mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Added windows sandbox policies
This commit is contained in:
ManikaDhiman
parent
d25ea0fced
commit
204ce4bfbe
@ -293,6 +293,7 @@
|
|||||||
#### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md)
|
#### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md)
|
||||||
#### [WindowsLogon](policy-csp-windowslogon.md)
|
#### [WindowsLogon](policy-csp-windowslogon.md)
|
||||||
#### [WindowsPowerShell](policy-csp-windowspowershell.md)
|
#### [WindowsPowerShell](policy-csp-windowspowershell.md)
|
||||||
|
#### [WindowsSandbox](policy-csp-windowssandbox.md)
|
||||||
#### [WirelessDisplay](policy-csp-wirelessdisplay.md)
|
#### [WirelessDisplay](policy-csp-wirelessdisplay.md)
|
||||||
### [PolicyManager CSP](policymanager-csp.md)
|
### [PolicyManager CSP](policymanager-csp.md)
|
||||||
### [Provisioning CSP](provisioning-csp.md)
|
### [Provisioning CSP](provisioning-csp.md)
|
||||||
|
|||||||
@ -4872,6 +4872,32 @@ The following diagram shows the Policy configuration service provider in tree fo
|
|||||||
</dd>
|
</dd>
|
||||||
</dl>
|
</dl>
|
||||||
|
|
||||||
|
### WindowsSandbox policies
|
||||||
|
|
||||||
|
<dl>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowaudioinput" id="windowssandbox-allowaudioinput">WindowsSandbox/AllowAudioInput</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection" id="windowssandbox-allowclipboardredirection">WindowsSandbox/AllowClipboardRedirection</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allownetworking" id="windowssandbox-allownetworking">WindowsSandbox/AllowNetworking</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection" id="windowssandbox-allowprinterredirection">WindowsSandbox/AllowPrinterRedirection</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowprotectedclient" id="windowssandbox-allowprotectedclient">WindowsSandbox/AllowProtectedClient</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowvgpu" id="windowssandbox-allowvgpu">WindowsSandbox/AllowVGPU</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowvideoinput" id="windowssandbox-allowvideoinput">WindowsSandbox/AllowVideoInput</a>
|
||||||
|
</dd>
|
||||||
|
</dl>
|
||||||
|
|
||||||
### WirelessDisplay policies
|
### WirelessDisplay policies
|
||||||
|
|
||||||
<dl>
|
<dl>
|
||||||
|
|||||||
648
windows/client-management/mdm/policy-csp-windowssandbox.md
Normal file
648
windows/client-management/mdm/policy-csp-windowssandbox.md
Normal file
@ -0,0 +1,648 @@
|
|||||||
|
---
|
||||||
|
title: Policy CSP - WindowsSandbox
|
||||||
|
description: Policy CSP - WindowsSandbox
|
||||||
|
ms.author: dansimp
|
||||||
|
ms.topic: article
|
||||||
|
ms.prod: w10
|
||||||
|
ms.technology: windows
|
||||||
|
author: manikadhiman
|
||||||
|
ms.localizationpriority: medium
|
||||||
|
ms.date: 10/06/2020
|
||||||
|
---
|
||||||
|
|
||||||
|
# Policy CSP - WindowsSandbox
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||||
|
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policies-->
|
||||||
|
## WindowsSandbox policies
|
||||||
|
|
||||||
|
<dl>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allowaudioinput">WindowsSandbox/AllowAudioInput</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allowclipboardredirection">WindowsSandbox/AllowClipboardRedirection</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allownetworking">WindowsSandbox/AllowNetworking</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allowprinterredirection">WindowsSandbox/AllowPrinterRedirection</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allowprotectedclient">WindowsSandbox/AllowProtectedClient</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allowvgpu">WindowsSandbox/AllowVGPU</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#windowssandbox-allowvideoinput">WindowsSandbox/AllowVideoInput</a>
|
||||||
|
</dd>
|
||||||
|
</dl>
|
||||||
|
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allowaudioinput"></a>**WindowsSandbox/AllowAudioInput**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enable or disable audio input to the Sandbox.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> There may be security implications of exposing host audio input to the container.
|
||||||
|
|
||||||
|
If this policy is not configured, end-users get the default behavior (audio input enabled).
|
||||||
|
|
||||||
|
If audio input is disabled, a user will not be able to enable audio input from their own configuration file.
|
||||||
|
|
||||||
|
If audio input is enabled, a user will be able to disable audio input from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
|
||||||
|
- GP English Name: *Allow audio input in Windows Sandbox*
|
||||||
|
- GP name: *AllowAudioInput*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
|
||||||
|
- 0 - Disabled
|
||||||
|
- 1 (default) - Enabled
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allowclipboardredirection"></a>**WindowsSandbox/AllowClipboardRedirection**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enable or disable sharing of the host clipboard with the sandbox.
|
||||||
|
|
||||||
|
If this policy is not configured, end-users get the default behavior (clipboard redirection enabled.
|
||||||
|
|
||||||
|
If clipboard sharing is disabled, a user will not be able to enable clipboard sharing from their own configuration file.
|
||||||
|
|
||||||
|
If clipboard sharing is enabled, a user will be able to disable clipboard sharing from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
|
||||||
|
- GP English Name: *Allow clipboard sharing with Windows Sandbox*
|
||||||
|
- GP name: *AllowClipboardRedirection*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
|
||||||
|
- 0 - Disabled
|
||||||
|
- 1 (default) - Enabled
|
||||||
|
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allownetworking"></a>**WindowsSandbox/AllowNetworking**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enable or disable networking in Windows Sandbox. Disabling network access can decrease the attack surface exposed by the Sandbox. Enabling networking can expose untrusted applications to the internal network.
|
||||||
|
|
||||||
|
If this policy is not configured, end-users get the default behavior (networking enabled).
|
||||||
|
|
||||||
|
If networking is disabled, a user will not be able to enable networking from their own configuration file.
|
||||||
|
|
||||||
|
If networking is enabled, a user will be able to disable networking from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
|
||||||
|
- GP English Name: *Allow networking in Windows Sandbox*
|
||||||
|
- GP name: *AllowNetworking*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
- 0 - Disabled
|
||||||
|
- 1 (default) - Enabled
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allowprinterredirection"></a>**WindowsSandbox/AllowPrinterRedirection**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enable or disable printer sharing from the host into the Sandbox.
|
||||||
|
|
||||||
|
If this policy is not configured, end-users get the default behavior (printer sharing disabled).
|
||||||
|
|
||||||
|
If printer sharing is disabled, a user will not be able to enable printer sharing from their own configuration file.
|
||||||
|
|
||||||
|
If printer sharing is enabled, a user will be able to disable printer sharing from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
|
||||||
|
- GP English Name: *Allow printer sharing with Windows Sandbox*
|
||||||
|
- GP name: *AllowPrinterRedirection*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
|
||||||
|
- 0 - Disabled
|
||||||
|
- 1 (default) - Enabled
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allowprotectedclient"></a>**WindowsSandbox/AllowProtectedClient**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enabled increased-security settings on the Sandbox RDP session. These settings decrease the attack surface of the sandbox.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Enabling this setting may restrict user's ability to copy and paste files in and out of Windows Sandbox.
|
||||||
|
|
||||||
|
If this policy is not configured, end-users get the default behavior (Sandbox does not run in protected client mode).
|
||||||
|
|
||||||
|
If protected client mode is enabled, a user will not be able to disable protected client mode from their own configuration file.
|
||||||
|
|
||||||
|
If protected client mode is disabled, a user will be able to enable protected client mode from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
- GP English Name: *Run Windows Sandbox in Protected Client Mode*
|
||||||
|
- GP name: *AllowProtectedClient*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
|
||||||
|
- 0 (default) - Disabled
|
||||||
|
- 1 - Enabled
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allowvgpu"></a>**WindowsSandbox/AllowVGPU**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enable or disable virtualized GPU for Windows Sandbox.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Enabling virtualized GPU can potentially increase the attack surface of Windows Sandbox.
|
||||||
|
|
||||||
|
If this policy is not configured, end-users get the default behavior (vGPU is disabled).
|
||||||
|
|
||||||
|
If vGPU is disabled, a user will not be able to enable vGPU support from their own configuration file.
|
||||||
|
|
||||||
|
If vGPU is enabled, a user will be able to disable vGPU support from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
|
||||||
|
- GP English Name: *Allow vGPU sharing for Windows Sandbox*
|
||||||
|
- GP name: *AllowVGPU*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
|
||||||
|
- 0 (default) - Disabled
|
||||||
|
- 1 - Enabled
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="windowssandbox-allowvideoinput"></a>**WindowsSandbox/AllowVideoInput**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Windows Edition</th>
|
||||||
|
<th>Supported?</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Home</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Pro</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Business</td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Enterprise</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Education</td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
This policy setting allows the IT admin to enable or disable video input to the Sandbox.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> There may be security implications of exposing host video input to the container.
|
||||||
|
|
||||||
|
If this policy is not configured, users get the default behavior (video input disabled).
|
||||||
|
|
||||||
|
If video input is disabled, users will not be able to enable video input from their own configuration file.
|
||||||
|
|
||||||
|
If video input is enabled, users will be able to disable video input from their own configuration file to make the device more secure.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
- GP English Name: *Allow video input in Windows Sandbox*
|
||||||
|
- GP name: *AllowVideoInput*
|
||||||
|
- GP path: *Windows Components/Windows Sandbox*
|
||||||
|
- GP ADMX file name: *WindowsSandbox.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
The following are the supported values:
|
||||||
|
|
||||||
|
- 0 (default) - Disabled
|
||||||
|
- 1 - Enabled
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
Footnotes:
|
||||||
|
|
||||||
|
- 1 - Available in Windows 10, version 1607.
|
||||||
|
- 2 - Available in Windows 10, version 1703.
|
||||||
|
- 3 - Available in Windows 10, version 1709.
|
||||||
|
- 4 - Available in Windows 10, version 1803.
|
||||||
|
- 5 - Available in Windows 10, version 1809.
|
||||||
|
- 6 - Available in Windows 10, version 1903.
|
||||||
|
- 7 - Available in Windows 10, version 1909.
|
||||||
|
- 8 - Available in Windows 10, version 2004.
|
||||||
|
- 9 - Available in Windows 10, version 2010.
|
||||||
|
|
||||||
|
<!--/Policies-->
|
||||||
Loading…
x
Reference in New Issue
Block a user