From 20f98055d242ddf2784d619aa66870f6efc35a54 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 21 Sep 2020 14:52:17 -0700 Subject: [PATCH] Added new policies --- windows/client-management/mdm/TOC.md | 3 + .../policy-configuration-service-provider.md | 39 ++ .../mdm/policy-csp-admx-sharedfolders.md | 192 ++++++++++ .../mdm/policy-csp-admx-sharing.md | 190 ++++++++++ ...csp-admx-shellcommandpromptregedittools.md | 347 ++++++++++++++++++ .../mdm/policy-csps-admx-backed.md | 8 + 6 files changed, 779 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-sharedfolders.md create mode 100644 windows/client-management/mdm/policy-csp-admx-sharing.md create mode 100644 windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 036234f80f..968e630165 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -204,6 +204,9 @@ #### [ADMX_sdiageng](policy-csp-admx-sdiageng.md) #### [ADMX_Securitycenter](policy-csp-admx-securitycenter.md) #### [ADMX_Servicing](policy-csp-admx-servicing.md) +#### [ADMX_SharedFolders](policy-csp-admx-sharedfolders.md) +#### [ADMX_Sharing](policy-csp-admx-sharing.md) +#### [ADMX_ShellCommandPromptRegEditTools](policy-csp-admx-shellcommandpromptregedittools.md) #### [ApplicationDefaults](policy-csp-applicationdefaults.md) #### [ApplicationManagement](policy-csp-applicationmanagement.md) #### [AppRuntime](policy-csp-appruntime.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 73fac1a3a3..f4da9592b5 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -858,6 +858,45 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_SharedFolders policies + +
+
+ ADMX_SharedFolders/PublishDfsRoots +
+
+ ADMX_SharedFolders/PublishSharedFolders +
+
+ +### ADMX_Sharing policies + +
+
+ ADMX_Sharing/DisableHomeGroup +
+
+ ADMX_Sharing/NoInplaceSharing +
+
+ +### ADMX_ShellCommandPromptRegEditTools policies + +
+
+ ADMX_ShellCommandPromptRegEditTools/DisableCMD +
+
+ ADMX_ShellCommandPromptRegEditTools/DisableRegedit +
+
+ ADMX_ShellCommandPromptRegEditTools/DisallowApps +
+
+ ADMX_ShellCommandPromptRegEditTools/RestrictApps +
+
+ ### ApplicationDefaults policies
diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md new file mode 100644 index 0000000000..7b7f7b195c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -0,0 +1,192 @@ +--- +title: Policy CSP - ADMX_SharedFolders +description: Policy CSP - ADMX_SharedFolders +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SharedFolders +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_SharedFolders policies + +
+
+ ADMX_SharedFolders/PublishDfsRoots +
+
+ ADMX_SharedFolders/PublishSharedFolders +
+
+ +
+ + +**ADMX_SharedFolders/PublishDfsRoots** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS). + +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . + +If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. + +> [!NOTE] +> The default is to allow shared folders to be published when this setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow DFS roots to be published* +- GP name: *PublishDfsRoots* +- GP path: *Shared Folders* +- GP ADMX file name: *SharedFolders.admx* + + + + +
+ + +**ADMX_SharedFolders/PublishSharedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines whether the user can publish shared folders in Active Directory Domain Services (AD DS). + +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. + +If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. + +> [!NOTE] +> The default is to allow shared folders to be published when this setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow shared folders to be published* +- GP name: *PublishSharedFolders* +- GP path: *Shared Folders* +- GP ADMX file name: *SharedFolders.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md new file mode 100644 index 0000000000..0a6a1a20dc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -0,0 +1,190 @@ +--- +title: Policy CSP - ADMX_Sharing +description: Policy CSP - ADMX_Sharing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Sharing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_Sharing policies + +
+
+ ADMX_Sharing/DisableHomeGroup +
+
+ ADMX_Sharing/NoInplaceSharing +
+
+ +
+ + +**ADMX_Sharing/DisableHomeGroup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether users can add computers to a homegroup. By default, users can add their computer to a homegroup on a private network. + +If you enable this policy setting, users cannot add computers to a homegroup. This policy setting does not affect other network sharing features. + +If you disable or do not configure this policy setting, users can add computers to a homegroup. However, data on a domain-joined computer is not shared with the homegroup. + +This policy setting is not configured by default. + +You must restart the computer for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent the computer from joining a homegroup* +- GP name: *DisableHomeGroup* +- GP path: *Windows Components\HomeGroup* +- GP ADMX file name: *Sharing.admx* + + + + +
+ + +**ADMX_Sharing/NoInplaceSharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. + +If you enable this policy setting, users cannot share files within their profile using the sharing wizard. Also, the sharing wizard cannot create a share at %root%\users and can only be used to create SMB shares on folders. + +If you disable or don't configure this policy setting, users can share files out of their user profile after an administrator has opted in the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from sharing files within their profile.* +- GP name: *NoInplaceSharing* +- GP path: *Windows Components\Network Sharing* +- GP ADMX file name: *Sharing.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md new file mode 100644 index 0000000000..60630dd5a1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -0,0 +1,347 @@ +--- +title: Policy CSP - ADMX_ShellCommandPromptRegEditTools +description: Policy CSP - ADMX_ShellCommandPromptRegEditTools +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ShellCommandPromptRegEditTools +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_ShellCommandPromptRegEditTools policies + +
+
+ ADMX_ShellCommandPromptRegEditTools/DisableCMD +
+
+ ADMX_ShellCommandPromptRegEditTools/DisableRegedit +
+
+ ADMX_ShellCommandPromptRegEditTools/DisallowApps +
+
+ ADMX_ShellCommandPromptRegEditTools/RestrictApps +
+
+ + +
+ + +**ADMX_ShellCommandPromptRegEditTools/DisableCMD** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer. + +If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action. + +If you disable this policy setting or do not configure it, users can run Cmd.exe and batch files normally. + +> [!NOTE] +> Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Remote Desktop Services. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to the command prompt* +- GP name: *DisableCMD* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
+ + +**ADMX_ShellCommandPromptRegEditTools/DisableRegedit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. Disables the Windows registry editor Regedit.exe. + +If you enable this policy setting and the user tries to start Regedit.exe, a message appears explaining that a policy setting prevents the action. + +If you disable this policy setting or do not configure it, users can run Regedit.exe normally. + +To prevent users from using other administrative tools, use the "Run only specified Windows applications" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to registry editing tools* +- GP name: *DisableRegistryTools* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + + +
+ +**ADMX_ShellCommandPromptRegEditTools/DisallowApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting prevents Windows from running the programs you specify in this policy setting. + +If you enable this policy setting, users cannot run programs that you add to the list of disallowed applications. + +If you disable this policy setting or do not configure it, users can run any programs. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +> [!NOTE] +> Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Don't run specified Windows applications* +- GP name: *DisallowRun* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
+ + +**ADMX_ShellCommandPromptRegEditTools/RestrictApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in Windows 10 Insider Preview Build 20185. Limits the Windows programs that users have permission to run on the computer. + +If you enable this policy setting, users can only run programs that you add to the list of allowed applications. + +If you disable this policy setting or do not configure it, users can run all applications. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +> [!NOTE] +> Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +> To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run only specified Windows applications* +- GP name: *RestrictRun* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csps-admx-backed.md b/windows/client-management/mdm/policy-csps-admx-backed.md index 8bc7c3e083..ceb9b49bc3 100644 --- a/windows/client-management/mdm/policy-csps-admx-backed.md +++ b/windows/client-management/mdm/policy-csps-admx-backed.md @@ -206,6 +206,14 @@ ms.date: 08/18/2020 - [ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy) - [ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain](/policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain) - [ADMX_Servicing/Servicing](./policy-csp-admx-servicing.md#admx-servicing-servicing) +- [ADMX_SharedFolders/PublishDfsRoots](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) +- [ADMX_SharedFolders/PublishSharedFolders](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) +- [ADMX_Sharing/DisableHomeGroup](./policy-csp-admx-sharing.md#admx-sharing-disablehomegroup) +- [ADMX_Sharing/NoInplaceSharing](./policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) +- [ADMX_ShellCommandPromptRegEditTools/DisableCMD](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [ADMX_ShellCommandPromptRegEditTools/DisableRegedit](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) +- [ADMX_ShellCommandPromptRegEditTools/DisallowApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) +- [ADMX_ShellCommandPromptRegEditTools/RestrictApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) - [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) - [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) - [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization)