017
ms.date: 01/29/2018
---
# Policy CSP - RemoteShell
@ -42,11 +42,13 @@ ms.date: 11/01/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-allowremoteshellaccess"></a>**RemoteShell/AllowRemoteShellAccess**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -68,8 +70,8 @@ ms.date: 11/01/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -77,9 +79,10 @@ ms.date: 11/01/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -87,20 +90,22 @@ ms.date: 11/01/2017
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Allow Remote Shell Access*
- GP name: *AllowRemoteShellAccess*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-maxconcurrentusers"></a>**RemoteShell/MaxConcurrentUsers**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -122,8 +127,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -131,9 +136,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -141,20 +147,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *MaxConcurrentUsers*
- GP name: *MaxConcurrentUsers*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-specifyidletimeout"></a>**RemoteShell/SpecifyIdleTimeout**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -176,8 +184,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -185,9 +193,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -195,20 +204,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify idle Timeout*
- GP name: *IdleTimeout*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-specifymaxmemory"></a>**RemoteShell/SpecifyMaxMemory**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -230,8 +241,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -239,9 +250,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -249,20 +261,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify maximum amount of memory in MB per Shell*
- GP name: *MaxMemoryPerShellMB*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-specifymaxprocesses"></a>**RemoteShell/SpecifyMaxProcesses**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -284,8 +298,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -293,9 +307,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -303,20 +318,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify maximum number of processes per Shell*
- GP name: *MaxProcessesPerShell*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-specifymaxremoteshells"></a>**RemoteShell/SpecifyMaxRemoteShells**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -338,8 +355,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -347,9 +364,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -357,20 +375,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify maximum number of remote shells per user*
- GP name: *MaxShellsPerUser*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="remoteshell-specifyshelltimeout"></a>**RemoteShell/SpecifyShellTimeout**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -392,8 +412,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -401,9 +421,10 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--EndDescription-->
<!--/Scope-->
<!--Description-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -411,14 +432,14 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Specify Shell Timeout*
- GP name: *ShellTimeOut*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

207
windows/client-management/mdm/policy-csp-search.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/08/2018
ms.date: 01/29/2018
---
# Policy CSP - Search
@ -65,11 +65,13 @@ ms.date: 01/08/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowcloudsearch"></a>**Search/AllowCloudSearch**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -91,8 +93,8 @@ ms.date: 01/08/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -100,8 +102,8 @@ ms.date: 01/08/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources.
The following list shows the supported values:
@ -109,13 +111,15 @@ The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowcortanainaad"></a>**Search/AllowCortanaInAAD**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -137,8 +141,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -146,31 +150,26 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow..
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 (default) - Not allowed. The Cortana consent page will not appear in AAD OOBE during setup.
- 1 - Allowed. The Cortana consent page will appear in Azure AAD OOBE during setup.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowindexingencryptedstoresoritems"></a>**Search/AllowIndexingEncryptedStoresOrItems**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -192,8 +191,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -201,8 +200,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows or disallows the indexing of items. This switch is for the Windows Search Indexer, which controls whether it will index items that are encrypted, such as the Windows Information Protection (WIP) protected files.
When the policy is enabled, WIP protected items are indexed and the metadata about them are stored in an unencrypted location. The metadata includes things like file path and date modified.
@ -211,7 +210,7 @@ When the policy is disabled, the WIP protected items are not indexed and do not
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -220,11 +219,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowsearchtouselocation"></a>**Search/AllowSearchToUseLocation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -246,8 +247,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -255,13 +256,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether search can leverage location information.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -270,11 +271,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowstoringimagesfromvisionsearch"></a>**Search/AllowStoringImagesFromVisionSearch**
<!--StartScope-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -282,17 +285,19 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy has been deprecated.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowusingdiacritics"></a>**Search/AllowUsingDiacritics**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -314,8 +319,8 @@ This policy has been deprecated.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -323,8 +328,8 @@ This policy has been deprecated.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows the use of diacritics.
The following list shows the supported values:
@ -334,13 +339,15 @@ The following list shows the supported values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-allowwindowsindexer"></a>**Search/AllowWindowsIndexer**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -362,8 +369,8 @@ Most restricted value is 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -371,17 +378,19 @@ Most restricted value is 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow Windows indexer. Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-alwaysuseautolangdetection"></a>**Search/AlwaysUseAutoLangDetection**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -403,8 +412,8 @@ Allow Windows indexer. Value type is integer.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -412,8 +421,8 @@ Allow Windows indexer. Value type is integer.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to always use automatic language detection when indexing content and properties.
The following list shows the supported values:
@ -423,13 +432,15 @@ The following list shows the supported values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-disablebackoff"></a>**Search/DisableBackoff**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -451,8 +462,8 @@ Most restricted value is 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -460,8 +471,8 @@ Most restricted value is 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
If enabled, the search indexer backoff feature will be disabled. Indexing will continue at full speed even when system activity is high. If disabled, backoff logic will be used to throttle back indexing activity when system activity is high. Default is disabled.
The following list shows the supported values:
@ -469,13 +480,15 @@ The following list shows the supported values:
- 0 (default) – Disable.
- 1 – Enable.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-disableremovabledriveindexing"></a>**Search/DisableRemovableDriveIndexing**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -497,8 +510,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -506,8 +519,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting configures whether or not locations on removable drives can be added to libraries.
If you enable this policy setting, locations on removable drives cannot be added to libraries. In addition, locations on removable drives cannot be indexed.
@ -519,13 +532,15 @@ The following list shows the supported values:
- 0 (default) – Disable.
- 1 – Enable.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-donotusewebresults"></a>**Search/DoNotUseWebResults**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -547,8 +562,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -556,8 +571,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Don't search the web or display web results in Search.
This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search.
@ -565,7 +580,7 @@ If you enable this policy setting, queries won't be performed on the web and web
If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -573,18 +588,14 @@ The following list shows the supported values:
- 1 (default) - Allowed. Queries will be performed on the web and web results will be displayed when a user performs a query in Search.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-preventindexinglowdiskspacemb"></a>**Search/PreventIndexingLowDiskSpaceMB**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -606,8 +617,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -615,8 +626,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 1.
Enable this policy if computers in your environment have extremely limited hard drive space.
@ -628,13 +639,15 @@ The following list shows the supported values:
- 0 – Disable.
- 1 (default) – Enable.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-preventremotequeries"></a>**Search/PreventRemoteQueries**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -656,8 +669,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -665,8 +678,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
If enabled, clients will be unable to query this computer's index remotely. Thus, when they are browsing network shares that are stored on this computer, they will not search them using the index. If disabled, client search requests will use this computer's index..
The following list shows the supported values:
@ -674,13 +687,15 @@ The following list shows the supported values:
- 0 – Disable.
- 1 (default) – Enable.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="search-safesearchpermissions"></a>**Search/SafeSearchPermissions**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -702,8 +717,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -711,8 +726,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -726,7 +741,7 @@ The following list shows the supported values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

159
windows/client-management/mdm/policy-csp-security.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/16/2018
ms.date: 01/29/2018
---
# Policy CSP - Security
@ -56,11 +56,13 @@ ms.date: 01/16/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="security-allowaddprovisioningpackage"></a>**Security/AllowAddProvisioningPackage**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -82,8 +84,8 @@ ms.date: 01/16/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -91,11 +93,11 @@ ms.date: 01/16/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow the runtime configuration agent to install provisioning packages.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -104,11 +106,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-allowautomaticdeviceencryptionforazureadjoineddevices"></a>**Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -130,8 +134,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartDescription-->
<!--/SupportedSKUs-->
<!--Description-->
> [!NOTE]
> This policy has been deprecated in Windows 10, version 1607
@ -148,13 +152,15 @@ The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-allowmanualrootcertificateinstallation"></a>**Security/AllowManualRootCertificateInstallation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -176,8 +182,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -185,8 +191,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@ -195,7 +201,7 @@ Specifies whether the user is allowed to manually install root and intermediate
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -204,11 +210,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-allowremoveprovisioningpackage"></a>**Security/AllowRemoveProvisioningPackage**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -230,8 +238,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -239,11 +247,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow the runtime configuration agent to remove provisioning packages.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -252,11 +260,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-antitheftmode"></a>**Security/AntiTheftMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -278,8 +288,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -287,15 +297,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
 
Allows or disallow Anti Theft Mode on the device.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -304,11 +314,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-cleartpmifnotready"></a>**Security/ClearTPMIfNotReady**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -330,8 +342,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -339,14 +351,14 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Added in Windows 10, version 1709. Admin access is required. The prompt will appear on first admin logon after a reboot when the TPM is in a non-ready state that can be remediated with a TPM Clear. The prompt will have a description of what clearing the TPM does and that it requires a reboot. The user can dismiss it, but it will appear on next admin logon after restart.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -355,11 +367,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-configurewindowspasswords"></a>**Security/ConfigureWindowsPasswords**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -381,8 +395,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -390,33 +404,30 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Configures the use of passwords for Windows features.
> [!Note]
> This policy is only supported in Windows 10 S.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 -Disallow passwords (Asymmetric credentials will be promoted to replace passwords on Windows features)
- 1- Allow passwords (Passwords continue to be allowed to be used for Windows features)
- 2- Default (Feature defaults as per SKU and device capabilities. Windows 10 S devices will exhibit "Disallow passwords" default, and all other devices will default to "Allow passwords")
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-preventautomaticdeviceencryptionforazureadjoineddevices"></a>**Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -438,8 +449,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -447,8 +458,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@ -462,13 +473,15 @@ The following list shows the supported values:
- 0 (default) – Encryption enabled.
- 1 – Encryption disabled.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-requiredeviceencryption"></a>**Security/RequireDeviceEncryption**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -490,8 +503,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -499,8 +512,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows enterprise to turn on internal storage encryption.
The following list shows the supported values:
@ -513,13 +526,15 @@ Most restricted value is 1.
> [!IMPORTANT]
> If encryption has been enabled, it cannot be turned off by using this policy.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-requireprovisioningpackagesignature"></a>**Security/RequireProvisioningPackageSignature**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -541,8 +556,8 @@ Most restricted value is 1.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -550,8 +565,8 @@ Most restricted value is 1.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether provisioning packages must have a certificate signed by a device trusted authority.
The following list shows the supported values:
@ -559,13 +574,15 @@ The following list shows the supported values:
- 0 (default) – Not required.
- 1 – Required.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="security-requireretrievehealthcertificateonboot"></a>**Security/RequireRetrieveHealthCertificateOnBoot**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -587,8 +604,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -596,8 +613,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots.
The following list shows the supported values:
@ -616,7 +633,7 @@ Setting this policy to 1 (Required):
Most restricted value is 1.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

206
windows/client-management/mdm/policy-csp-settings.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/19/2017
ms.date: 01/29/2018
---
# Policy CSP - Settings
@ -65,11 +65,13 @@ ms.date: 12/19/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowautoplay"></a>**Settings/AllowAutoPlay**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -91,8 +93,8 @@ ms.date: 12/19/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -100,8 +102,8 @@ ms.date: 12/19/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@ -111,7 +113,7 @@ Allows the user to change Auto Play settings.
> [!NOTE]
> Setting this policy to 0 (Not allowed) does not affect the autoplay dialog box that appears when a device is connected.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -120,11 +122,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowdatasense"></a>**Settings/AllowDataSense**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -146,8 +150,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -155,11 +159,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows the user to change Data Sense settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -168,11 +172,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowdatetime"></a>**Settings/AllowDateTime**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -194,8 +200,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -203,11 +209,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows the user to change date and time settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -216,11 +222,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-alloweditdevicename"></a>**Settings/AllowEditDeviceName**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -242,8 +250,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -251,11 +259,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows editing of the device name.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -264,11 +272,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowlanguage"></a>**Settings/AllowLanguage**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -290,8 +300,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -299,15 +309,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Allows the user to change the language settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -316,11 +326,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowonlinetips"></a>**Settings/AllowOnlineTips**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -342,8 +354,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -351,27 +363,21 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Enables or disables the retrieval of online tips and help for the Settings app.
If disabled, Settings will not contact Microsoft content services to retrieve tips and help content.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowpowersleep"></a>**Settings/AllowPowerSleep**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -393,8 +399,8 @@ If disabled, Settings will not contact Microsoft content services to retrieve ti
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -402,15 +408,15 @@ If disabled, Settings will not contact Microsoft content services to retrieve ti
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Allows the user to change power and sleep settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -419,11 +425,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowregion"></a>**Settings/AllowRegion**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -445,8 +453,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -454,15 +462,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Allows the user to change the region settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -471,11 +479,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowsigninoptions"></a>**Settings/AllowSignInOptions**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -497,8 +507,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -506,15 +516,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Allows the user to change sign-in options.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -523,11 +533,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowvpn"></a>**Settings/AllowVPN**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -549,8 +561,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -558,11 +570,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows the user to change VPN settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -571,11 +583,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowworkplace"></a>**Settings/AllowWorkplace**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -597,8 +611,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -606,15 +620,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Allows user to change workplace settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -623,11 +637,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-allowyouraccount"></a>**Settings/AllowYourAccount**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -649,8 +665,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -658,11 +674,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows user to change account settings.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -671,11 +687,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-configuretaskbarcalendar"></a>**Settings/ConfigureTaskbarCalendar**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -697,8 +715,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -706,8 +724,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select "Don't show additional calendars" to prevent showing other calendars besides the default calendar for the locale.
The following list shows the supported values:
@ -717,13 +735,15 @@ The following list shows the supported values:
- 2 - Simplified Chinese (Lunar).
- 3 - Traditional Chinese (Lunar).
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="settings-pagevisibilitylist"></a>**Settings/PageVisibilityList**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -745,8 +765,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -754,8 +774,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:".  Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons.
The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI "ms-settings:about" and "ms-settings:bluetooth" respectively:
@ -788,7 +808,7 @@ To validate on Desktop, do the following:
2. Configure the policy with the following string: "hide:about".
3. Open System Settings again and verify that the About page is no longer accessible.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

44
windows/client-management/mdm/policy-csp-smartscreen.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - SmartScreen
@ -30,11 +30,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="smartscreen-enableappinstallcontrol"></a>**SmartScreen/EnableAppInstallControl**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,11 +67,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -78,11 +80,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="smartscreen-enablesmartscreeninshell"></a>**SmartScreen/EnableSmartScreenInShell**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -104,8 +108,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -113,11 +117,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen for Windows.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -126,11 +130,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="smartscreen-preventoverrideforfilesinshell"></a>**SmartScreen/PreventOverrideForFilesInShell**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -152,8 +158,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -161,11 +167,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

16
windows/client-management/mdm/policy-csp-speech.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Speech
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="speech-allowspeechmodelupdate"></a>**Speech/AllowSpeechModelUpdate**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,11 +61,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Specifies whether the device will receive updates to the speech recognition and speech synthesis models. A speech model contains data used by the speech engine to convert audio to text (or vice-versa). The models are periodically updated to improve accuracy and performance. Models are non-executable data files. If enabled, the device will periodically check for updated speech models and then download them from a Microsoft service using the Background Internet Transfer Service (BITS).
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

408
windows/client-management/mdm/policy-csp-start.md
View File

File diff suppressed because it is too large Load Diff

34
windows/client-management/mdm/policy-csp-storage.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/13/2017
ms.date: 01/29/2018
---
# Policy CSP - Storage
@ -27,11 +27,13 @@ ms.date: 12/13/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="storage-allowdiskhealthmodelupdates"></a>**Storage/AllowDiskHealthModelUpdates**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 12/13/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,8 +64,8 @@ ms.date: 12/13/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Allows disk health model updates.
@ -74,13 +76,15 @@ The following list shows the supported values:
Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="storage-enhancedstoragedevices"></a>**Storage/EnhancedStorageDevices**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -102,8 +106,8 @@ Value type is integer.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -111,15 +115,15 @@ Value type is integer.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting configures whether or not Windows will activate an Enhanced Storage device.
If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -127,14 +131,14 @@ If you disable or do not configure this policy setting, Windows will activate un
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not allow Windows to activate Enhanced Storage devices*
- GP name: *TCGSecurityActivationDisabled*
- GP path: *System/Enhanced Storage Access*
- GP ADMX file name: *enhancedstorage.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>

233
windows/client-management/mdm/policy-csp-system.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/19/2017
ms.date: 01/29/2018
---
# Policy CSP - System
@ -68,11 +68,13 @@ ms.date: 12/19/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowbuildpreview"></a>**System/AllowBuildPreview**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -94,8 +96,8 @@ ms.date: 12/19/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -103,8 +105,8 @@ ms.date: 12/19/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy setting applies only to devices running Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, Windows 10 Mobile, and Windows 10 Mobile Enterprise.
@ -119,13 +121,15 @@ The following list shows the supported values:
- 1 – Allowed. Users can make their devices available for downloading and installing preview software.
- 2 (default) – Not configured. Users can make their devices available for downloading and installing preview software.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowembeddedmode"></a>**System/AllowEmbeddedMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -147,8 +151,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -156,13 +160,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether set general purpose device to be in embedded mode.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -171,11 +175,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowexperimentation"></a>**System/AllowExperimentation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -197,8 +203,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -206,8 +212,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> This policy is not supported in Windows 10, version 1607.
@ -221,13 +227,15 @@ The following list shows the supported values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowfontproviders"></a>**System/AllowFontProviders**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -249,8 +257,8 @@ Most restricted value is 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -258,8 +266,8 @@ Most restricted value is 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled).
@ -269,7 +277,7 @@ This setting is used by lower-level components for text display and fond handlin
> [!Note]
> Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -284,11 +292,13 @@ To verify if System/AllowFontProviders is set to true:
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowlocation"></a>**System/AllowLocation**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -310,8 +320,8 @@ To verify if System/AllowFontProviders is set to true:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -319,8 +329,8 @@ To verify if System/AllowFontProviders is set to true:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow app access to the Location service.
The following list shows the supported values:
@ -337,13 +347,15 @@ When switching the policy back from 0 (Force Location Off) or 2 (Force Location
For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowstoragecard"></a>**System/AllowStorageCard**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -365,8 +377,8 @@ For example, an app's original Location setting is Off. The administrator then s
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -374,13 +386,13 @@ For example, an app's original Location setting is Off. The administrator then s
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -389,11 +401,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowtelemetry"></a>**System/AllowTelemetry**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -415,8 +429,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -425,8 +439,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow the device to send diagnostic and usage telemetry data, such as Watson.
The following tables describe the supported values:
@ -504,13 +518,15 @@ Windows 10 Values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-allowusertoresetphone"></a>**System/AllowUserToResetPhone**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -532,8 +548,8 @@ Most restricted value is 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -541,13 +557,13 @@ Most restricted value is 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
orted values:
@ -557,11 +573,13 @@ orted values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-bootstartdriverinitialization"></a>**System/BootStartDriverInitialization**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -583,8 +601,8 @@ orted values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -592,11 +610,11 @@ orted values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
N/A
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -604,18 +622,20 @@ N/A
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP name: *POL_DriverLoadPolicy_Name*
- GP ADMX file name: *earlylauncham.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-disableenterpriseauthproxy"></a>**System/DisableEnterpriseAuthProxy**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -637,8 +657,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -646,20 +666,19 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-disableonedrivefilesync"></a>**System/DisableOneDriveFileSync**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -681,8 +700,8 @@ This policy setting blocks the Connected User Experience and Telemetry service f
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -690,8 +709,8 @@ This policy setting blocks the Connected User Experience and Telemetry service f
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting:
* Users cannot access OneDrive from the OneDrive app or file picker.
@ -708,7 +727,7 @@ To validate on Desktop, do the following:
2. Restart machine.
3. Verify that OneDrive.exe is not running in Task Manager.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -717,11 +736,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-disablesystemrestore"></a>**System/DisableSystemRestore**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -743,8 +764,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -752,8 +773,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows you to disable System Restore.
This policy setting allows you to turn off System Restore.
@ -766,7 +787,7 @@ If you disable or do not configure this policy setting, users can perform System
Also, see the "Turn off System Restore configuration" policy setting. If the "Turn off System Restore" policy setting is disabled or not configured, the "Turn off System Restore configuration" policy setting is used to determine whether the option to configure System Restore is available.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -774,20 +795,22 @@ Also, see the "Turn off System Restore configuration" policy setting. If the "Tu
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off System Restore*
- GP name: *SR_DisableSR*
- GP path: *System/System Restore*
- GP ADMX file name: *systemrestore.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-feedbackhubalwayssavediagnosticslocally"></a>**System/FeedbackHubAlwaysSaveDiagnosticsLocally**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -795,6 +818,8 @@ ADMX Info:
<th>Business</th>
<th>Enterprise</th>
<th>Education</th>
<th>Mobile</th>
<th>Mobile Enterprise</th>
</tr>
<tr>
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
@ -802,11 +827,13 @@ ADMX Info:
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
<td></td>
<td></td>
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -814,11 +841,11 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. When filing feedback in the Feedback Hub, diagnostic logs are collected for certain types of feedback. We now offer the option for users to save it locally, in addition to sending it to Microsoft. This policy will allow enterprises to mandate that all diagnostics are saved locally for use in internal investigations.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -826,18 +853,14 @@ The following list shows the supported values:
- 1 - True. The Feedback Hub should always save a local copy of diagnostics that may be created when a feedback is submitted.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-limitenhanceddiagnosticdatawindowsanalytics"></a>**System/LimitEnhancedDiagnosticDataWindowsAnalytics**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -859,8 +882,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -868,8 +891,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting, in combination with the System/AllowTelemetry
policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services.
@ -885,13 +908,15 @@ Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combina
If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="system-telemetryproxy"></a>**System/TelemetryProxy**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -913,8 +938,8 @@ If you disable or do not configure this policy setting, then the level of diagno
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -922,13 +947,13 @@ If you disable or do not configure this policy setting, then the level of diagno
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *&lt;server&gt;:&lt;port&gt;*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

140
windows/client-management/mdm/policy-csp-systemservices.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/03/2018
ms.date: 01/29/2018
---
# Policy CSP - SystemServices
@ -41,11 +41,13 @@ ms.date: 01/03/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="systemservices-configurehomegrouplistenerservicestartupmode"></a>**SystemServices/ConfigureHomeGroupListenerServiceStartupMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -67,8 +69,8 @@ ms.date: 01/03/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -76,26 +78,19 @@ ms.date: 01/03/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="systemservices-configurehomegroupproviderservicestartupmode"></a>**SystemServices/ConfigureHomeGroupProviderServiceStartupMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -117,8 +112,8 @@ Added in Windows 10, next major update. This setting determines whether the serv
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -126,26 +121,19 @@ Added in Windows 10, next major update. This setting determines whether the serv
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="systemservices-configurexboxaccessorymanagementservicestartupmode"></a>**SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -167,8 +155,8 @@ Added in Windows 10, next major update. This setting determines whether the serv
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -176,26 +164,19 @@ Added in Windows 10, next major update. This setting determines whether the serv
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="systemservices-configurexboxliveauthmanagerservicestartupmode"></a>**SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -217,8 +198,8 @@ Added in Windows 10, next major update. This setting determines whether the serv
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -226,26 +207,19 @@ Added in Windows 10, next major update. This setting determines whether the serv
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="systemservices-configurexboxlivegamesaveservicestartupmode"></a>**SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -267,8 +241,8 @@ Added in Windows 10, next major update. This setting determines whether the serv
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -276,26 +250,19 @@ Added in Windows 10, next major update. This setting determines whether the serv
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="systemservices-configurexboxlivenetworkingservicestartupmode"></a>**SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -317,8 +284,8 @@ Added in Windows 10, next major update. This setting determines whether the serv
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -326,20 +293,11 @@ Added in Windows 10, next major update. This setting determines whether the serv
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

25
windows/client-management/mdm/policy-csp-taskscheduler.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 01/03/2018
ms.date: 01/29/2018
---
# Policy CSP - TaskScheduler
@ -26,11 +26,13 @@ ms.date: 01/03/2018
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="taskscheduler-enablexboxgamesavetask"></a>**TaskScheduler/EnableXboxGameSaveTask**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -52,8 +54,8 @@ ms.date: 01/03/2018
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -61,20 +63,11 @@ ms.date: 01/03/2018
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

197
windows/client-management/mdm/policy-csp-textinput.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/19/2017
ms.date: 01/29/2018
---
# Policy CSP - TextInput
@ -65,11 +65,13 @@ ms.date: 12/19/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowimelogging"></a>**TextInput/AllowIMELogging**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -91,8 +93,8 @@ ms.date: 12/19/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -100,8 +102,8 @@ ms.date: 12/19/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -110,7 +112,7 @@ Allows the user to turn on and off the logging for incorrect conversion and savi
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -119,11 +121,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowimenetworkaccess"></a>**TextInput/AllowIMENetworkAccess**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -145,8 +149,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -154,8 +158,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -164,7 +168,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -173,11 +177,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowinputpanel"></a>**TextInput/AllowInputPanel**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -199,8 +205,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -208,8 +214,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -218,7 +224,7 @@ Allows the IT admin to disable the touch/handwriting keyboard on Windows.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -227,11 +233,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowjapaneseimesurrogatepaircharacters"></a>**TextInput/AllowJapaneseIMESurrogatePairCharacters**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -253,8 +261,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -262,8 +270,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -277,13 +285,15 @@ The following list shows the supported values:
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowjapaneseivscharacters"></a>**TextInput/AllowJapaneseIVSCharacters**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -305,8 +315,8 @@ Most restricted value is 0.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -314,8 +324,8 @@ Most restricted value is 0.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -324,7 +334,7 @@ Allows Japanese Ideographic Variation Sequence (IVS) characters.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -333,11 +343,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowjapanesenonpublishingstandardglyph"></a>**TextInput/AllowJapaneseNonPublishingStandardGlyph**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -359,8 +371,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -368,8 +380,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -378,7 +390,7 @@ Allows the Japanese non-publishing standard glyph.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -387,11 +399,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowjapaneseuserdictionary"></a>**TextInput/AllowJapaneseUserDictionary**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -413,8 +427,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -422,8 +436,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -432,7 +446,7 @@ Allows the Japanese user dictionary.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -441,11 +455,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowkeyboardtextsuggestions"></a>**TextInput/AllowKeyboardTextSuggestions**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -467,8 +483,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -476,8 +492,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -491,7 +507,7 @@ To validate that text prediction is disabled on Windows 10 for desktop, do the f
2. Launch the input panel/touch keyboard by touching a text input field or launching it from the taskbar. Verify that text prediction is disabled by typing some text. Text prediction on the keyboard will be disabled even if the “Show text suggestions as I type” setting is enabled in the Settings app.
3. Launch the handwriting tool from the touch keyboard. Verify that text prediction is disabled when you write using the tool.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -500,20 +516,24 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowkoreanextendedhanja"></a>**TextInput/AllowKoreanExtendedHanja**
<!--StartDescription-->
<!--Description-->
This policy has been deprecated.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-allowlanguagefeaturesuninstall"></a>**TextInput/AllowLanguageFeaturesUninstall**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -535,8 +555,8 @@ This policy has been deprecated.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -544,8 +564,8 @@ This policy has been deprecated.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -554,7 +574,7 @@ Allows the uninstall of language features, such as spell checkers, on a device.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -563,11 +583,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-enabletouchkeyboardautoinvokeindesktopmode"></a>**TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -589,8 +611,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -598,8 +620,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. This policy allows the IT admin to enable the touch keyboard to automatically show up when the device is in the desktop mode.
The touch keyboard is enabled in both the tablet and desktop mode. In the tablet mode, when you touch a textbox, the touch keyboard automatically shows up.
@ -608,27 +630,22 @@ When this policy is enabled, the touch keyboard automatically shows up when the
This policy corresponds to "Show the touch keyboard when not in tablet mode and there's no keyboard attached" in the Settings app.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
- 0 (default) - Disabled.
- 1 - Enabled.
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-excludejapaneseimeexceptjis0208"></a>**TextInput/ExcludeJapaneseIMEExceptJIS0208**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -650,8 +667,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -659,8 +676,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -672,13 +689,15 @@ The following list shows the supported values:
- 0 (default) – No characters are filtered.
- 1 – All characters except JIS0208 are filtered.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-excludejapaneseimeexceptjis0208andeudc"></a>**TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -700,8 +719,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -709,8 +728,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -722,13 +741,15 @@ The following list shows the supported values:
- 0 (default) – No characters are filtered.
- 1 – All characters except JIS0208 and EUDC are filtered.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="textinput-excludejapaneseimeexceptshiftjis"></a>**TextInput/ExcludeJapaneseIMEExceptShiftJIS**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -750,8 +771,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -759,8 +780,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@ -772,7 +793,7 @@ The following list shows the supported values:
- 0 (default) – No characters are filtered.
- 1 – All characters except ShiftJIS are filtered.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

16
windows/client-management/mdm/policy-csp-timelanguagesettings.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - TimeLanguageSettings
@ -24,11 +24,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="timelanguagesettings-allowset24hourclock"></a>**TimeLanguageSettings/AllowSet24HourClock**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -50,8 +52,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -59,11 +61,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

674
windows/client-management/mdm/policy-csp-update.md
View File

File diff suppressed because it is too large Load Diff

669
windows/client-management/mdm/policy-csp-userrights.md
View File

File diff suppressed because it is too large Load Diff

92
windows/client-management/mdm/policy-csp-wifi.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - Wifi
@ -42,20 +42,24 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-allowwifihotspotreporting"></a>**WiFi/AllowWiFiHotSpotReporting**
<!--StartDescription-->
<!--Description-->
This policy has been deprecated.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-allowautoconnecttowifisensehotspots"></a>**Wifi/AllowAutoConnectToWiFiSenseHotspots**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -77,8 +81,8 @@ This policy has been deprecated.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -86,13 +90,13 @@ This policy has been deprecated.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow or disallow the device to automatically connect to Wi-Fi hotspots.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -101,11 +105,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-allowinternetsharing"></a>**Wifi/AllowInternetSharing**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -127,8 +133,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -136,13 +142,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow or disallow internet sharing.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -151,11 +157,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-allowmanualwificonfiguration"></a>**Wifi/AllowManualWiFiConfiguration**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -177,8 +185,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -186,8 +194,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks.
Most restricted value is 0.
@ -195,7 +203,7 @@ Most restricted value is 0.
> [!NOTE]
> Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that are not user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -204,11 +212,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-allowwifi"></a>**Wifi/AllowWiFi**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -230,8 +240,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -239,13 +249,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow or disallow WiFi connection.
Most restricted value is 0.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -254,11 +264,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-allowwifidirect"></a>**Wifi/AllowWiFiDirect**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -280,8 +292,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -289,11 +301,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Allow WiFi Direct connection..
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -302,11 +314,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wifi-wlanscanmode"></a>**Wifi/WLANScanMode**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -328,8 +342,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -337,8 +351,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected.
Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency.
@ -347,7 +361,7 @@ The default value is 0.
Supported operations are Add, Delete, Get, and Replace.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

311
windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/29/2017
ms.date: 01/29/2018
---
# Policy CSP - WindowsDefenderSecurityCenter
@ -80,11 +80,13 @@ ms.date: 12/29/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-companyname"></a>**WindowsDefenderSecurityCenter/CompanyName**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -106,8 +108,8 @@ ms.date: 12/29/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -115,19 +117,21 @@ ms.date: 12/29/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options.
Value type is string. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disableaccountprotectionui"></a>**WindowsDefenderSecurityCenter/DisableAccountProtectionUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -149,8 +153,8 @@ Value type is string. Supported operations are Add, Get, Replace and Delete.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -158,8 +162,8 @@ Value type is string. Supported operations are Add, Get, Replace and Delete.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major release. Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Valid values:
@ -167,22 +171,15 @@ Valid values:
- 0 - (Disable) The users can see the display of the Account protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the Account protection area in Windows Defender Security Center.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disableappbrowserui"></a>**WindowsDefenderSecurityCenter/DisableAppBrowserUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -204,8 +201,8 @@ Valid values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -213,14 +210,13 @@ Valid values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -229,11 +225,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disabledevicesecurityui"></a>**WindowsDefenderSecurityCenter/DisableDeviceSecurityUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -255,8 +253,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -264,8 +262,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major release. Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Valid values:
@ -273,22 +271,15 @@ Valid values:
- 0 - (Disable) The users can see the display of the Device security area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the Device secuirty area in Windows Defender Security Center.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disableenhancednotifications"></a>**WindowsDefenderSecurityCenter/DisableEnhancedNotifications**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -310,8 +301,8 @@ Valid values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -319,8 +310,8 @@ Valid values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy if you want Windows Defender Security Center to only display notifications which are considered critical. If you disable or do not configure this setting, Windows Defender Security Center will display critical and non-critical notifications to users.
> [!Note]
@ -328,7 +319,7 @@ Added in Windows 10, version 1709. Use this policy if you want Windows Defender
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -337,11 +328,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disablefamilyui"></a>**WindowsDefenderSecurityCenter/DisableFamilyUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -363,8 +356,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -372,13 +365,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -387,11 +380,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disablehealthui"></a>**WindowsDefenderSecurityCenter/DisableHealthUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -413,8 +408,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -422,13 +417,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -437,11 +432,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disablenetworkui"></a>**WindowsDefenderSecurityCenter/DisableNetworkUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -463,8 +460,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -472,13 +469,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -487,11 +484,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disablenotifications"></a>**WindowsDefenderSecurityCenter/DisableNotifications**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -513,8 +512,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -522,13 +521,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. If you disable or do not configure this setting, Windows Defender Security Center notifications will display on devices.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -537,11 +536,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disablevirusui"></a>**WindowsDefenderSecurityCenter/DisableVirusUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -563,8 +564,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -572,13 +573,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -587,11 +588,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-disallowexploitprotectionoverride"></a>**WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -613,8 +616,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -622,13 +625,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -637,11 +640,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-email"></a>**WindowsDefenderSecurityCenter/Email**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -663,8 +668,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -672,19 +677,21 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. The email address that is displayed to users.  The default mail application is used to initiate email actions. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
Value type is string. Supported operations are Add, Get, Replace and Delete.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-enablecustomizedtoasts"></a>**WindowsDefenderSecurityCenter/EnableCustomizedToasts**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -706,8 +713,8 @@ Value type is string. Supported operations are Add, Get, Replace and Delete.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -715,13 +722,13 @@ Value type is string. Supported operations are Add, Get, Replace and Delete.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Enable this policy to display your company name and contact options in the notifications. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will display a default notification text.
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -730,11 +737,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-enableinappcustomization"></a>**WindowsDefenderSecurityCenter/EnableInAppCustomization**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -756,8 +765,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -765,13 +774,13 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will not display the contact card fly out notification.
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -780,11 +789,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-hideransomwaredatarecovery"></a>**WindowsDefenderSecurityCenter/HideRansomwareDataRecovery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -806,8 +817,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -815,30 +826,24 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center.
Valid values:
- 0 - (Disable or not configured) The Ransomware data recovery area will be visible.
- 1 - (Enable) The Ransomware data recovery area is hidden.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-hidesecureboot"></a>**WindowsDefenderSecurityCenter/HideSecureBoot**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -860,8 +865,8 @@ Valid values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -869,30 +874,24 @@ Valid values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Use this policy to hide the Secure boot area in the Windows Defender Security Center.
Valid values:
- 0 - (Disable or not configured) The Secure boot area is displayed.
- 1 - (Enable) The Secure boot area is hidden.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-hidetpmtroubleshooting"></a>**WindowsDefenderSecurityCenter/HideTPMTroubleshooting**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -914,8 +913,8 @@ Valid values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -923,30 +922,24 @@ Valid values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, next major update. Use this policy to hide the Security processor (TPM) troubleshooting area in the Windows Defender Security Center.
Valid values:
- 0 - (Disable or not configured) The Security processor (TPM) troubleshooting area is displayed.
- 1 - (Enable) The Security processor (TPM) troubleshooting area is hidden.
<!--EndDescription-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-phone"></a>**WindowsDefenderSecurityCenter/Phone**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -968,8 +961,8 @@ Valid values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -977,19 +970,21 @@ Valid values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. The phone number or Skype ID that is displayed to users.  Skype is used to initiate the call. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
Value type is string. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsdefendersecuritycenter-url"></a>**WindowsDefenderSecurityCenter/URL**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -1011,8 +1006,8 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -1020,13 +1015,13 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. The help portal URL this is displayed to users. The default browser is used to initiate this action. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options.
Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

30
windows/client-management/mdm/policy-csp-windowsinkworkspace.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - WindowsInkWorkspace
@ -27,11 +27,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace"></a>**WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -53,8 +55,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -62,11 +64,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Show recommended app suggestions in the ink workspace.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -75,11 +77,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowsinkworkspace-allowwindowsinkworkspace"></a>**WindowsInkWorkspace/AllowWindowsInkWorkspace**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -101,8 +105,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -110,8 +114,8 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Specifies whether to allow the user to access the ink workspace.
Value type is int. The following list shows the supported values:
@ -120,7 +124,7 @@ Value type is int. The following list shows the supported values:
- 1 - ink workspace is enabled (feature is turned on), but the user cannot access it above the lock screen.
- 2 (default) - ink workspace is enabled (feature is turned on), and the user is allowed to use it above the lock screen.
<!--EndDescription-->
<!--/Description-->
<!--EndPolicy-->
<hr/>

52
windows/client-management/mdm/policy-csp-windowslogon.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - WindowsLogon
@ -30,11 +30,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="windowslogon-disablelockscreenappnotifications"></a>**WindowsLogon/DisableLockScreenAppNotifications**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -56,8 +58,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -65,15 +67,15 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to prevent app notifications from appearing on the lock screen.
If you enable this policy setting, no app notifications are displayed on the lock screen.
If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -81,20 +83,22 @@ If you disable or do not configure this policy setting, users can choose which a
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Turn off app notifications on the lock screen*
- GP name: *DisableLockScreenAppNotifications*
- GP path: *System/Logon*
- GP ADMX file name: *logon.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowslogon-dontdisplaynetworkselectionui"></a>**WindowsLogon/DontDisplayNetworkSelectionUI**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -116,8 +120,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -125,15 +129,15 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.
If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows.
If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.
<!--EndDescription-->
<!--/Description-->
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@ -141,20 +145,22 @@ If you disable or don't configure this policy setting, any user can disconnect t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
<!--StartADMX-->
<!--ADMX-->
ADMX Info:
- GP English name: *Do not display network selection UI*
- GP name: *DontDisplayNetworkSelectionUI*
- GP path: *System/Logon*
- GP ADMX file name: *logon.admx*
<!--EndADMX-->
<!--/ADMX-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="windowslogon-hidefastuserswitching"></a>**WindowsLogon/HideFastUserSwitching**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -176,8 +182,8 @@ ADMX Info:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -185,8 +191,8 @@ ADMX Info:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations.
To validate on Desktop, do the following:
@ -194,7 +200,7 @@ To validate on Desktop, do the following:
1. Enable policy.
2. Verify that the Switch account button in Start is hidden.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:

110
windows/client-management/mdm/policy-csp-wirelessdisplay.md
View File

@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
ms.date: 12/14/2017
ms.date: 01/29/2018
---
# Policy CSP - WirelessDisplay
@ -45,11 +45,13 @@ ms.date: 12/14/2017
</dd>
</dl>
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowmdnsadvertisement"></a>**WirelessDisplay/AllowMdnsAdvertisement**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -71,8 +73,8 @@ ms.date: 12/14/2017
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -80,11 +82,11 @@ ms.date: 12/14/2017
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. If the network administrator is concerned about network congestion, they may set this policy to 0, disabling mDNS advertisement.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -93,11 +95,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowmdnsdiscovery"></a>**WirelessDisplay/AllowMdnsDiscovery**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -119,8 +123,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -128,11 +132,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1709. This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. If the network administrator is concerned about network congestion, they may set this policy to 0, disabling mDNS discovery.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -141,11 +145,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowprojectionfrompc"></a>**WirelessDisplay/AllowProjectionFromPC**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -167,8 +173,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -176,11 +182,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -189,11 +195,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowprojectionfrompcoverinfrastructure"></a>**WirelessDisplay/AllowProjectionFromPCOverInfrastructure**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -215,8 +223,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -224,11 +232,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC over infrastructure.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -237,11 +245,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowprojectiontopc"></a>**WirelessDisplay/AllowProjectionToPC**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -263,8 +273,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -272,15 +282,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Allow or disallow turning off the projection to a PC.
If you set it to 0 (zero), your PC is not discoverable and you cannot project to it. If you set it to 1, your PC is discoverable and you can project to it above the lock screen. The user has an option to turn it always on or always off except for manual launch. In PCs that support Miracast, after the policy is applied you can verify the setting from the user interface in **Settings** &gt; **System** &gt; **Projecting to this PC**.
Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -289,11 +299,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowprojectiontopcoverinfrastructure"></a>**WirelessDisplay/AllowProjectionToPCOverInfrastructure**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -315,8 +327,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -324,11 +336,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. This policy setting allows you to turn off projection to a PC over infrastructure.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -337,11 +349,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-allowuserinputfromwirelessdisplayreceiver"></a>**WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver**
<!--StartScope-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -349,11 +363,11 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1703. Setting this policy controls whether or not the wireless display can send input&#8212;keyboard, mouse, pen, and touch input if the display supports it&#8212;back to the source device.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values:
@ -362,11 +376,13 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--EndPolicy-->
<hr/>
<!--StartPolicy-->
<a href="" id="wirelessdisplay-requirepinforpairing"></a>**WirelessDisplay/RequirePinForPairing**
<!--StartSKU-->
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
@ -388,8 +404,8 @@ The following list shows the supported values:
</tr>
</table>
<!--EndSKU-->
<!--StartScope-->
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@ -397,15 +413,15 @@ The following list shows the supported values:
<hr/>
<!--EndScope-->
<!--StartDescription-->
<!--/Scope-->
<!--Description-->
Added in Windows 10, version 1607. Allow or disallow requirement for a PIN for pairing.
If you turn this on, the pairing ceremony for new devices will always require a PIN. If you turn this off or do not configure it, a PIN is not required for pairing. In PCs that support Miracast, after the policy is applied you can verify the setting from the user interface in **Settings** &gt; **System** &gt; **Projecting to this PC**.
Value type is integer.
<!--EndDescription-->
<!--/Description-->
<!--SupportedValues-->
The following list shows the supported values: