mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'main' into vp-defendertp
This commit is contained in:
Vinay Pamnani
GitHub
commit
2299a80e04
@ -4,7 +4,7 @@ description: Learn more about the BitLocker CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -21,6 +21,9 @@ ms.topic: reference
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
|
||||
|
||||
<!-- BitLocker-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it's also supported in Windows 10 Pro.
|
||||
@ -40,6 +43,7 @@ The following list shows the BitLocker configuration service provider nodes:
|
||||
|
||||
- ./Device/Vendor/MSFT/BitLocker
|
||||
- [AllowStandardUserEncryption](#allowstandarduserencryption)
|
||||
- [AllowSuspensionOfBitLockerProtection](#allowsuspensionofbitlockerprotection)
|
||||
- [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption)
|
||||
- [ConfigureRecoveryPasswordRotation](#configurerecoverypasswordrotation)
|
||||
- [EncryptionMethodByDriveType](#encryptionmethodbydrivetype)
|
||||
@ -149,6 +153,63 @@ To disable this policy, use the following SyncML:
|
||||
|
||||
<!-- Device-AllowStandardUserEncryption-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Begin -->
|
||||
## AllowSuspensionOfBitLockerProtection
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Applicability-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/BitLocker/AllowSuspensionOfBitLockerProtection
|
||||
```
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-OmaUri-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This policy setting allows suspending protection for BitLocker Drive Encryption when enabled and prevents suspending protection when disabled.
|
||||
|
||||
> [!WARNING]
|
||||
> When policy is disabled, some scenarios will be blocked and prevent those scenarios from behaving normally.
|
||||
|
||||
The expected values for this policy are:
|
||||
|
||||
0 = Prevent BitLocker Drive Encryption protection from being suspended.
|
||||
1 = This is the default, when the policy is not set. Allows suspending BitLocker Drive Encryption protection.
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Description-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Editable-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 1 |
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-DFProperties-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | Prevent BitLocker Drive Encryption protection from being suspended. |
|
||||
| 1 (Default) | This is the default, when the policy is not set. Allows suspending BitLocker Drive Encryption protection. |
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-AllowedValues-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-Examples-End -->
|
||||
|
||||
<!-- Device-AllowSuspensionOfBitLockerProtection-End -->
|
||||
|
||||
<!-- Device-AllowWarningForOtherDiskEncryption-Begin -->
|
||||
## AllowWarningForOtherDiskEncryption
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -772,6 +772,52 @@ Supported Values: String form of request ID. Example format of request ID is GUI
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>AllowSuspensionOfBitLockerProtection</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>This policy setting allows suspending protection for BitLocker Drive Encryption when enabled and prevents suspending protection when disabled.
|
||||
Warning: When policy is disabled, some scenarios will be blocked and prevent those scenarios from behaving normally.
|
||||
The format is integer.
|
||||
The expected values for this policy are:
|
||||
|
||||
0 = Prevent BitLocker Drive Encryption protection from being suspended.
|
||||
1 = This is the default, when the policy is not set. Allows suspending BitLocker Drive Encryption protection.
|
||||
</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>9.9</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Prevent BitLocker Drive Encryption protection from being suspended.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>This is the default, when the policy is not set. Allows suspending BitLocker Drive Encryption protection.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Status</NodeName>
|
||||
<DFProperties>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Defender CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -63,6 +63,7 @@ The following list shows the Defender configuration service provider nodes:
|
||||
- [HideExclusionsFromLocalUsers](#configurationhideexclusionsfromlocalusers)
|
||||
- [IntelTDTEnabled](#configurationinteltdtenabled)
|
||||
- [MeteredConnectionUpdates](#configurationmeteredconnectionupdates)
|
||||
- [OobeEnableRtpAndSigUpdate](#configurationoobeenablertpandsigupdate)
|
||||
- [PassiveRemediation](#configurationpassiveremediation)
|
||||
- [PlatformUpdatesChannel](#configurationplatformupdateschannel)
|
||||
- [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes)
|
||||
@ -1808,6 +1809,55 @@ Allow managed devices to update through metered connections. Default is 0 - not
|
||||
|
||||
<!-- Device-Configuration-MeteredConnectionUpdates-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Begin -->
|
||||
### Configuration/OobeEnableRtpAndSigUpdate
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Applicability-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Defender/Configuration/OobeEnableRtpAndSigUpdate
|
||||
```
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-OmaUri-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This setting allows you to configure whether real-time protection and Security Intelligence Updates are enabled during OOBE (Out of Box experience).
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Description-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Editable-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 0 |
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-DFProperties-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 1 | If you enable this setting, real-time protection and Security Intelligence Updates are enabled during OOBE. |
|
||||
| 0 (Default) | If you either disable or do not configure this setting, real-time protection and Security Intelligence Updates during OOBE is not enabled. |
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-AllowedValues-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-Examples-End -->
|
||||
|
||||
<!-- Device-Configuration-OobeEnableRtpAndSigUpdate-End -->
|
||||
|
||||
<!-- Device-Configuration-PassiveRemediation-Begin -->
|
||||
### Configuration/PassiveRemediation
|
||||
|
||||
@ -3678,7 +3728,7 @@ OfflineScan action starts a Microsoft Defender Offline scan on the computer wher
|
||||
|
||||
<!-- Device-RollbackEngine-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
RollbackEngine action rolls back Microsoft Defender engine to its last known good saved version on the computer where you run the command.
|
||||
RollbackEngine action rolls back Microsoft Defender engine to it's last known good saved version on the computer where you run the command.
|
||||
<!-- Device-RollbackEngine-Description-End -->
|
||||
|
||||
<!-- Device-RollbackEngine-Editable-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -1920,6 +1920,45 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>OobeEnableRtpAndSigUpdate</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>This setting allows you to configure whether real-time protection and Security Intelligence Updates are enabled during OOBE (Out of Box experience).</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.3</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>If you enable this setting, real-time protection and Security Intelligence Updates are enabled during OOBE.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>If you either disable or do not configure this setting, real-time protection and Security Intelligence Updates during OOBE is not enabled.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ThrottleForScheduledScanOnly</NodeName>
|
||||
<DFProperties>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the DevicePreparation CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -31,6 +31,7 @@ The following list shows the DevicePreparation configuration service provider no
|
||||
- [ClassID](#bootstrapperagentclassid)
|
||||
- [ExecutionContext](#bootstrapperagentexecutioncontext)
|
||||
- [InstallationStatusUri](#bootstrapperagentinstallationstatusuri)
|
||||
- [MdmAgentInstalled](#mdmagentinstalled)
|
||||
- [MDMProvider](#mdmprovider)
|
||||
- [Progress](#mdmproviderprogress)
|
||||
- [PageEnabled](#pageenabled)
|
||||
@ -194,6 +195,46 @@ This node holds a URI that can be queried for the status of the Bootstrapper Age
|
||||
|
||||
<!-- Device-BootstrapperAgent-InstallationStatusUri-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-Begin -->
|
||||
## MdmAgentInstalled
|
||||
|
||||
<!-- Device-MdmAgentInstalled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- Device-MdmAgentInstalled-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/DevicePreparation/MdmAgentInstalled
|
||||
```
|
||||
<!-- Device-MdmAgentInstalled-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This node indicates whether the MDM agent was installed or not. When set to true sets the AUTOPILOT_MDM_AGENT_REGISTERED WNF event.
|
||||
<!-- Device-MdmAgentInstalled-Description-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmAgentInstalled-Editable-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | bool |
|
||||
| Access Type | Get, Replace |
|
||||
| Default Value | false |
|
||||
<!-- Device-MdmAgentInstalled-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmAgentInstalled-Examples-End -->
|
||||
|
||||
<!-- Device-MdmAgentInstalled-End -->
|
||||
|
||||
<!-- Device-MDMProvider-Begin -->
|
||||
## MDMProvider
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -286,6 +286,29 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>MdmAgentInstalled</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>false</DefaultValue>
|
||||
<Description>This node indicates whether the MDM agent was installed or not. When set to true sets the AUTOPILOT_MDM_AGENT_REGISTERED WNF event.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</MgmtTree>
|
||||
```
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the DMClient CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/28/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -16,6 +16,9 @@ ms.topic: reference
|
||||
<!-- DMClient-Begin -->
|
||||
# DMClient CSP
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
|
||||
|
||||
<!-- DMClient-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The DMClient configuration service provider (CSP) has more enterprise-specific mobile device management (MDM) configuration settings. These settings identify the device in the enterprise domain, include security mitigation for certificate renewal, and are used for server-triggered enterprise unenrollment.
|
||||
@ -37,6 +40,10 @@ The following list shows the DMClient configuration service provider nodes:
|
||||
- [Lock](#deviceproviderprovideridconfiglocklock)
|
||||
- [SecureCore](#deviceproviderprovideridconfiglocksecurecore)
|
||||
- [UnlockDuration](#deviceproviderprovideridconfiglockunlockduration)
|
||||
- [ConfigRefresh](#deviceproviderprovideridconfigrefresh)
|
||||
- [Cadence](#deviceproviderprovideridconfigrefreshcadence)
|
||||
- [Enabled](#deviceproviderprovideridconfigrefreshenabled)
|
||||
- [PausePeriod](#deviceproviderprovideridconfigrefreshpauseperiod)
|
||||
- [CustomEnrollmentCompletePage](#deviceproviderprovideridcustomenrollmentcompletepage)
|
||||
- [BodyText](#deviceproviderprovideridcustomenrollmentcompletepagebodytext)
|
||||
- [HyperlinkHref](#deviceproviderprovideridcustomenrollmentcompletepagehyperlinkhref)
|
||||
@ -624,6 +631,176 @@ This node, when it is set, tells the client to set how many minutes the device s
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigLock-UnlockDuration-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Begin -->
|
||||
#### Device/Provider/{ProviderID}/ConfigRefresh
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Applicability-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/DMClient/Provider/{ProviderID}/ConfigRefresh
|
||||
```
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-OmaUri-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Parent node for ConfigRefresh nodes.
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Description-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Editable-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | node |
|
||||
| Access Type | Add, Delete, Get |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-DFProperties-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Examples-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Begin -->
|
||||
##### Device/Provider/{ProviderID}/ConfigRefresh/Cadence
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Applicability-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/DMClient/Provider/{ProviderID}/ConfigRefresh/Cadence
|
||||
```
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-OmaUri-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This node determines the number of minutes between refreshes.
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Description-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Editable-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[30-1440]` |
|
||||
| Default Value | 90 |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-DFProperties-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-Examples-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Cadence-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Begin -->
|
||||
##### Device/Provider/{ProviderID}/ConfigRefresh/Enabled
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Applicability-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/DMClient/Provider/{ProviderID}/ConfigRefresh/Enabled
|
||||
```
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-OmaUri-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This node determines whether or not a periodic settings refresh for MDM policies will occur.
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Description-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Editable-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | bool |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | false |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-DFProperties-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| true | ConfigRefresh is enabled. |
|
||||
| false (Default) | ConfigRefresh is disabled. |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-AllowedValues-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-Examples-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-Enabled-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Begin -->
|
||||
##### Device/Provider/{ProviderID}/ConfigRefresh/PausePeriod
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Applicability-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/DMClient/Provider/{ProviderID}/ConfigRefresh/PausePeriod
|
||||
```
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-OmaUri-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This node determines the number of minutes ConfigRefresh should be paused for.
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Description-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Editable-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[0-1440]` |
|
||||
| Default Value | 0 |
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-DFProperties-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-Examples-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-ConfigRefresh-PausePeriod-End -->
|
||||
|
||||
<!-- Device-Provider-{ProviderID}-CustomEnrollmentCompletePage-Begin -->
|
||||
#### Device/Provider/{ProviderID}/CustomEnrollmentCompletePage
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/24/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -2947,6 +2947,125 @@ The following XML file contains the device description framework (DDF) for the D
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ConfigRefresh</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Parent node for ConfigRefresh nodes</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.6</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>Enabled</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>false</DefaultValue>
|
||||
<Description>This node determines whether or not a periodic settings refresh for MDM policies will occur.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>ConfigRefresh is enabled.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>false</MSFT:Value>
|
||||
<MSFT:ValueDescription>ConfigRefresh is disabled.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
<MSFT:ConflictResolution>LastWrite</MSFT:ConflictResolution>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Cadence</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>90</DefaultValue>
|
||||
<Description>This node determines the number of minutes between refreshes.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="Range">
|
||||
<MSFT:Value>[30-1440]</MSFT:Value>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>PausePeriod</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>This node determines the number of minutes ConfigRefresh should be paused for.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="Range">
|
||||
<MSFT:Value>[0-1440]</MSFT:Value>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the EnterpriseModernAppManagement CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/28/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -17,6 +17,7 @@ ms.topic: reference
|
||||
# EnterpriseModernAppManagement CSP
|
||||
|
||||
<!-- EnterpriseModernAppManagement-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. For details about how to use this CSP to for reporting apps inventory, installation and removal of apps for users, provisioning apps to devices, and managing app licenses, see [Enterprise app management](../enterprise-app-management.md).
|
||||
|
||||
> [!NOTE]
|
||||
@ -273,6 +274,7 @@ Used to perform app installation.
|
||||
<!-- Device-AppInstallation-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppInstallation-Editable-End -->
|
||||
|
||||
@ -312,6 +314,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is an optional node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -329,6 +332,7 @@ This is an optional node.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example for uninstalling an app:
|
||||
@ -374,6 +378,7 @@ Command to perform an install of an app package from a hosted location (this can
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-HostedInstall-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-HostedInstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. The following list shows the supported deployment options:
|
||||
|
||||
- ForceApplicationShutdown
|
||||
@ -424,6 +429,7 @@ Last error relating to the app installation.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-LastError-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-LastError-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-LastError-Editable-End -->
|
||||
@ -464,6 +470,7 @@ Description of last error relating to the app installation.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-LastErrorDesc-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-LastErrorDesc-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-LastErrorDesc-Editable-End -->
|
||||
@ -504,6 +511,7 @@ An integer the indicates the progress of the app installation. For https locatio
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-ProgressStatus-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-ProgressStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-ProgressStatus-Editable-End -->
|
||||
@ -544,6 +552,7 @@ Status of app installation. The following values are returned: NOT_INSTALLED (0)
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-Status-Description-End -->
|
||||
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-Status-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- Device-AppInstallation-{PackageFamilyName}-Status-Editable-End -->
|
||||
@ -662,6 +671,7 @@ Used to manage licenses for store apps.
|
||||
<!-- Device-AppLicenses-StoreLicenses-Description-End -->
|
||||
|
||||
<!-- Device-AppLicenses-StoreLicenses-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppLicenses-StoreLicenses-Editable-End -->
|
||||
|
||||
@ -701,6 +711,7 @@ License ID for a store installed app. The license ID is generally the PFN of the
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-Description-End -->
|
||||
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is an optional node.
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-Editable-End -->
|
||||
|
||||
@ -741,6 +752,7 @@ Command to add license.
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-AddLicense-Description-End -->
|
||||
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-AddLicense-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-AddLicense-Editable-End -->
|
||||
|
||||
@ -780,6 +792,7 @@ Command to get license from the store.
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-GetLicenseFromStore-Description-End -->
|
||||
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-GetLicenseFromStore-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppLicenses-StoreLicenses-{LicenseID}-GetLicenseFromStore-Editable-End -->
|
||||
|
||||
@ -936,6 +949,7 @@ Used for inventory and app management (post-install).
|
||||
<!-- Device-AppManagement-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-Editable-End -->
|
||||
|
||||
@ -975,6 +989,7 @@ Specifies the query for app inventory.
|
||||
<!-- Device-AppManagement-AppInventoryQuery-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppInventoryQuery-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Query parameters:
|
||||
|
||||
- Output - Specifies the parameters for the information returned in AppInventoryResults operation. Multiple value must be separate by |. Valid values are:
|
||||
@ -1016,6 +1031,7 @@ This is a required node. Query parameters:
|
||||
<!-- Device-AppManagement-AppInventoryQuery-DFProperties-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppInventoryQuery-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
The following example sets the inventory query for the package names and checks the status for reinstallation for all main packages that are nonStore apps.
|
||||
@ -1057,6 +1073,7 @@ Returns the results for app inventory that was created after the AppInventoryQue
|
||||
<!-- Device-AppManagement-AppInventoryResults-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppInventoryResults-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-AppInventoryResults-Editable-End -->
|
||||
|
||||
@ -1070,6 +1087,7 @@ This is a required node.
|
||||
<!-- Device-AppManagement-AppInventoryResults-DFProperties-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppInventoryResults-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example of AppInventoryResults operation.
|
||||
@ -1108,6 +1126,7 @@ Here's an example of AppInventoryResults operation.
|
||||
<!-- Device-AppManagement-AppStore-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Used for managing apps from the Microsoft Store.
|
||||
<!-- Device-AppManagement-AppStore-Editable-End -->
|
||||
|
||||
@ -1147,6 +1166,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-Editable-End -->
|
||||
@ -1162,6 +1182,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example for uninstalling an app:
|
||||
@ -1247,6 +1268,7 @@ Architecture of installed package. Value type is string.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Architecture-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-End -->
|
||||
@ -1287,6 +1309,7 @@ Date the app was installed. Value type is string.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-End -->
|
||||
|
||||
@ -1326,6 +1349,7 @@ Install location of the app on the device. Value type is string.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-End -->
|
||||
@ -1405,6 +1429,7 @@ Whether or not the app is a framework package. Value type is int. The value is 1
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-End -->
|
||||
@ -1484,6 +1509,7 @@ This node is used to identify whether the package is a stub package. A stub pack
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsStub-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The value is 1 if the package is a stub package and 0 (zero) for all other cases.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-End -->
|
||||
|
||||
@ -1562,6 +1588,7 @@ Provides information about the status of the package. Value type is int. Valid v
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-End -->
|
||||
@ -1641,6 +1668,7 @@ Specifies whether the package state has changed and requires a reinstallation of
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -1683,6 +1711,7 @@ Resource ID of the app. This is null for the main app, ~ for a bundle, and conta
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-End -->
|
||||
@ -1723,6 +1752,7 @@ Registered users of the app and the package install state. If the query is at th
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Users-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Users-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Possible values:
|
||||
|
||||
- 0 = Not Installed
|
||||
@ -1806,6 +1836,7 @@ Specifies whether you want to block a specific app from being updated via auto-u
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-DoNotUpdate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-DoNotUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-DoNotUpdate-Editable-End -->
|
||||
|
||||
@ -1854,6 +1885,7 @@ Specify whether on a AMD64 device, across an app update, the architecture of the
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins).
|
||||
|
||||
| Applicability Setting | CSP state | Result |
|
||||
@ -1909,6 +1941,7 @@ This setting allows the IT admin to set an app to be nonremovable, or unable to
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-NonRemovable-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-NonRemovable-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
NonRemovable requires admin permission. This setting can only be defined per device, not per user. You can query the setting using AppInventoryQuery or AppInventoryResults.
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-NonRemovable-Editable-End -->
|
||||
|
||||
@ -1931,6 +1964,7 @@ NonRemovable requires admin permission. This setting can only be defined per dev
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-NonRemovable-AllowedValues-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-{PackageFamilyName}-NonRemovable-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Examples**:
|
||||
|
||||
- Add an app to the nonremovable app policy list
|
||||
@ -2019,6 +2053,7 @@ Interior node for the managing updates through the Microsoft Store. These settin
|
||||
<!-- Device-AppManagement-AppStore-ReleaseManagement-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-AppStore-ReleaseManagement-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> ReleaseManagement settings only apply to updates through the Microsoft Store.
|
||||
<!-- Device-AppManagement-AppStore-ReleaseManagement-Editable-End -->
|
||||
@ -2294,6 +2329,7 @@ Reports the last error code returned by the update scan.
|
||||
<!-- Device-AppManagement-LastScanError-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-LastScanError-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-LastScanError-Editable-End -->
|
||||
|
||||
@ -2332,6 +2368,7 @@ This is a required node.
|
||||
<!-- Device-AppManagement-nonStore-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Used to manage enterprise apps or developer apps that weren't acquired from the Microsoft Store.
|
||||
<!-- Device-AppManagement-nonStore-Editable-End -->
|
||||
|
||||
@ -2371,6 +2408,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-Editable-End -->
|
||||
@ -2386,6 +2424,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example for uninstalling an app:
|
||||
@ -2471,6 +2510,7 @@ Architecture of installed package. Value type is string.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Architecture-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-End -->
|
||||
@ -2511,6 +2551,7 @@ Date the app was installed. Value type is string.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-End -->
|
||||
|
||||
@ -2550,6 +2591,7 @@ Install location of the app on the device. Value type is string.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-End -->
|
||||
@ -2629,6 +2671,7 @@ Whether or not the app is a framework package. Value type is int. The value is 1
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-End -->
|
||||
@ -2708,6 +2751,7 @@ This node is used to identify whether the package is a stub package. A stub pack
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsStub-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The value is 1 if the package is a stub package and 0 (zero) for all other cases.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-End -->
|
||||
|
||||
@ -2786,6 +2830,7 @@ Provides information about the status of the package. Value type is int. Valid v
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-End -->
|
||||
@ -2865,6 +2910,7 @@ Specifies whether the package state has changed and requires a reinstallation of
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -2907,6 +2953,7 @@ Resource ID of the app. This is null for the main app, ~ for a bundle, and conta
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-End -->
|
||||
@ -2947,6 +2994,7 @@ Registered users of the app and the package install state. If the query is at th
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Users-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Users-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Possible values:
|
||||
|
||||
- 0 = Not Installed
|
||||
@ -3030,6 +3078,7 @@ Specifies whether you want to block a specific app from being updated via auto-u
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-DoNotUpdate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-DoNotUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-DoNotUpdate-Editable-End -->
|
||||
|
||||
@ -3078,6 +3127,7 @@ Specify whether on a AMD64 device, across an app update, the architecture of the
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins).
|
||||
|
||||
| Applicability Setting | CSP state | Result |
|
||||
@ -3133,6 +3183,7 @@ This setting allows the IT admin to set an app to be nonremovable, or unable to
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-NonRemovable-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-NonRemovable-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
NonRemovable requires admin permission. This setting can only be defined per device, not per user. You can query the setting using AppInventoryQuery or AppInventoryResults.
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-NonRemovable-Editable-End -->
|
||||
|
||||
@ -3155,6 +3206,7 @@ NonRemovable requires admin permission. This setting can only be defined per dev
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-NonRemovable-AllowedValues-End -->
|
||||
|
||||
<!-- Device-AppManagement-nonStore-{PackageFamilyName}-NonRemovable-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Examples**:
|
||||
|
||||
- Add an app to the nonremovable app policy list
|
||||
@ -3555,6 +3607,7 @@ Used to restore the Windows app to its initial configuration.
|
||||
<!-- Device-AppManagement-System-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Reports apps installed as part of the operating system.
|
||||
<!-- Device-AppManagement-System-Editable-End -->
|
||||
|
||||
@ -3594,6 +3647,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-Editable-End -->
|
||||
@ -3675,6 +3729,7 @@ Architecture of installed package. Value type is string.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Architecture-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-End -->
|
||||
@ -3715,6 +3770,7 @@ Date the app was installed. Value type is string.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallDate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-End -->
|
||||
|
||||
@ -3754,6 +3810,7 @@ Install location of the app on the device. Value type is string.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallLocation-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-End -->
|
||||
@ -3833,6 +3890,7 @@ Whether or not the app is a framework package. Value type is int. The value is 1
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsFramework-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-End -->
|
||||
@ -3912,6 +3970,7 @@ This node is used to identify whether the package is a stub package. A stub pack
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsStub-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The value is 1 if the package is a stub package and 0 (zero) for all other cases.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-End -->
|
||||
|
||||
@ -3990,6 +4049,7 @@ Provides information about the status of the package. Value type is int. Valid v
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-PackageStatus-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-End -->
|
||||
@ -4069,6 +4129,7 @@ Specifies whether the package state has changed and requires a reinstallation of
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -4111,6 +4172,7 @@ Resource ID of the app. This is null for the main app, ~ for a bundle, and conta
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-ResourceID-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-End -->
|
||||
@ -4151,6 +4213,7 @@ Registered users of the app and the package install state. If the query is at th
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Users-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Users-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
- 0 = Not Installed
|
||||
@ -4766,6 +4829,7 @@ Specifies whether you want to block a specific app from being updated via auto-u
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-DoNotUpdate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-DoNotUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-DoNotUpdate-Editable-End -->
|
||||
|
||||
@ -4814,6 +4878,7 @@ Specify whether on a AMD64 device, across an app update, the architecture of the
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins).
|
||||
|
||||
| Applicability Setting | CSP state | Result |
|
||||
@ -4869,6 +4934,7 @@ This setting allows the IT admin to set an app to be nonremovable, or unable to
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-NonRemovable-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-NonRemovable-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
NonRemovable requires admin permission. This setting can only be defined per device, not per user. You can query the setting using AppInventoryQuery or AppInventoryResults.
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-NonRemovable-Editable-End -->
|
||||
|
||||
@ -4891,6 +4957,7 @@ NonRemovable requires admin permission. This setting can only be defined per dev
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-NonRemovable-AllowedValues-End -->
|
||||
|
||||
<!-- Device-AppManagement-System-{PackageFamilyName}-NonRemovable-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Examples**:
|
||||
|
||||
- Add an app to the nonremovable app policy list
|
||||
@ -5253,6 +5320,7 @@ Used to start the Windows Update scan.
|
||||
<!-- Device-AppManagement-UpdateScan-Description-End -->
|
||||
|
||||
<!-- Device-AppManagement-UpdateScan-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- Device-AppManagement-UpdateScan-Editable-End -->
|
||||
|
||||
@ -5331,6 +5399,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Editable-End -->
|
||||
@ -5346,6 +5415,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example for uninstalling an app:
|
||||
@ -5391,6 +5461,7 @@ Command to perform an install of an app package from a hosted location (this can
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-HostedInstall-Description-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-HostedInstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. The following list shows the supported deployment options:
|
||||
|
||||
- ForceApplicationShutdown
|
||||
@ -5441,6 +5512,7 @@ Last error relating to the app installation.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-LastError-Description-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-LastError-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-LastError-Editable-End -->
|
||||
@ -5481,6 +5553,7 @@ Description of last error relating to the app installation.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-LastErrorDesc-Description-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-LastErrorDesc-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-LastErrorDesc-Editable-End -->
|
||||
@ -5521,6 +5594,7 @@ An integer the indicates the progress of the app installation. For https locatio
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-ProgressStatus-Description-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-ProgressStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-ProgressStatus-Editable-End -->
|
||||
@ -5561,6 +5635,7 @@ Status of app installation. The following values are returned: NOT_INSTALLED (0)
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Status-Description-End -->
|
||||
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Status-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This element isn't present after the app is installed.
|
||||
<!-- User-AppInstallation-{PackageFamilyName}-Status-Editable-End -->
|
||||
@ -5718,6 +5793,7 @@ License ID for a store installed app. The license ID is generally the PFN of the
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-Description-End -->
|
||||
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is an optional node.
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-Editable-End -->
|
||||
|
||||
@ -5758,6 +5834,7 @@ Command to add license.
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-AddLicense-Description-End -->
|
||||
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-AddLicense-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-AddLicense-Editable-End -->
|
||||
|
||||
@ -5797,6 +5874,7 @@ Command to get license from the store.
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-GetLicenseFromStore-Description-End -->
|
||||
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-GetLicenseFromStore-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppLicenses-StoreLicenses-{LicenseID}-GetLicenseFromStore-Editable-End -->
|
||||
|
||||
@ -5992,6 +6070,7 @@ Specifies the query for app inventory.
|
||||
<!-- User-AppManagement-AppInventoryQuery-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppInventoryQuery-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Query parameters:
|
||||
|
||||
- Output - Specifies the parameters for the information returned in AppInventoryResults operation. Multiple value must be separate by |. Valid values are:
|
||||
@ -6031,6 +6110,7 @@ This is a required node. Query parameters:
|
||||
<!-- User-AppManagement-AppInventoryQuery-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-AppInventoryQuery-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
The following example sets the inventory query for the package names and checks the status for reinstallation for all main packages that are nonStore apps.
|
||||
@ -6072,6 +6152,7 @@ Returns the results for app inventory that was created after the AppInventoryQue
|
||||
<!-- User-AppManagement-AppInventoryResults-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppInventoryResults-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-AppInventoryResults-Editable-End -->
|
||||
|
||||
@ -6085,6 +6166,7 @@ This is a required node.
|
||||
<!-- User-AppManagement-AppInventoryResults-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-AppInventoryResults-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example of AppInventoryResults operation.
|
||||
@ -6123,6 +6205,7 @@ Here's an example of AppInventoryResults operation.
|
||||
<!-- User-AppManagement-AppStore-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Used for managing apps from the Microsoft Store.
|
||||
<!-- User-AppManagement-AppStore-Editable-End -->
|
||||
|
||||
@ -6162,6 +6245,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-Editable-End -->
|
||||
@ -6177,6 +6261,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
Here's an example for uninstalling an app:
|
||||
@ -6262,6 +6347,7 @@ Architecture of installed package. Value type is string.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Architecture-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-End -->
|
||||
@ -6302,6 +6388,7 @@ Date the app was installed. Value type is string.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-End -->
|
||||
|
||||
@ -6341,6 +6428,7 @@ Install location of the app on the device. Value type is string.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-End -->
|
||||
@ -6420,6 +6508,7 @@ Whether or not the app is a framework package. Value type is int. The value is 1
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-End -->
|
||||
@ -6499,6 +6588,7 @@ This node is used to identify whether the package is a stub package. A stub pack
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsStub-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The value is 1 if the package is a stub package and 0 (zero) for all other cases.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-End -->
|
||||
|
||||
@ -6577,6 +6667,7 @@ Provides information about the status of the package. Value type is int. Valid v
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-End -->
|
||||
@ -6656,6 +6747,7 @@ Specifies whether the package state has changed and requires a reinstallation of
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -6698,6 +6790,7 @@ Resource ID of the app. This is null for the main app, ~ for a bundle, and conta
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-End -->
|
||||
@ -6738,6 +6831,7 @@ Registered users of the app and the package install state. If the query is at th
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Users-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-{PackageFullName}-Users-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node. Possible values:
|
||||
|
||||
- 0 = Not Installed
|
||||
@ -6821,6 +6915,7 @@ Interior node for all managed app setting values.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> This node is only supported in the user context.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-Editable-End -->
|
||||
@ -6861,6 +6956,7 @@ The SettingValue and data represent a key value pair to be configured for the ap
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This setting only works for apps that support the feature and it's only supported in the user context.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Editable-End -->
|
||||
|
||||
@ -6875,6 +6971,7 @@ This setting only works for apps that support the feature and it's only supporte
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Examples**:
|
||||
|
||||
- The following example sets the value for the 'Server'
|
||||
@ -6933,6 +7030,7 @@ Specifies whether you want to block a specific app from being updated via auto-u
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-DoNotUpdate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-DoNotUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-DoNotUpdate-Editable-End -->
|
||||
|
||||
@ -6981,6 +7079,7 @@ Specify whether on a AMD64 device, across an app update, the architecture of the
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins).
|
||||
|
||||
|Applicability Setting |CSP state |Result |
|
||||
@ -7036,6 +7135,7 @@ Interior node for the managing updates through the Microsoft Store. These settin
|
||||
<!-- User-AppManagement-AppStore-ReleaseManagement-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-AppStore-ReleaseManagement-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> ReleaseManagement settings only apply to updates through the Microsoft Store.
|
||||
<!-- User-AppManagement-AppStore-ReleaseManagement-Editable-End -->
|
||||
@ -7311,6 +7411,7 @@ Reports the last error code returned by the update scan.
|
||||
<!-- User-AppManagement-LastScanError-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-LastScanError-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-LastScanError-Editable-End -->
|
||||
|
||||
@ -7349,6 +7450,7 @@ This is a required node.
|
||||
<!-- User-AppManagement-nonStore-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Used to manage enterprise apps or developer apps that weren't acquired from the Microsoft Store.
|
||||
<!-- User-AppManagement-nonStore-Editable-End -->
|
||||
|
||||
@ -7388,6 +7490,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-Editable-End -->
|
||||
@ -7403,6 +7506,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
```xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
@ -7484,6 +7588,7 @@ Architecture of installed package. Value type is string.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Architecture-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-End -->
|
||||
@ -7524,6 +7629,7 @@ Date the app was installed. Value type is string.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-End -->
|
||||
|
||||
@ -7563,6 +7669,7 @@ Install location of the app on the device. Value type is string.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-End -->
|
||||
@ -7642,6 +7749,7 @@ Whether or not the app is a framework package. Value type is int. The value is 1
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-End -->
|
||||
@ -7721,6 +7829,7 @@ This node is used to identify whether the package is a stub package. A stub pack
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsStub-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The value is 1 if the package is a stub package and 0 (zero) for all other cases.
|
||||
|
||||
Value type is int.
|
||||
@ -7801,6 +7910,7 @@ Provides information about the status of the package. Value type is int. Valid v
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-End -->
|
||||
@ -7880,6 +7990,7 @@ Specifies whether the package state has changed and requires a reinstallation of
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -7922,6 +8033,7 @@ Resource ID of the app. This is null for the main app, ~ for a bundle, and conta
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-End -->
|
||||
@ -7962,6 +8074,7 @@ Registered users of the app and the package install state. If the query is at th
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Users-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-{PackageFullName}-Users-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Requried.
|
||||
|
||||
- Not Installed = 0
|
||||
@ -8045,6 +8158,7 @@ Interior node for all managed app setting values.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This node is only supported in the user context.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-Editable-End -->
|
||||
|
||||
@ -8084,6 +8198,7 @@ The SettingValue and data represent a key value pair to be configured for the ap
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This setting only works for apps that support the feature and it's only supported in the user context.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Editable-End -->
|
||||
|
||||
@ -8098,6 +8213,7 @@ This setting only works for apps that support the feature and it's only supporte
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
The following example sets the value for the 'Server'
|
||||
|
||||
```xml
|
||||
@ -8154,6 +8270,7 @@ Specifies whether you want to block a specific app from being updated via auto-u
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-DoNotUpdate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-DoNotUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-DoNotUpdate-Editable-End -->
|
||||
|
||||
@ -8202,6 +8319,7 @@ Specify whether on a AMD64 device, across an app update, the architecture of the
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-nonStore-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins).
|
||||
|
||||
| Applicability Setting | CSP state | Result |
|
||||
@ -8531,6 +8649,7 @@ Used to remove packages.
|
||||
<!-- User-AppManagement-RemovePackage-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-RemovePackage-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Parameters:
|
||||
|
||||
- Package
|
||||
@ -8551,6 +8670,7 @@ Parameters:
|
||||
<!-- User-AppManagement-RemovePackage-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-RemovePackage-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
The following example removes a package for all users:
|
||||
@ -8632,6 +8752,7 @@ Used to restore the Windows app to its initial configuration.
|
||||
<!-- User-AppManagement-System-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Reports apps installed as part of the operating system.
|
||||
<!-- User-AppManagement-System-Editable-End -->
|
||||
|
||||
@ -8671,6 +8792,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-Editable-End -->
|
||||
@ -8686,6 +8808,7 @@ Package family name (PFN) of the app. There is one for each PFN on the device wh
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Example**:
|
||||
|
||||
```xml
|
||||
@ -8769,6 +8892,7 @@ Architecture of installed package. Value type is string.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Architecture-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Architecture-Editable-End -->
|
||||
@ -8809,6 +8933,7 @@ Date the app was installed. Value type is string.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallDate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallDate-Editable-End -->
|
||||
|
||||
@ -8848,6 +8973,7 @@ Install location of the app on the device. Value type is string.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallLocation-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-InstallLocation-Editable-End -->
|
||||
@ -8927,6 +9053,7 @@ Whether or not the app is a framework package. Value type is int. The value is 1
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsFramework-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsFramework-Editable-End -->
|
||||
@ -9006,6 +9133,7 @@ This node is used to identify whether the package is a stub package. A stub pack
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsStub-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The value is 1 if the package is a stub package and 0 (zero) for all other cases.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-IsStub-Editable-End -->
|
||||
|
||||
@ -9084,6 +9212,7 @@ Provides information about the status of the package. Value type is int. Valid v
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-PackageStatus-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-PackageStatus-Editable-End -->
|
||||
@ -9163,6 +9292,7 @@ Specifies whether the package state has changed and requires a reinstallation of
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-RequiresReinstall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
> [!NOTE]
|
||||
@ -9205,6 +9335,7 @@ Resource ID of the app. This is null for the main app, ~ for a bundle, and conta
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-ResourceID-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
> [!NOTE]
|
||||
> Not applicable to XAP files.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-ResourceID-Editable-End -->
|
||||
@ -9245,6 +9376,7 @@ Registered users of the app and the package install state. If the query is at th
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Users-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-{PackageFullName}-Users-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
|
||||
- 0 = Not Installed
|
||||
@ -9328,6 +9460,7 @@ Interior node for all managed app setting values.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This node is only supported in the user context.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-Editable-End -->
|
||||
|
||||
@ -9367,6 +9500,7 @@ The SettingValue and data represent a key value pair to be configured for the ap
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This setting only works for apps that support the feature and it's only supported in the user context.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Editable-End -->
|
||||
|
||||
@ -9381,6 +9515,7 @@ This setting only works for apps that support the feature and it's only supporte
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-DFProperties-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-AppSettingPolicy-{SettingValue}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
**Examples**:
|
||||
|
||||
- The following example sets the value for the 'Server'
|
||||
@ -9439,6 +9574,7 @@ Specifies whether you want to block a specific app from being updated via auto-u
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-DoNotUpdate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-DoNotUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-DoNotUpdate-Editable-End -->
|
||||
|
||||
@ -9487,6 +9623,7 @@ Specify whether on a AMD64 device, across an app update, the architecture of the
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-System-{PackageFamilyName}-MaintainProcessorArchitectureOnUpdate-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins).
|
||||
|
||||
| Applicability Setting | CSP state | Result |
|
||||
@ -9816,6 +9953,7 @@ Used to start the Windows Update scan.
|
||||
<!-- User-AppManagement-UpdateScan-Description-End -->
|
||||
|
||||
<!-- User-AppManagement-UpdateScan-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
This is a required node.
|
||||
<!-- User-AppManagement-UpdateScan-Editable-End -->
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Firewall CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -16,9 +16,6 @@ ms.topic: reference
|
||||
<!-- Firewall-Begin -->
|
||||
# Firewall CSP
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
|
||||
|
||||
<!-- Firewall-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings, per profile settings, and the desired set of custom rules to be enforced on the device. Using the Firewall CSP the IT admin can now manage non-domain devices, and reduce the risk of network security threats across all systems connecting to the corporate network.
|
||||
@ -99,11 +96,11 @@ The following list shows the Firewall configuration service provider nodes:
|
||||
- [HyperVFirewallRules](#mdmstorehypervfirewallrules)
|
||||
- [{FirewallRuleName}](#mdmstorehypervfirewallrulesfirewallrulename)
|
||||
- [Action](#mdmstorehypervfirewallrulesfirewallrulenameaction)
|
||||
- [Type](#mdmstorehypervfirewallrulesfirewallrulenameactiontype)
|
||||
- [Direction](#mdmstorehypervfirewallrulesfirewallrulenamedirection)
|
||||
- [Enabled](#mdmstorehypervfirewallrulesfirewallrulenameenabled)
|
||||
- [LocalAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocaladdressranges)
|
||||
- [LocalPortRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocalportranges)
|
||||
- [Name](#mdmstorehypervfirewallrulesfirewallrulenamename)
|
||||
- [Priority](#mdmstorehypervfirewallrulesfirewallrulenamepriority)
|
||||
- [Profiles](#mdmstorehypervfirewallrulesfirewallrulenameprofiles)
|
||||
- [Protocol](#mdmstorehypervfirewallrulesfirewallrulenameprotocol)
|
||||
@ -111,12 +108,6 @@ The following list shows the Firewall configuration service provider nodes:
|
||||
- [RemotePortRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteportranges)
|
||||
- [Status](#mdmstorehypervfirewallrulesfirewallrulenamestatus)
|
||||
- [VMCreatorId](#mdmstorehypervfirewallrulesfirewallrulenamevmcreatorid)
|
||||
- [HyperVLoopbackRules](#mdmstorehypervloopbackrules)
|
||||
- [{RuleName}](#mdmstorehypervloopbackrulesrulename)
|
||||
- [DestinationVMCreatorId](#mdmstorehypervloopbackrulesrulenamedestinationvmcreatorid)
|
||||
- [Enabled](#mdmstorehypervloopbackrulesrulenameenabled)
|
||||
- [PortRanges](#mdmstorehypervloopbackrulesrulenameportranges)
|
||||
- [SourceVMCreatorId](#mdmstorehypervloopbackrulesrulenamesourcevmcreatorid)
|
||||
- [HyperVVMSettings](#mdmstorehypervvmsettings)
|
||||
- [{VMCreatorId}](#mdmstorehypervvmsettingsvmcreatorid)
|
||||
- [AllowHostPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge)
|
||||
@ -1791,7 +1782,7 @@ Specifies the description of the rule.
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-Direction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Comma separated list. The rule is enabled based on the traffic direction as following.
|
||||
The rule is enabled based on the traffic direction as following.
|
||||
|
||||
IN - the rule applies to inbound traffic.
|
||||
OUT - the rule applies to outbound traffic.
|
||||
@ -1935,7 +1926,7 @@ If not specified - a new rule is disabled by default.
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-IcmpTypesAndCodes-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 21H1 [10.0.19043] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-IcmpTypesAndCodes-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-IcmpTypesAndCodes-OmaUri-Begin -->
|
||||
@ -2087,6 +2078,7 @@ An IPv6 address range in the format of "start address - end address" with no spa
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-LocalPortRanges-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.
|
||||
When setting this field in a firewall rule, the protocol field must also be set, to either 6 (TCP) or 17 (UDP).
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-LocalPortRanges-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-LocalPortRanges-Editable-Begin -->
|
||||
@ -2166,7 +2158,8 @@ This is a string in Security Descriptor Definition Language (SDDL) format..
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-Name-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-Name-Description-Begin -->
|
||||
<!-- Description-Source-Not-Found -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Specifies the friendly name of the firewall rule.
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-Name-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-Name-Editable-Begin -->
|
||||
@ -2194,7 +2187,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-PolicyAppId-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 22H2 [10.0.19045.2913] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.1880] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621.1635] and later |
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-PolicyAppId-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-PolicyAppId-OmaUri-Begin -->
|
||||
@ -2205,7 +2198,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-PolicyAppId-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Specifies one WDAC tag. This is a string that can contain any alphanumeric character and any of the characters ":", "/", ".", and "_".
|
||||
Specifies one WDAC tag. This is a string that can contain any alphanumeric character and any of the characters ":", "/", ".", and "_". A PolicyAppId and ServiceName cannot be specified in the same rule.
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-PolicyAppId-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-PolicyAppId-Editable-Begin -->
|
||||
@ -2431,6 +2424,7 @@ An IPv6 address range in the format of "start address - end address" with no spa
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemotePortRanges-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.
|
||||
When setting this field in a firewall rule, the protocol field must also be set, to either 6 (TCP) or 17 (UDP).
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemotePortRanges-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemotePortRanges-Editable-Begin -->
|
||||
@ -3122,7 +3116,9 @@ Unique alpha numeric identifier for the rule. The rule name must not include a f
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Specifies the action for the rule.
|
||||
Specifies the action the rule enforces:
|
||||
0 - Block
|
||||
1 - Allow.
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Editable-Begin -->
|
||||
@ -3132,68 +3128,27 @@ Specifies the action for the rule.
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | node |
|
||||
| Access Type | Get |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Begin -->
|
||||
###### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Action/Type
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Action/Type
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Specifies the action the rule enforces:
|
||||
0 - Block
|
||||
1 - Allow.
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Get, Replace |
|
||||
| Default Value | 1 |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-DFProperties-End -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-AllowedValues-Begin -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | Block. |
|
||||
| 1 (Default) | Allow. |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-AllowedValues-End -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-AllowedValues-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Examples-Begin -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-Examples-End -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-Type-End -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Action-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Direction-Begin -->
|
||||
##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Direction
|
||||
@ -3212,7 +3167,7 @@ Specifies the action the rule enforces:
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Direction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Comma separated list. The rule is enabled based on the traffic direction as following.
|
||||
The rule is enabled based on the traffic direction as following.
|
||||
|
||||
IN - the rule applies to inbound traffic.
|
||||
OUT - the rule applies to outbound traffic.
|
||||
@ -3385,6 +3340,45 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-LocalPortRanges-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Begin -->
|
||||
##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Specifies the friendly name of the Hyper-V Firewall rule.
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-Begin -->
|
||||
##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Priority
|
||||
|
||||
@ -3402,7 +3396,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
0-255 number representing the IANA Internet Protocol (TCP = 6, UDP = 17). If not specified the default is All.
|
||||
This value represents the order of rule enforcement. A lower priority rule is evaluated first. If not specified, block rules are evaluated before allow rules. If priority is configured, it is highly recommended to configure the value for ALL rules to ensure expected evaluation of rules.
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-Editable-Begin -->
|
||||
@ -3416,7 +3410,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[0-255]` |
|
||||
| Allowed Values | Range: `[0-65535]` |
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-Examples-Begin -->
|
||||
@ -3679,255 +3673,6 @@ This field specifies the VM Creator ID that this rule is applicable to. A NULL G
|
||||
|
||||
<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-VMCreatorId-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Begin -->
|
||||
### MdmStore/HyperVLoopbackRules
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules.
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | node |
|
||||
| Access Type | Get |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Begin -->
|
||||
#### MdmStore/HyperVLoopbackRules/{RuleName}
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | node |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Atomic Required | True |
|
||||
| Dynamic Node Naming | ServerGeneratedUniqueIdentifier |
|
||||
| Allowed Values | Regular Expression: `^[^|/]*$` |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Begin -->
|
||||
##### MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All.
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Begin -->
|
||||
##### MdmStore/HyperVLoopbackRules/{RuleName}/Enabled
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/Enabled
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default.
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | bool |
|
||||
| Access Type | Get, Replace |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | Disabled. |
|
||||
| 1 | Enabled. |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-AllowedValues-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Begin -->
|
||||
##### MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Regular Expression: `^[0-9,-]+$` |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Begin -->
|
||||
##### MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Applicability-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId
|
||||
```
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-OmaUri-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All.
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Editable-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` |
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-DFProperties-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Examples-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-Begin -->
|
||||
### MdmStore/HyperVVMSettings
|
||||
|
||||
@ -4026,7 +3771,7 @@ VM Creator ID that these settings apply to. Valid format is a GUID.
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall.
|
||||
This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V Firewall.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Editable-Begin -->
|
||||
@ -4075,7 +3820,7 @@ This value is used as an on/off switch. If this value is true, applicable host f
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Editable-Begin -->
|
||||
@ -4125,7 +3870,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-Editable-Begin -->
|
||||
@ -4213,7 +3958,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
|
||||
This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Editable-Begin -->
|
||||
@ -4263,7 +4008,7 @@ This value is used as an on/off switch. If this value is false, firewall rules f
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Editable-Begin -->
|
||||
@ -4313,7 +4058,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Editable-Begin -->
|
||||
@ -4363,7 +4108,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is an on/off switch for the firewall and advanced security enforcement.
|
||||
This value is an on/off switch for the Hyper-V Firewall enforcement.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Editable-Begin -->
|
||||
@ -4412,7 +4157,7 @@ This value is an on/off switch for the firewall and advanced security enforcemen
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
|
||||
This value is an on/off switch for the Hyper-V Firewall. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Editable-Begin -->
|
||||
@ -4434,8 +4179,8 @@ This value is an on/off switch for the firewall and advanced security enforcemen
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| false | Disable Firewall. |
|
||||
| true (Default) | Enable Firewall. |
|
||||
| false | Disable Hyper-V Firewall. |
|
||||
| true (Default) | Enable Hyper-V Firewall. |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-AllowedValues-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Examples-Begin -->
|
||||
@ -4548,7 +4293,7 @@ This value is an on/off switch for loopback traffic. This determines if this VM
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
|
||||
This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Editable-Begin -->
|
||||
@ -4598,7 +4343,7 @@ This value is used as an on/off switch. If this value is false, firewall rules f
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Editable-Begin -->
|
||||
@ -4648,7 +4393,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Editable-Begin -->
|
||||
@ -4698,7 +4443,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is an on/off switch for the firewall and advanced security enforcement.
|
||||
This value is an on/off switch for the Hyper-V Firewall enforcement.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Editable-Begin -->
|
||||
@ -4785,7 +4530,7 @@ This value is an on/off switch for the firewall and advanced security enforcemen
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
|
||||
This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Editable-Begin -->
|
||||
@ -4835,7 +4580,7 @@ This value is used as an on/off switch. If this value is false, firewall rules f
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Editable-Begin -->
|
||||
@ -4885,7 +4630,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
|
||||
This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Editable-Begin -->
|
||||
@ -4935,7 +4680,7 @@ This value is the action that the firewall does by default (and evaluates at the
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This value is an on/off switch for the firewall and advanced security enforcement.
|
||||
This value is an on/off switch for the Hyper-V Firewall enforcement.
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Description-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Editable-Begin -->
|
||||
@ -4957,8 +4702,8 @@ This value is an on/off switch for the firewall and advanced security enforcemen
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| false | Disable Firewall. |
|
||||
| true (Default) | Enable Firewall. |
|
||||
| false | Disable Hyper-V Firewall. |
|
||||
| true (Default) | Enable Hyper-V Firewall. |
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-AllowedValues-End -->
|
||||
|
||||
<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Examples-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -2855,7 +2855,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
|
||||
<Description>This value is an on/off switch for the Hyper-V Firewall. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -2871,11 +2871,11 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>false</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Disable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
@ -2888,7 +2888,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -2918,7 +2918,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -2934,7 +2934,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -2964,7 +2964,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3012,7 +3012,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall.</Description>
|
||||
<Description>This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V Firewall.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3063,7 +3063,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
|
||||
<Description>This value is an on/off switch for the Hyper-V Firewall enforcement.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3096,7 +3096,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -3126,7 +3126,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3142,7 +3142,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -3172,7 +3172,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3187,7 +3187,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.</Description>
|
||||
<Description>This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3217,7 +3217,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3252,7 +3252,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
|
||||
<Description>This value is an on/off switch for the Hyper-V Firewall enforcement.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3285,7 +3285,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -3315,7 +3315,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3331,7 +3331,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -3361,7 +3361,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3376,7 +3376,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.</Description>
|
||||
<Description>This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3406,7 +3406,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3441,7 +3441,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
|
||||
<Description>This value is an on/off switch for the Hyper-V Firewall enforcement.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3457,11 +3457,11 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>false</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Disable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
@ -3474,7 +3474,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -3504,7 +3504,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3520,7 +3520,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
|
||||
<Description>This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -3550,7 +3550,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3565,7 +3565,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.</Description>
|
||||
<Description>This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
@ -3595,7 +3595,7 @@ The following XML file contains the device description framework (DDF) for the F
|
||||
<MSFT:DependencyAllowedValue ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>true</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
|
||||
<MSFT:ValueDescription>Enable Hyper-V Firewall</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:DependencyAllowedValue>
|
||||
</MSFT:Dependency>
|
||||
@ -3818,7 +3818,10 @@ ServiceName</Description>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.</Description>
|
||||
<Description>
|
||||
Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.
|
||||
When setting this field in a firewall rule, the protocol field must also be set, to either 6 (TCP) or 17 (UDP).
|
||||
</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -3846,7 +3849,10 @@ ServiceName</Description>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description> Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.</Description>
|
||||
<Description>
|
||||
Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.
|
||||
When setting this field in a firewall rule, the protocol field must also be set, to either 6 (TCP) or 17 (UDP).
|
||||
</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -3878,6 +3884,8 @@ ServiceName</Description>
|
||||
String value. Multiple ICMP type+code pairs can be included in the string by separating each value with a ",". If more than one ICMP type+code pair is specified, the strings must be separated by a comma.
|
||||
To specify all ICMP types and codes, use the "*" character. For specific ICMP types and codes, use the ":" to separate the type and code.
|
||||
The following are valid examples: 3:4 or 1:*. The "*" character can be used to represent any code. The "*" character can't be used to specify any type, examples such as "*:4" or "*:*" are invalid.
|
||||
|
||||
When setting this field in a firewall rule, the protocol field must also be set, to either 1 (ICMP) or 58 (IPv6-ICMP).
|
||||
</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
@ -3892,7 +3900,7 @@ ServiceName</Description>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.19043</MSFT:OsBuildVersion>
|
||||
<MSFT:OsBuildVersion>10.0.20348</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="None">
|
||||
@ -4172,7 +4180,7 @@ If not specified - a new rule is disabled by default.</Description>
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>OUT</DefaultValue>
|
||||
<Description>Comma separated list. The rule is enabled based on the traffic direction as following.
|
||||
<Description>The rule is enabled based on the traffic direction as following.
|
||||
|
||||
IN - the rule applies to inbound traffic.
|
||||
OUT - the rule applies to outbound traffic.
|
||||
@ -4328,7 +4336,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..</Des
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description> Specifies one WDAC tag. This is a string that can contain any alphanumeric character and any of the characters ":", "/", ".", and "_". </Description>
|
||||
<Description> Specifies one WDAC tag. This is a string that can contain any alphanumeric character and any of the characters ":", "/", ".", and "_". A PolicyAppId and ServiceName cannot be specified in the same rule. </Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -4342,7 +4350,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..</Des
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
|
||||
<MSFT:OsBuildVersion>10.0.19045.2913, 10.0.22621.1635, 10.0.22000.1880</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.1</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="RegEx">
|
||||
@ -4380,6 +4388,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..</Des
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Specifies the friendly name of the firewall rule.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -4457,7 +4466,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..</Des
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>0-255 number representing the IANA Internet Protocol (TCP = 6, UDP = 17). If not specified the default is All.</Description>
|
||||
<Description>This value represents the order of rule enforcement. A lower priority rule is evaluated first. If not specified, block rules are evaluated before allow rules. If priority is configured, it is highly recommended to configure the value for ALL rules to ensure expected evaluation of rules.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
@ -4471,7 +4480,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..</Des
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="Range">
|
||||
<MSFT:Value>[0-255]</MSFT:Value>
|
||||
<MSFT:Value>[0-65535]</MSFT:Value>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
@ -4483,7 +4492,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format..</Des
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>OUT</DefaultValue>
|
||||
<Description>Comma separated list. The rule is enabled based on the traffic direction as following.
|
||||
<Description>The rule is enabled based on the traffic direction as following.
|
||||
|
||||
IN - the rule applies to inbound traffic.
|
||||
OUT - the rule applies to outbound traffic.
|
||||
@ -4692,26 +4701,6 @@ An IPv6 address range in the format of "start address - end address" with no spa
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Action</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Specifies the action for the rule.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>Type</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
@ -4745,7 +4734,6 @@ An IPv6 address range in the format of "start address - end address" with no spa
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Enabled</NodeName>
|
||||
<DFProperties>
|
||||
@ -4785,7 +4773,7 @@ If not specified - a new rule is disabled by default.</Description>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Provides information about the specific verrsion of the rule in deployment for monitoring purposes.</Description>
|
||||
<Description>Provides information about the specific version of the rule in deployment for monitoring purposes.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -4840,31 +4828,8 @@ If not specified - a new rule is disabled by default.</Description>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>HyperVLoopbackRules</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>
|
||||
</NodeName>
|
||||
<NodeName>Name</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
@ -4872,43 +4837,12 @@ If not specified - a new rule is disabled by default.</Description>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>RuleName</DFTitle>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
<MSFT:DynamicNodeNaming>
|
||||
<MSFT:ServerGeneratedUniqueIdentifier />
|
||||
</MSFT:DynamicNodeNaming>
|
||||
<MSFT:AllowedValues ValueType="RegEx">
|
||||
<MSFT:Value>^[^|/]*$</MSFT:Value>
|
||||
</MSFT:AllowedValues>
|
||||
<MSFT:AtomicRequired />
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>SourceVMCreatorId</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All.</Description>
|
||||
<Description>Specifies the friendly name of the Hyper-V Firewall rule.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
@ -4916,96 +4850,6 @@ If not specified - a new rule is disabled by default.</Description>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="RegEx">
|
||||
<MSFT:Value>\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}</MSFT:Value>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DestinationVMCreatorId</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="RegEx">
|
||||
<MSFT:Value>\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}</MSFT:Value>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>PortRanges</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="RegEx">
|
||||
<MSFT:Value>^[0-9,-]+$</MSFT:Value>
|
||||
<MSFT:List Delimiter="," />
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Enabled</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disabled</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enabled</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the PassportForWork CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -445,7 +445,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of digits in PIN. |
|
||||
| 1 | Requires the use of at least one digit in PIN. |
|
||||
| 1 | Requires the use of at least one digits in PIN. |
|
||||
| 2 | Does not allow the use of digits in PIN. |
|
||||
<!-- Device-{TenantId}-Policies-PINComplexity-Digits-AllowedValues-End -->
|
||||
|
||||
@ -583,7 +583,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of lowercase letters in PIN. |
|
||||
| 1 | Requires the use of at least one lowercase letter in PIN. |
|
||||
| 1 | Requires the use of at least one lowercase letters in PIN. |
|
||||
| 2 | Does not allow the use of lowercase letters in PIN. |
|
||||
<!-- Device-{TenantId}-Policies-PINComplexity-LowercaseLetters-AllowedValues-End -->
|
||||
|
||||
@ -706,7 +706,7 @@ Minimum PIN length configures the minimum number of characters required for the
|
||||
|
||||
<!-- Device-{TenantId}-Policies-PINComplexity-SpecialCharacters-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Use this policy setting to configure the use of special character in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) * + , - . / : ; `< = >` ? @ [ \ ] ^ _ ` { | } ~ .
|
||||
Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) * + , - . / : ; `< = >` ? @ [ \ ] ^ _ ` { | } ~ .
|
||||
|
||||
A value of 1 corresponds to "Required." If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN.
|
||||
|
||||
@ -791,7 +791,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of uppercase letters in PIN. |
|
||||
| 1 | Requires the use of at least one uppercase letter in PIN. |
|
||||
| 1 | Requires the use of at least one uppercase letters in PIN. |
|
||||
| 2 | Does not allow the use of uppercase letters in PIN. |
|
||||
<!-- Device-{TenantId}-Policies-PINComplexity-UppercaseLetters-AllowedValues-End -->
|
||||
|
||||
@ -2027,7 +2027,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of digits in PIN. |
|
||||
| 1 | Requires the use of at least one digit in PIN. |
|
||||
| 1 | Requires the use of at least one digits in PIN. |
|
||||
| 2 | Does not allow the use of digits in PIN. |
|
||||
<!-- User-{TenantId}-Policies-PINComplexity-Digits-AllowedValues-End -->
|
||||
|
||||
@ -2165,7 +2165,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of lowercase letters in PIN. |
|
||||
| 1 | Requires the use of at least one lowercase letter in PIN. |
|
||||
| 1 | Requires the use of at least one lowercase letters in PIN. |
|
||||
| 2 | Does not allow the use of lowercase letters in PIN. |
|
||||
<!-- User-{TenantId}-Policies-PINComplexity-LowercaseLetters-AllowedValues-End -->
|
||||
|
||||
@ -2317,7 +2317,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of special characters in PIN. |
|
||||
| 1 | Requires the use of at least one special character in PIN. |
|
||||
| 1 | Requires the use of at least one special characters in PIN. |
|
||||
| 2 | Does not allow the use of special characters in PIN. |
|
||||
<!-- User-{TenantId}-Policies-PINComplexity-SpecialCharacters-AllowedValues-End -->
|
||||
|
||||
@ -2373,7 +2373,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Allows the use of uppercase letters in PIN. |
|
||||
| 1 | Requires the use of at least one uppercase letter in PIN. |
|
||||
| 1 | Requires the use of at least one uppercase letters in PIN. |
|
||||
| 2 | Does not allow the use of uppercase letters in PIN. |
|
||||
<!-- User-{TenantId}-Policies-PINComplexity-UppercaseLetters-AllowedValues-End -->
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -83,128 +83,6 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ProtectFolders</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>ProtectDocuments</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable PDE on the folder.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ProtectDesktop</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable PDE on the folder.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ProtectPictures</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable PDE on the folder.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Status</NodeName>
|
||||
<DFProperties>
|
||||
@ -245,66 +123,6 @@ The following XML file contains the device description framework (DDF) for the P
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>FolderProtectionStatus</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node reports folder protection status for a user. </Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Protection not started.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Protection is completed with no failures.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>2</MSFT:Value>
|
||||
<MSFT:ValueDescription>Protection in progress.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>3</MSFT:Value>
|
||||
<MSFT:ValueDescription>Protection failed.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>FoldersProtected</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node reports all folders (full path to each folder) that have been protected.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</MgmtTree>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -340,9 +340,6 @@ This article lists the policies in Policy CSP that have a group policy mapping.
|
||||
- [ClearTextPassword](policy-csp-devicelock.md)
|
||||
- [PasswordComplexity](policy-csp-devicelock.md)
|
||||
- [PasswordHistorySize](policy-csp-devicelock.md)
|
||||
- [AccountLockoutThreshold](policy-csp-devicelock.md)
|
||||
- [AccountLockoutDuration](policy-csp-devicelock.md)
|
||||
- [ResetAccountLockoutCounterAfter](policy-csp-devicelock.md)
|
||||
- [AllowAdministratorLockout](policy-csp-devicelock.md)
|
||||
|
||||
## Display
|
||||
@ -689,7 +686,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
|
||||
- [StartLayout](policy-csp-start.md)
|
||||
- [ConfigureStartPins](policy-csp-start.md)
|
||||
- [HideRecommendedSection](policy-csp-start.md)
|
||||
- [HideRecoPersonalizedSites](policy-csp-start.md)
|
||||
- [HideRecommendedPersonalizedSites](policy-csp-start.md)
|
||||
- [HideTaskViewButton](policy-csp-start.md)
|
||||
- [DisableControlCenter](policy-csp-start.md)
|
||||
- [ForceStartSize](policy-csp-start.md)
|
||||
@ -700,7 +697,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
|
||||
- [StartLayout](policy-csp-start.md)
|
||||
- [ConfigureStartPins](policy-csp-start.md)
|
||||
- [HideRecommendedSection](policy-csp-start.md)
|
||||
- [HideRecoPersonalizedSites](policy-csp-start.md)
|
||||
- [HideRecommendedPersonalizedSites](policy-csp-start.md)
|
||||
- [SimplifyQuickSettings](policy-csp-start.md)
|
||||
- [DisableEditingQuickSettings](policy-csp-start.md)
|
||||
- [HideTaskViewButton](policy-csp-start.md)
|
||||
@ -884,7 +881,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
|
||||
- [DenyLogOnAsBatchJob](policy-csp-userrights.md)
|
||||
- [LogOnAsService](policy-csp-userrights.md)
|
||||
- [IncreaseProcessWorkingSet](policy-csp-userrights.md)
|
||||
- [DenyServiceLogonRight](policy-csp-userrights.md)
|
||||
- [DenyLogOnAsService](policy-csp-userrights.md)
|
||||
|
||||
## VirtualizationBasedTechnology
|
||||
|
||||
@ -897,7 +894,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
|
||||
- [NotifyMalicious](policy-csp-webthreatdefense.md)
|
||||
- [NotifyPasswordReuse](policy-csp-webthreatdefense.md)
|
||||
- [NotifyUnsafeApp](policy-csp-webthreatdefense.md)
|
||||
- [CaptureThreatWindow](policy-csp-webthreatdefense.md)
|
||||
- [AutomaticDataCollection](policy-csp-webthreatdefense.md)
|
||||
|
||||
## Wifi
|
||||
|
||||
|
||||
@ -24,14 +24,15 @@ ms.date: 02/03/2023
|
||||
- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#preferredaadtenantdomainname)
|
||||
- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#allowdiscoverablemode)
|
||||
- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#localdevicename)
|
||||
- [Browser/AllowAutofill](policy-csp-browser.md#allowautofill)
|
||||
- [Browser/AllowCookies](policy-csp-browser.md#allowcookies)
|
||||
- [Browser/AllowDoNotTrack](policy-csp-browser.md#allowdonottrack)
|
||||
- [Browser/AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager)
|
||||
- [Browser/AllowPopups](policy-csp-browser.md#allowpopups)
|
||||
- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar)
|
||||
- [Browser/AllowSmartScreen](policy-csp-browser.md#allowsmartscreen)
|
||||
- [Browser/AllowAutofill](policy-csp-browser.md#allowautofill) <sup>13</sup>
|
||||
- [Browser/AllowCookies](policy-csp-browser.md#allowcookies) <sup>13</sup>
|
||||
- [Browser/AllowDoNotTrack](policy-csp-browser.md#allowdonottrack) <sup>13</sup>
|
||||
- [Browser/AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager) <sup>13</sup>
|
||||
- [Browser/AllowPopups](policy-csp-browser.md#allowpopups) <sup>13</sup>
|
||||
- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar) <sup>13</sup>
|
||||
- [Browser/AllowSmartScreen](policy-csp-browser.md#allowsmartscreen) <sup>13</sup>
|
||||
- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#allowbluetooth)
|
||||
- [Connectivity/AllowConnectedDevices](policy-csp-connectivity.md#allowconnecteddevices) <sup>12</sup>
|
||||
- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#allowusbconnection)
|
||||
- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#docachehost) <sup>10</sup>
|
||||
- [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#docachehostsource) <sup>10</sup>
|
||||
@ -66,7 +67,6 @@ ms.date: 02/03/2023
|
||||
- [MixedReality/ConfigureNtpClient](./policy-csp-mixedreality.md#configurentpclient) <sup>12</sup>
|
||||
- [MixedReality/DisallowNetworkConnectivityPassivePolling](./policy-csp-mixedreality.md#disallownetworkconnectivitypassivepolling) <sup>12</sup>
|
||||
- [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#fallbackdiagnostics) <sup>9</sup>
|
||||
- [MixedReality/HeadTrackingMode](policy-csp-mixedreality.md#headtrackingmode) <sup>9</sup>
|
||||
- [MixedReality/ManualDownDirectionDisabled](policy-csp-mixedreality.md#manualdowndirectiondisabled) <sup>*[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update)</sup>
|
||||
- [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#microphonedisabled) <sup>9</sup>
|
||||
- [MixedReality/NtpClientEnabled](./policy-csp-mixedreality.md#ntpclientenabled) <sup>12</sup>
|
||||
@ -74,14 +74,13 @@ ms.date: 02/03/2023
|
||||
- [MixedReality/SkipTrainingDuringSetup](./policy-csp-mixedreality.md#skiptrainingduringsetup) <sup>12</sup>
|
||||
- [MixedReality/VisitorAutoLogon](policy-csp-mixedreality.md#visitorautologon) <sup>10</sup>
|
||||
- [MixedReality/VolumeButtonDisabled](./policy-csp-mixedreality.md#volumebuttondisabled) <sup>9</sup>
|
||||
- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#displayofftimeoutonbattery) <sup>9</sup>
|
||||
- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#displayofftimeoutpluggedin) <sup>9</sup>
|
||||
- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#energysaverbatterythresholdonbattery) <sup>9</sup>
|
||||
- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#energysaverbatterythresholdpluggedin) <sup>9</sup>
|
||||
- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#standbytimeoutonbattery) <sup>9</sup>
|
||||
- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#standbytimeoutpluggedin) <sup>9</sup>
|
||||
- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#displayofftimeoutonbattery) <sup>9, 14</sup>
|
||||
- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#displayofftimeoutpluggedin) <sup>9, 14</sup>
|
||||
- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#energysaverbatterythresholdonbattery) <sup>9, 14</sup>
|
||||
- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#energysaverbatterythresholdpluggedin) <sup>9, 14</sup>
|
||||
- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#standbytimeoutonbattery) <sup>9, 14</sup>
|
||||
- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#standbytimeoutpluggedin) <sup>9, 14</sup>
|
||||
- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#allowinputpersonalization)
|
||||
- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#disableprivacyexperience) <sup>Insider</sup>
|
||||
- [Privacy/LetAppsAccessAccountInfo](policy-csp-privacy.md#letappsaccessaccountinfo)
|
||||
- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forceallowtheseapps)
|
||||
- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forcedenytheseapps)
|
||||
@ -99,6 +98,9 @@ ms.date: 02/03/2023
|
||||
- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_forcedenytheseapps) <sup>8</sup>
|
||||
- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_userincontroloftheseapps) <sup>8</sup>
|
||||
- [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation)
|
||||
- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](/windows/client-management/mdm/policy-csp-privacy) <sup>12</sup>
|
||||
- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy) <sup>12</sup>
|
||||
- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](/windows/client-management/mdm/policy-csp-privacy) <sup>12</sup>
|
||||
- [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone)
|
||||
- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) <sup>8</sup>
|
||||
- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) <sup>8</sup>
|
||||
@ -115,10 +117,11 @@ ms.date: 02/03/2023
|
||||
- [Storage/ConfigStorageSenseCloudContentDehydrationThreshold](policy-csp-storage.md#configstoragesensecloudcontentdehydrationthreshold) <sup>12</sup>
|
||||
- [Storage/ConfigStorageSenseDownloadsCleanupThreshold](policy-csp-storage.md#configstoragesensedownloadscleanupthreshold) <sup>12</sup>
|
||||
- [Storage/ConfigStorageSenseGlobalCadence](policy-csp-storage.md#configstoragesenseglobalcadence) <sup>12</sup>
|
||||
- [System/AllowCommercialDataPipeline](policy-csp-system.md#allowcommercialdatapipeline)
|
||||
- [System/AllowLocation](policy-csp-system.md#allowlocation)
|
||||
- [System/AllowStorageCard](policy-csp-system.md#allowstoragecard)
|
||||
- [System/AllowTelemetry](policy-csp-system.md#allowtelemetry)
|
||||
- [System/ConfigureTelemetryOptInSettingsUx](/windows/client-management/mdm/policy-csp-system) <sup>12</sup>
|
||||
- [System/DisableDeviceDelete](/windows/client-management/mdm/policy-csp-system) <sup>12</sup>
|
||||
- [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#configuretimezone) <sup>9</sup>
|
||||
- [Update/ActiveHoursEnd](./policy-csp-update.md#activehoursend) <sup>9</sup>
|
||||
- [Update/ActiveHoursMaxRange](./policy-csp-update.md#activehoursmaxrange) <sup>9</sup>
|
||||
@ -160,8 +163,15 @@ Footnotes:
|
||||
- 10 - Available in [Windows Holographic, version 21H1](/hololens/hololens-release-notes#windows-holographic-version-21h1)
|
||||
- 11 - Available in [Windows Holographic, version 21H2](/hololens/hololens-release-notes#windows-holographic-version-21h2)
|
||||
- 12 - Available in [Windows Holographic, version 22H2](/hololens/hololens-release-notes#windows-holographic-version-22h2)
|
||||
- 13 - Refer to [Configuring Policy Settings for the New Microsoft Edge](/hololens/hololens-new-edge#configuring-policy-settings-for-the-new-microsoft-edge)
|
||||
- 14 - Refer to [New Power Policies for Hololens 2](/hololens/hololens-release-notes-2004#new-power-policies-for-hololens-2)
|
||||
- Insider - Available in our current [HoloLens Insider builds](/hololens/hololens-insider).
|
||||
|
||||
## Related topics
|
||||
|
||||
[Policy CSP](policy-configuration-service-provider.md)
|
||||
|
||||
[Full HoloLens CSP Details](/windows/client-management/mdm/configuration-service-provider-support)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Windows 10 Team
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/28/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -257,6 +257,7 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
|
||||
|
||||
## Start
|
||||
|
||||
- [HideRecommendedPersonalizedSites](policy-csp-start.md#hiderecommendedpersonalizedsites)
|
||||
- [StartLayout](policy-csp-start.md#startlayout)
|
||||
|
||||
## System
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/28/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the ADMX_SharedFolders Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -31,7 +31,7 @@ ms.topic: reference
|
||||
<!-- PublishDfsRoots-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
<!-- PublishDfsRoots-Applicability-End -->
|
||||
|
||||
<!-- PublishDfsRoots-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Audit Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 04/14/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/27/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -1901,8 +1901,8 @@ Same as Disabled.
|
||||
<!-- ExcludedExtensions-OmaUri-End -->
|
||||
|
||||
<!-- ExcludedExtensions-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0.
|
||||
<!-- Description-Source-DDF-Forced -->
|
||||
Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a |. For example, lib|obj.
|
||||
<!-- ExcludedExtensions-Description-End -->
|
||||
|
||||
<!-- ExcludedExtensions-Editable-Begin -->
|
||||
@ -1957,8 +1957,8 @@ This policy setting allows you specify a list of file types that should be exclu
|
||||
<!-- ExcludedPaths-OmaUri-End -->
|
||||
|
||||
<!-- ExcludedPaths-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0.
|
||||
<!-- Description-Source-DDF-Forced -->
|
||||
Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a |. For example, C:\Example|C:\Example1.
|
||||
<!-- ExcludedPaths-Description-End -->
|
||||
|
||||
<!-- ExcludedPaths-Editable-Begin -->
|
||||
@ -2013,8 +2013,11 @@ This policy setting allows you to disable scheduled and real-time scanning for f
|
||||
<!-- ExcludedProcesses-OmaUri-End -->
|
||||
|
||||
<!-- ExcludedProcesses-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0.
|
||||
<!-- Description-Source-DDF-Forced -->
|
||||
Allows an administrator to specify a list of files opened by processes to ignore during a scan.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The process itself is not excluded from the scan, but can be by using the Defender/ExcludedPaths policy to exclude its path. Each file type must be separated by a |. For example, C:\Example. exe|C:\Example1.exe.
|
||||
<!-- ExcludedProcesses-Description-End -->
|
||||
|
||||
<!-- ExcludedProcesses-Editable-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the DeviceInstallation Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -347,7 +347,7 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
|
||||
<!-- EnableInstallationPolicyLayering-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.256] and later <br> :heavy_check_mark: Windows 10, version 1809 [10.0.17763.2145] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1714] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1151] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348.256] and later <br> :heavy_check_mark: Windows 10, version 1809 [10.0.17763.2145] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1714] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1151] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
<!-- EnableInstallationPolicyLayering-Applicability-End -->
|
||||
|
||||
<!-- EnableInstallationPolicyLayering-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the DeviceLock Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -30,105 +30,44 @@ ms.topic: reference
|
||||
> The DeviceLock CSP utilizes the [Exchange ActiveSync Policy Engine](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). When password length and complexity rules are applied, all the local user and administrator accounts are marked to change their password at the next sign in to ensure complexity requirements are met. For more information, see [Password length and complexity supported by account types](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)#password-length-and-complexity-supported-by-account-types).
|
||||
<!-- DeviceLock-Editable-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-Begin -->
|
||||
## AccountLockoutDuration
|
||||
<!-- AccountLockoutPolicy-Begin -->
|
||||
## AccountLockoutPolicy
|
||||
|
||||
<!-- AccountLockoutDuration-Applicability-Begin -->
|
||||
<!-- AccountLockoutPolicy-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- AccountLockoutDuration-Applicability-End -->
|
||||
<!-- AccountLockoutPolicy-Applicability-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-OmaUri-Begin -->
|
||||
<!-- AccountLockoutPolicy-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutDuration
|
||||
./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutPolicy
|
||||
```
|
||||
<!-- AccountLockoutDuration-OmaUri-End -->
|
||||
<!-- AccountLockoutPolicy-OmaUri-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-Description-Begin -->
|
||||
<!-- AccountLockoutPolicy-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Account lockout duration This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
|
||||
<!-- AccountLockoutDuration-Description-End -->
|
||||
Account lockout threshold - This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out. Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts. Default: 0 Account lockout duration - This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified. Reset account lockout counter after - This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes. If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
|
||||
<!-- AccountLockoutPolicy-Description-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-Editable-Begin -->
|
||||
<!-- AccountLockoutPolicy-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- AccountLockoutDuration-Editable-End -->
|
||||
<!-- AccountLockoutPolicy-Editable-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-DFProperties-Begin -->
|
||||
<!-- AccountLockoutPolicy-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[0-99999]` |
|
||||
| Default Value | 0 |
|
||||
<!-- AccountLockoutDuration-DFProperties-End -->
|
||||
<!-- AccountLockoutPolicy-DFProperties-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | Account lockout duration |
|
||||
| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
|
||||
<!-- AccountLockoutDuration-GpMapping-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-Examples-Begin -->
|
||||
<!-- AccountLockoutPolicy-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- AccountLockoutDuration-Examples-End -->
|
||||
<!-- AccountLockoutPolicy-Examples-End -->
|
||||
|
||||
<!-- AccountLockoutDuration-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-Begin -->
|
||||
## AccountLockoutThreshold
|
||||
|
||||
<!-- AccountLockoutThreshold-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- AccountLockoutThreshold-Applicability-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutThreshold
|
||||
```
|
||||
<!-- AccountLockoutThreshold-OmaUri-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Account lockout threshold - This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out. Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts. Default: 0.
|
||||
<!-- AccountLockoutThreshold-Description-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- AccountLockoutThreshold-Editable-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[0-10]` |
|
||||
| Default Value | 0 |
|
||||
<!-- AccountLockoutThreshold-DFProperties-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | Account lockout threshold |
|
||||
| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
|
||||
<!-- AccountLockoutThreshold-GpMapping-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- AccountLockoutThreshold-Examples-End -->
|
||||
|
||||
<!-- AccountLockoutThreshold-End -->
|
||||
<!-- AccountLockoutPolicy-End -->
|
||||
|
||||
<!-- AllowAdministratorLockout-Begin -->
|
||||
## AllowAdministratorLockout
|
||||
@ -162,7 +101,7 @@ Allow Administrator account lockout This security setting determines whether the
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[0-1]` |
|
||||
| Default Value | 0 |
|
||||
| Default Value | 1 |
|
||||
<!-- AllowAdministratorLockout-DFProperties-End -->
|
||||
|
||||
<!-- AllowAdministratorLockout-GpMapping-Begin -->
|
||||
@ -1165,11 +1104,11 @@ Complexity requirements are enforced when passwords are changed or created.
|
||||
|
||||
<!-- PasswordHistorySize-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Minimum password length
|
||||
This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required.
|
||||
Enforce password history
|
||||
This security setting determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. The value must be between 0 and 24 passwords. This policy enables administrators to enhance security by ensuring that old passwords are not reused continually. Default: 24 on domain controllers. 0 on stand-alone servers.
|
||||
|
||||
> [!NOTE]
|
||||
> By default, member computers follow the configuration of their domain controllers. Default: 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting.
|
||||
> By default, member computers follow the configuration of their domain controllers. To maintain the effectiveness of the password history, do not allow passwords to be changed immediately after they were just changed by also enabling the Minimum password age security policy setting. For information about the minimum password age security policy setting, see Minimum password age.
|
||||
<!-- PasswordHistorySize-Description-End -->
|
||||
|
||||
<!-- PasswordHistorySize-Editable-Begin -->
|
||||
@ -1184,7 +1123,7 @@ This security setting determines the least number of characters that a password
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[0-24]` |
|
||||
| Default Value | 7 |
|
||||
| Default Value | 24 |
|
||||
<!-- PasswordHistorySize-DFProperties-End -->
|
||||
|
||||
<!-- PasswordHistorySize-GpMapping-Begin -->
|
||||
@ -1192,7 +1131,7 @@ This security setting determines the least number of characters that a password
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | Minimum password length |
|
||||
| Name | Enforce password history |
|
||||
| Path | Windows Settings > Security Settings > Account Policies > Password Policy |
|
||||
<!-- PasswordHistorySize-GpMapping-End -->
|
||||
|
||||
@ -1322,56 +1261,6 @@ If you enable this setting, users will no longer be able to modify slide show se
|
||||
|
||||
<!-- PreventLockScreenSlideShow-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-Begin -->
|
||||
## ResetAccountLockoutCounterAfter
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- ResetAccountLockoutCounterAfter-Applicability-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/DeviceLock/ResetAccountLockoutCounterAfter
|
||||
```
|
||||
<!-- ResetAccountLockoutCounterAfter-OmaUri-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Reset account lockout counter after - This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes. If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
|
||||
<!-- ResetAccountLockoutCounterAfter-Description-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- ResetAccountLockoutCounterAfter-Editable-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | Range: `[1-99999]` |
|
||||
| Default Value | 0 |
|
||||
<!-- ResetAccountLockoutCounterAfter-DFProperties-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | Reset account lockout counter after |
|
||||
| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
|
||||
<!-- ResetAccountLockoutCounterAfter-GpMapping-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- ResetAccountLockoutCounterAfter-Examples-End -->
|
||||
|
||||
<!-- ResetAccountLockoutCounterAfter-End -->
|
||||
|
||||
<!-- ScreenTimeoutWhileLocked-Begin -->
|
||||
## ScreenTimeoutWhileLocked
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the InternetExplorer Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -1428,7 +1428,7 @@ This policy allows the user to go directly to an intranet site for a one-word en
|
||||
<!-- AllowSaveTargetAsInIEMode-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
<!-- AllowSaveTargetAsInIEMode-Applicability-End -->
|
||||
|
||||
<!-- AllowSaveTargetAsInIEMode-OmaUri-Begin -->
|
||||
@ -2080,7 +2080,7 @@ This policy setting allows you to manage whether Internet Explorer checks for di
|
||||
<!-- ConfigureEdgeRedirectChannel-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
<!-- ConfigureEdgeRedirectChannel-Applicability-End -->
|
||||
|
||||
<!-- ConfigureEdgeRedirectChannel-OmaUri-Begin -->
|
||||
@ -3403,7 +3403,7 @@ The Home page specified on the General tab of the Internet Options dialog box is
|
||||
<!-- DisableHTMLApplication-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.1060] and later <br> :heavy_check_mark: Windows 10, version 1809 [10.0.17763.3460] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.2060] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.1030] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348.1060] and later <br> :heavy_check_mark: Windows 10, version 1809 [10.0.17763.3460] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.2060] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.1030] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- DisableHTMLApplication-Applicability-End -->
|
||||
|
||||
<!-- DisableHTMLApplication-OmaUri-Begin -->
|
||||
@ -3599,7 +3599,7 @@ InPrivate Browsing prevents Internet Explorer from storing data about a user's b
|
||||
<!-- DisableInternetExplorerApp-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
<!-- DisableInternetExplorerApp-Applicability-End -->
|
||||
|
||||
<!-- DisableInternetExplorerApp-OmaUri-Begin -->
|
||||
@ -4486,7 +4486,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T
|
||||
<!-- EnableExtendedIEModeHotkeys-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.143] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1474] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.906] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348.143] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1474] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.906] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
<!-- EnableExtendedIEModeHotkeys-Applicability-End -->
|
||||
|
||||
<!-- EnableExtendedIEModeHotkeys-OmaUri-Begin -->
|
||||
@ -4552,7 +4552,7 @@ For more information, see <https://go.microsoft.com/fwlink/?linkid=2102115>
|
||||
<!-- EnableGlobalWindowListInIEMode-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.558] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1566] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.527] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348.558] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1566] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.527] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- EnableGlobalWindowListInIEMode-Applicability-End -->
|
||||
|
||||
<!-- EnableGlobalWindowListInIEMode-OmaUri-Begin -->
|
||||
@ -7968,7 +7968,7 @@ This policy setting specifies whether JScript or JScript9Legacy is loaded for MS
|
||||
<!-- KeepIntranetSitesInInternetExplorer-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
<!-- KeepIntranetSitesInInternetExplorer-Applicability-End -->
|
||||
|
||||
<!-- KeepIntranetSitesInInternetExplorer-OmaUri-Begin -->
|
||||
@ -13390,7 +13390,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T
|
||||
<!-- ResetZoomForDialogInIEMode-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.261] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1832] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1266] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.282] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348.261] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1832] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1266] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000.282] and later <br> :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- ResetZoomForDialogInIEMode-Applicability-End -->
|
||||
|
||||
<!-- ResetZoomForDialogInIEMode-OmaUri-Begin -->
|
||||
@ -16537,7 +16537,7 @@ Also, see the "Security zones: Do not allow users to change policies" policy.
|
||||
<!-- SendSitesNotInEnterpriseSiteListToEdge-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348] and later <br> :heavy_check_mark: Windows 10, version 1903 [10.0.18362.1350] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.789] and later |
|
||||
<!-- SendSitesNotInEnterpriseSiteListToEdge-Applicability-End -->
|
||||
|
||||
<!-- SendSitesNotInEnterpriseSiteListToEdge-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Kerberos Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -242,7 +242,6 @@ This policy setting controls hash or checksum algorithms used by the Kerberos cl
|
||||
- "Not Supported" disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure.
|
||||
|
||||
- If you disable or do not configure this policy, each algorithm will assume the "Default" state.
|
||||
More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at< https://go.microsoft.com/fwlink/?linkid=2169037>.
|
||||
|
||||
Events generated by this configuration: 205, 206, 207, 208.
|
||||
<!-- PKInitHashAlgorithmConfiguration-Description-End -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the MixedReality Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 01/09/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -86,7 +86,7 @@ Steps to use this policy correctly:
|
||||
<!-- AllowCaptivePortalBeforeLogon-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- AllowCaptivePortalBeforeLogon-Applicability-End -->
|
||||
|
||||
<!-- AllowCaptivePortalBeforeLogon-OmaUri-Begin -->
|
||||
@ -136,7 +136,7 @@ This opt-in policy can help with the setup of new devices in new areas or new us
|
||||
<!-- AllowLaunchUriInSingleAppKiosk-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- AllowLaunchUriInSingleAppKiosk-Applicability-End -->
|
||||
|
||||
<!-- AllowLaunchUriInSingleAppKiosk-OmaUri-Begin -->
|
||||
@ -188,7 +188,7 @@ For more information on the Launcher API, see [Launcher Class (Windows.System) -
|
||||
<!-- AutoLogonUser-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- AutoLogonUser-Applicability-End -->
|
||||
|
||||
<!-- AutoLogonUser-OmaUri-Begin -->
|
||||
@ -335,7 +335,7 @@ This policy setting controls if pressing the brightness button changes the brigh
|
||||
<!-- ConfigureMovingPlatform-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- ConfigureMovingPlatform-Applicability-End -->
|
||||
|
||||
<!-- ConfigureMovingPlatform-OmaUri-Begin -->
|
||||
@ -386,7 +386,7 @@ For more information, see [Moving platform mode on low dynamic motion moving pla
|
||||
<!-- ConfigureNtpClient-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- ConfigureNtpClient-Applicability-End -->
|
||||
|
||||
<!-- ConfigureNtpClient-OmaUri-Begin -->
|
||||
@ -491,7 +491,7 @@ The following XML string is an example of the value for this policy:
|
||||
<!-- DisallowNetworkConnectivityPassivePolling-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- DisallowNetworkConnectivityPassivePolling-Applicability-End -->
|
||||
|
||||
<!-- DisallowNetworkConnectivityPassivePolling-OmaUri-Begin -->
|
||||
@ -687,7 +687,7 @@ This policy configures behavior of HUP to determine, which algorithm to use for
|
||||
<!-- ManualDownDirectionDisabled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- ManualDownDirectionDisabled-Applicability-End -->
|
||||
|
||||
<!-- ManualDownDirectionDisabled-OmaUri-Begin -->
|
||||
@ -786,7 +786,7 @@ This policy setting controls whether microphone on HoloLens 2 is disabled or not
|
||||
<!-- NtpClientEnabled-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- NtpClientEnabled-Applicability-End -->
|
||||
|
||||
<!-- NtpClientEnabled-OmaUri-Begin -->
|
||||
@ -856,7 +856,7 @@ The following example XML string shows the value to enable this policy:
|
||||
<!-- SkipCalibrationDuringSetup-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- SkipCalibrationDuringSetup-Applicability-End -->
|
||||
|
||||
<!-- SkipCalibrationDuringSetup-OmaUri-Begin -->
|
||||
@ -907,7 +907,7 @@ This policy configures whether the device will take the user through the eye tra
|
||||
<!-- SkipTrainingDuringSetup-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- SkipTrainingDuringSetup-Applicability-End -->
|
||||
|
||||
<!-- SkipTrainingDuringSetup-OmaUri-Begin -->
|
||||
@ -957,7 +957,7 @@ It skips the training experience of interactions with the hummingbird and Start
|
||||
<!-- VisitorAutoLogon-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Unknown [10.0.20348] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: [10.0.20348] and later |
|
||||
<!-- VisitorAutoLogon-Applicability-End -->
|
||||
|
||||
<!-- VisitorAutoLogon-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Privacy Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -2930,7 +2930,7 @@ If an app is open when this Group Policy object is applied on a device, employee
|
||||
<!-- LetAppsAccessHumanPresence-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence-OmaUri-Begin -->
|
||||
@ -2990,7 +2990,7 @@ This policy setting specifies whether Windows apps can access the human presence
|
||||
<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-OmaUri-Begin -->
|
||||
@ -3040,7 +3040,7 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
|
||||
<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-OmaUri-Begin -->
|
||||
@ -3090,7 +3090,7 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
|
||||
<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.25000] and later |
|
||||
<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Applicability-End -->
|
||||
|
||||
<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Start Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -1424,6 +1424,68 @@ To validate this policy, do the following steps:
|
||||
|
||||
<!-- HideRecentlyAddedApps-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-Begin -->
|
||||
## HideRecommendedPersonalizedSites
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | <!-- Not-Found --> |
|
||||
<!-- HideRecommendedPersonalizedSites-Applicability-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-OmaUri-Begin -->
|
||||
```User
|
||||
./User/Vendor/MSFT/Policy/Config/Start/HideRecommendedPersonalizedSites
|
||||
```
|
||||
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/Start/HideRecommendedPersonalizedSites
|
||||
```
|
||||
<!-- HideRecommendedPersonalizedSites-OmaUri-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This policy setting allows you to hide the personalized websites in the recommended section of the Start Menu. If you enable this policy setting, the Start Menu will no longer show personalized website recommendations in the recommended section of the start menu.
|
||||
<!-- HideRecommendedPersonalizedSites-Description-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- HideRecommendedPersonalizedSites-Editable-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 0 |
|
||||
<!-- HideRecommendedPersonalizedSites-DFProperties-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Personalized Website Recommendations shown. |
|
||||
| 1 | Personalized Website Recommendations hidden. |
|
||||
<!-- HideRecommendedPersonalizedSites-AllowedValues-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | HideRecommendedPersonalizedSites |
|
||||
| Path | StartMenu > AT > StartMenu |
|
||||
<!-- HideRecommendedPersonalizedSites-GpMapping-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- HideRecommendedPersonalizedSites-Examples-End -->
|
||||
|
||||
<!-- HideRecommendedPersonalizedSites-End -->
|
||||
|
||||
<!-- HideRecommendedSection-Begin -->
|
||||
## HideRecommendedSection
|
||||
|
||||
@ -1493,68 +1555,6 @@ If you enable this policy setting, the Start Menu will no longer show the sectio
|
||||
|
||||
<!-- HideRecommendedSection-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-Begin -->
|
||||
## HideRecoPersonalizedSites
|
||||
|
||||
<!-- HideRecoPersonalizedSites-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | <!-- Not-Found --> |
|
||||
<!-- HideRecoPersonalizedSites-Applicability-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-OmaUri-Begin -->
|
||||
```User
|
||||
./User/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites
|
||||
```
|
||||
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites
|
||||
```
|
||||
<!-- HideRecoPersonalizedSites-OmaUri-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This policy setting allows you to hide the personalized websites in the recommended section of the Start Menu. If you enable this policy setting, the Start Menu will no longer show personalized website recommendations in the recommended section of the start menu.
|
||||
<!-- HideRecoPersonalizedSites-Description-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- HideRecoPersonalizedSites-Editable-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 0 |
|
||||
<!-- HideRecoPersonalizedSites-DFProperties-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Personalized Website Recommendations shown. |
|
||||
| 1 | Personalized Website Recommendations hidden. |
|
||||
<!-- HideRecoPersonalizedSites-AllowedValues-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | HideRecoPersonalizedSites |
|
||||
| Path | StartMenu > AT > StartMenu |
|
||||
<!-- HideRecoPersonalizedSites-GpMapping-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- HideRecoPersonalizedSites-Examples-End -->
|
||||
|
||||
<!-- HideRecoPersonalizedSites-End -->
|
||||
|
||||
<!-- HideRestart-Begin -->
|
||||
## HideRestart
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Stickers Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -26,7 +26,7 @@ ms.topic: reference
|
||||
<!-- EnableStickers-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- EnableStickers-Applicability-End -->
|
||||
|
||||
<!-- EnableStickers-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the TenantRestrictions Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 01/09/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -31,7 +31,7 @@ ms.topic: reference
|
||||
<!-- ConfigureTenantRestrictions-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.320] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1320] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1320] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1320] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20348.320] and later <br> :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1320] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1320] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1320] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
|
||||
<!-- ConfigureTenantRestrictions-Applicability-End -->
|
||||
|
||||
<!-- ConfigureTenantRestrictions-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the TextInput Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -949,7 +949,7 @@ This Policy setting applies only to Microsoft Traditional Chinese IME.
|
||||
|
||||
<!-- EnableTouchKeyboardAutoInvokeInDesktopMode-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This policy allows the IT admin to enable the touch keyboard to automatically show up when the device is in the desktop mode. The touch keyboard is enabled in both the tablet and desktop mode. In the tablet mode, when you touch a textbox, the touch keyboard automatically shows up. But in the desktop mode, by default, the touch keyboard does not automatically show up when you touch a textbox. The user must click the system tray to enable the touch keyboard. When this policy is enabled, the touch keyboard automatically shows up when the device is in the desktop mode. This policy corresponds to Show the touch keyboard when not in tablet mode and there's no keyboard attached in the Settings app.
|
||||
This policy allows the IT admin to control whether the touch keyboard should show up on tapping an edit control. By default, when you tap a textbox, the touch keyboard automatically shows up when there's no keyboard attached. When this policy is enabled, the touch keyboard can be shown or suppressed regardless of the hardware keyboard availability. This policy corresponds to Show the touch keyboard setting in the Settings app.
|
||||
<!-- EnableTouchKeyboardAutoInvokeInDesktopMode-Description-End -->
|
||||
|
||||
<!-- EnableTouchKeyboardAutoInvokeInDesktopMode-Editable-Begin -->
|
||||
@ -971,8 +971,9 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 (Default) | Disabled. |
|
||||
| 1 | Enabled. |
|
||||
| 0 (Default) | Never. |
|
||||
| 1 | When no keyboard attached. |
|
||||
| 2 | Always. |
|
||||
<!-- EnableTouchKeyboardAutoInvokeInDesktopMode-AllowedValues-End -->
|
||||
|
||||
<!-- EnableTouchKeyboardAutoInvokeInDesktopMode-Examples-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -826,12 +826,8 @@ Pause Updates | To prevent Feature Updates from being offered to the device, you
|
||||
<!-- PauseFeatureUpdatesStartTime-OmaUri-End -->
|
||||
|
||||
<!-- PauseFeatureUpdatesStartTime-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
Enable this policy to specify when to receive Feature Updates.
|
||||
|
||||
Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo
|
||||
|
||||
Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused.
|
||||
<!-- Description-Source-DDF-Forced -->
|
||||
Specifies the date and time when the IT admin wants to start pausing the Feature Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28).
|
||||
<!-- PauseFeatureUpdatesStartTime-Description-End -->
|
||||
|
||||
<!-- PauseFeatureUpdatesStartTime-Editable-Begin -->
|
||||
@ -955,16 +951,8 @@ If you disable or do not configure this policy, Windows Update will not alter it
|
||||
<!-- PauseQualityUpdatesStartTime-OmaUri-End -->
|
||||
|
||||
<!-- PauseQualityUpdatesStartTime-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
Enable this policy to specify when to receive quality updates.
|
||||
|
||||
You can defer receiving quality updates for up to 30 days.
|
||||
|
||||
To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field.
|
||||
|
||||
To resume receiving Quality Updates which are paused, clear the start date field.
|
||||
|
||||
If you disable or do not configure this policy, Windows Update will not alter its behavior.
|
||||
<!-- Description-Source-DDF-Forced -->
|
||||
Specifies the date and time when the IT admin wants to start pausing the Quality Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28).
|
||||
<!-- PauseQualityUpdatesStartTime-Description-End -->
|
||||
|
||||
<!-- PauseQualityUpdatesStartTime-Editable-Begin -->
|
||||
@ -2143,7 +2131,7 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. |
|
||||
| 0 | Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. |
|
||||
| 1 | Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. |
|
||||
| 2 (Default) | Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart. |
|
||||
| 3 | Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. |
|
||||
@ -3551,7 +3539,7 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie
|
||||
|
||||
<!-- SetDisablePauseUXAccess-Description-Begin -->
|
||||
<!-- Description-Source-ADMX -->
|
||||
This setting allows removal access to "Pause updates" feature.
|
||||
This setting allows to remove access to "Pause updates" feature.
|
||||
|
||||
Once enabled user access to pause updates is removed.
|
||||
<!-- SetDisablePauseUXAccess-Description-End -->
|
||||
@ -4311,7 +4299,7 @@ Enable this policy to control the timing before transitioning from Auto restarts
|
||||
|
||||
You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days.
|
||||
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period.
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.
|
||||
|
||||
If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
|
||||
|
||||
@ -4381,7 +4369,7 @@ Enable this policy to control the timing before transitioning from Auto restarts
|
||||
|
||||
You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days.
|
||||
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period.
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.
|
||||
|
||||
If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
|
||||
|
||||
@ -4451,7 +4439,7 @@ Enable this policy to control the timing before transitioning from Auto restarts
|
||||
|
||||
You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days.
|
||||
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period.
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.
|
||||
|
||||
If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
|
||||
|
||||
@ -4521,7 +4509,7 @@ Enable this policy to control the timing before transitioning from Auto restarts
|
||||
|
||||
You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days.
|
||||
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period.
|
||||
You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.
|
||||
|
||||
If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the UserRights Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -980,6 +980,58 @@ This security setting determines which accounts are prevented from being able to
|
||||
|
||||
<!-- DenyLogOnAsBatchJob-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-Begin -->
|
||||
## DenyLogOnAsService
|
||||
|
||||
<!-- DenyLogOnAsService-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- DenyLogOnAsService-Applicability-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/UserRights/DenyLogOnAsService
|
||||
```
|
||||
<!-- DenyLogOnAsService-OmaUri-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Deny log on as a service -This security setting determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies.
|
||||
|
||||
> [!NOTE]
|
||||
> This security setting does not apply to the System, Local Service, or Network Service accounts. Default: None.
|
||||
<!-- DenyLogOnAsService-Description-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- DenyLogOnAsService-Editable-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | List (Delimiter: `0xF000`) |
|
||||
<!-- DenyLogOnAsService-DFProperties-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | Deny log on as a service |
|
||||
| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment |
|
||||
<!-- DenyLogOnAsService-GpMapping-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- DenyLogOnAsService-Examples-End -->
|
||||
|
||||
<!-- DenyLogOnAsService-End -->
|
||||
|
||||
<!-- DenyRemoteDesktopServicesLogOn-Begin -->
|
||||
## DenyRemoteDesktopServicesLogOn
|
||||
|
||||
@ -1029,58 +1081,6 @@ This user right determines which users and groups are prohibited from logging on
|
||||
|
||||
<!-- DenyRemoteDesktopServicesLogOn-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-Begin -->
|
||||
## DenyServiceLogonRight
|
||||
|
||||
<!-- DenyServiceLogonRight-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- DenyServiceLogonRight-Applicability-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/UserRights/DenyServiceLogonRight
|
||||
```
|
||||
<!-- DenyServiceLogonRight-OmaUri-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This security setting determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies.
|
||||
|
||||
> [!NOTE]
|
||||
> This security setting does not apply to the System, Local Service, or Network Service accounts. Default: None.
|
||||
<!-- DenyServiceLogonRight-Description-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- DenyServiceLogonRight-Editable-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Allowed Values | List (Delimiter: `0xF000`) |
|
||||
<!-- DenyServiceLogonRight-DFProperties-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | Deny log on as a service |
|
||||
| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment |
|
||||
<!-- DenyServiceLogonRight-GpMapping-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- DenyServiceLogonRight-Examples-End -->
|
||||
|
||||
<!-- DenyServiceLogonRight-End -->
|
||||
|
||||
<!-- EnableDelegation-Begin -->
|
||||
## EnableDelegation
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the WebThreatDefense Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -25,63 +25,63 @@ ms.topic: reference
|
||||
> In Microsoft Intune, this CSP is listed under the **Enhanced Phishing Protection** category.
|
||||
<!-- WebThreatDefense-Editable-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-Begin -->
|
||||
## CaptureThreatWindow
|
||||
<!-- AutomaticDataCollection-Begin -->
|
||||
## AutomaticDataCollection
|
||||
|
||||
<!-- CaptureThreatWindow-Applicability-Begin -->
|
||||
<!-- AutomaticDataCollection-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
|
||||
<!-- CaptureThreatWindow-Applicability-End -->
|
||||
<!-- AutomaticDataCollection-Applicability-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-OmaUri-Begin -->
|
||||
<!-- AutomaticDataCollection-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/CaptureThreatWindow
|
||||
./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/AutomaticDataCollection
|
||||
```
|
||||
<!-- CaptureThreatWindow-OmaUri-End -->
|
||||
<!-- AutomaticDataCollection-OmaUri-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-Description-Begin -->
|
||||
<!-- AutomaticDataCollection-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Configures Enhanced Phishing Protection notifications to allow to capture the suspicious window on client machines for further threat analysis.
|
||||
<!-- CaptureThreatWindow-Description-End -->
|
||||
Automatically collect website or app content when additional analysis is needed to help identify security threats.
|
||||
<!-- AutomaticDataCollection-Description-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-Editable-Begin -->
|
||||
<!-- AutomaticDataCollection-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- CaptureThreatWindow-Editable-End -->
|
||||
<!-- AutomaticDataCollection-Editable-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-DFProperties-Begin -->
|
||||
<!-- AutomaticDataCollection-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 1 |
|
||||
<!-- CaptureThreatWindow-DFProperties-End -->
|
||||
| Default Value | 0 |
|
||||
<!-- AutomaticDataCollection-DFProperties-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-AllowedValues-Begin -->
|
||||
<!-- AutomaticDataCollection-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | Disabled. |
|
||||
| 1 (Default) | Enabled. |
|
||||
<!-- CaptureThreatWindow-AllowedValues-End -->
|
||||
| 0 (Default) | Disabled. |
|
||||
| 1 | Enabled. |
|
||||
<!-- AutomaticDataCollection-AllowedValues-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-GpMapping-Begin -->
|
||||
<!-- AutomaticDataCollection-GpMapping-Begin -->
|
||||
**Group policy mapping**:
|
||||
|
||||
| Name | Value |
|
||||
|:--|:--|
|
||||
| Name | CaptureThreatWindow |
|
||||
| Name | AutomaticDataCollection |
|
||||
| Path | WebThreatDefense > AT > WindowsComponents > WebThreatDefense |
|
||||
<!-- CaptureThreatWindow-GpMapping-End -->
|
||||
<!-- AutomaticDataCollection-GpMapping-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-Examples-Begin -->
|
||||
<!-- AutomaticDataCollection-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- CaptureThreatWindow-Examples-End -->
|
||||
<!-- AutomaticDataCollection-Examples-End -->
|
||||
|
||||
<!-- CaptureThreatWindow-End -->
|
||||
<!-- AutomaticDataCollection-End -->
|
||||
|
||||
<!-- NotifyMalicious-Begin -->
|
||||
## NotifyMalicious
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Wifi Area in Policy CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -228,6 +228,105 @@ Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks.
|
||||
|
||||
<!-- AllowManualWiFiConfiguration-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Begin -->
|
||||
## AllowWFAQosManagementDSCPToUPMapping
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | <!-- Not-Found --> |
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Applicability-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWFAQosManagementDSCPToUPMapping
|
||||
```
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-OmaUri-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Allow or disallow the device to use the DSCP to UP Mapping feature from the Wi-Fi Alliance QOS Management Suite 2020. This policy requires a reboot to take effect.
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Description-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Editable-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 2 |
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-DFProperties-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | DSCP to UP Mapping will be disabled. |
|
||||
| 1 | DSCP to UP Mapping will be enabled. |
|
||||
| 2 (Default) | DSCP to UP Mapping will be enabled only if it is enabled in the network profile. |
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-AllowedValues-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-Examples-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementDSCPToUPMapping-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-Begin -->
|
||||
## AllowWFAQosManagementMSCS
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | <!-- Not-Found --> |
|
||||
<!-- AllowWFAQosManagementMSCS-Applicability-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-OmaUri-Begin -->
|
||||
```Device
|
||||
./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWFAQosManagementMSCS
|
||||
```
|
||||
<!-- AllowWFAQosManagementMSCS-OmaUri-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Allow or disallow the device to automatically request to enable Mirrored Stream Classification Service when connecting to a MSCS capable network. This is a Quality of Service feature associated with Wi-Fi Alliance QoS Management Suite 2020. This policy requires a reboot to take effect.
|
||||
<!-- AllowWFAQosManagementMSCS-Description-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- AllowWFAQosManagementMSCS-Editable-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Default Value | 1 |
|
||||
<!-- AllowWFAQosManagementMSCS-DFProperties-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | The device will not automatically request to enable MSCS when connecting to a MSCS capable network. |
|
||||
| 1 (Default) | The device will automatically request to enable MSCS when connecting to a MSCS capable network. |
|
||||
<!-- AllowWFAQosManagementMSCS-AllowedValues-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- AllowWFAQosManagementMSCS-Examples-End -->
|
||||
|
||||
<!-- AllowWFAQosManagementMSCS-End -->
|
||||
|
||||
<!-- AllowWiFi-Begin -->
|
||||
## AllowWiFi
|
||||
|
||||
@ -245,7 +344,7 @@ Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks.
|
||||
|
||||
<!-- AllowWiFi-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This policy has been deprecated.
|
||||
Allow or disallow WiFi connection.
|
||||
<!-- AllowWiFi-Description-End -->
|
||||
|
||||
<!-- AllowWiFi-Editable-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the Reboot CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -194,7 +194,7 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule
|
||||
<!-- Device-Schedule-WeeklyRecurrent-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- Device-Schedule-WeeklyRecurrent-Applicability-End -->
|
||||
|
||||
<!-- Device-Schedule-WeeklyRecurrent-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -170,6 +170,10 @@ The following XML file contains the device description framework (DDF) for the R
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:Applicability>
|
||||
<MSFT:OsBuildVersion>10.0.22621</MSFT:OsBuildVersion>
|
||||
<MSFT:CspVersion>1.0</MSFT:CspVersion>
|
||||
</MSFT:Applicability>
|
||||
<MSFT:AllowedValues ValueType="None">
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the SUPL CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/23/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -17,6 +17,7 @@ ms.topic: reference
|
||||
# SUPL CSP
|
||||
|
||||
<!-- SUPL-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
The SUPL configuration service provider is used to configure the location client, as shown in the following table:
|
||||
|
||||
- **Location Service**: Connection type
|
||||
@ -395,6 +396,7 @@ This setting is deprecated in Windows 10. Optional. Boolean. Specifies whether t
|
||||
<!-- Device-SUPL1-Ext-Microsoft-LocMasterSwitchDependencyNII-Description-End -->
|
||||
|
||||
<!-- Device-SUPL1-Ext-Microsoft-LocMasterSwitchDependencyNII-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
| Location toggle setting | LocMasterSwitchDependencyNII setting | NI request processing allowed |
|
||||
|-------------------------|--------------------------------------|------------------------------------|
|
||||
| On | 0 | Yes |
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 03/24/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -50,102 +50,6 @@ The following XML file contains the device description framework (DDF) for the S
|
||||
<MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD;</MSFT:EditionAllowList>
|
||||
</MSFT:Applicability>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>AutopilotSelfdeploy</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Node for setting Autopilot self-deployment mode device account information. This information is stored and committed by the Autopilot client during the Enrollment Status Page phase of OOBE for Surface Hub devices that are using Autopilot self-deploying mode. These values should be set only during the first sync phase of enrollment and are ignored at any other time.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName />
|
||||
</DFType>
|
||||
<CaseSense>
|
||||
<CS />
|
||||
</CaseSense>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>UserPrincipalName</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>User principal name (UPN) of the device account. Autopilot on Surface Hub only supports Azure Active Directory, and this should specify the UPN of the device account. Get is allowed here but only returns a blank</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="None">
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Password</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Password for the device account. Get is allowed here, but will always return a blank.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="None">
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>FriendlyName</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>The device friendly name set during Autopilot self-deploying mode on Surface Hub. Get is allowed here but only returns a blank</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="None">
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DeviceAccount</NodeName>
|
||||
<DFProperties>
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the VPNv2 CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/28/2023
|
||||
ms.date: 04/26/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -2838,7 +2838,7 @@ True: Plumb traffic selectors as routes onto VPN interface, False: Do not plumb
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-Applicability-End -->
|
||||
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-OmaUri-Begin -->
|
||||
@ -2876,7 +2876,7 @@ True: Plumb traffic selectors as routes onto VPN interface, False: Do not plumb
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-Applicability-End -->
|
||||
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-OmaUri-Begin -->
|
||||
@ -2915,7 +2915,7 @@ List of inbox VPN protocols in priority order.
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Applicability-End -->
|
||||
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-OmaUri-Begin -->
|
||||
@ -2953,7 +2953,7 @@ List of inbox VPN protocols in priority order.
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Type-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Type-Applicability-End -->
|
||||
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Type-OmaUri-Begin -->
|
||||
@ -3003,7 +3003,7 @@ Inbox VPN protocols type.
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-RetryTimeInHours-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-RetryTimeInHours-Applicability-End -->
|
||||
|
||||
<!-- Device-{ProfileName}-NativeProfile-ProtocolList-RetryTimeInHours-OmaUri-Begin -->
|
||||
@ -7063,7 +7063,7 @@ True: Plumb traffic selectors as routes onto VPN interface, False: Do not plumb
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-Applicability-End -->
|
||||
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-OmaUri-Begin -->
|
||||
@ -7101,7 +7101,7 @@ True: Plumb traffic selectors as routes onto VPN interface, False: Do not plumb
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-Applicability-End -->
|
||||
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-OmaUri-Begin -->
|
||||
@ -7140,7 +7140,7 @@ List of inbox VPN protocols in priority order.
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Applicability-End -->
|
||||
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-OmaUri-Begin -->
|
||||
@ -7178,7 +7178,7 @@ List of inbox VPN protocols in priority order.
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Type-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Type-Applicability-End -->
|
||||
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-NativeProtocolList-{NativeProtocolRowId}-Type-OmaUri-Begin -->
|
||||
@ -7228,7 +7228,7 @@ Inbox VPN protocols type.
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-RetryTimeInHours-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20207] and later |
|
||||
| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.20207] and later |
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-RetryTimeInHours-Applicability-End -->
|
||||
|
||||
<!-- User-{ProfileName}-NativeProfile-ProtocolList-RetryTimeInHours-OmaUri-Begin -->
|
||||
@ -7893,7 +7893,7 @@ Boolean value (true or false) for caching credentials.
|
||||
<!-- User-{ProfileName}-RequireVpnClientAppUI-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.19628] and later |
|
||||
| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: [10.0.19628] and later |
|
||||
<!-- User-{ProfileName}-RequireVpnClientAppUI-Applicability-End -->
|
||||
|
||||
<!-- User-{ProfileName}-RequireVpnClientAppUI-OmaUri-Begin -->
|
||||
|
||||
@ -4,7 +4,7 @@ description: Learn more about the WindowsLicensing CSP.
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/28/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -28,12 +28,10 @@ The following list shows the WindowsLicensing configuration service provider nod
|
||||
- [ChangeProductKey](#changeproductkey)
|
||||
- [CheckApplicability](#checkapplicability)
|
||||
- [DeviceLicensingService](#devicelicensingservice)
|
||||
- [AcquireDeviceLicense](#devicelicensingserviceacquiredevicelicense)
|
||||
- [DeviceLicensingLastError](#devicelicensingservicedevicelicensinglasterror)
|
||||
- [DeviceLicensingLastErrorDescription](#devicelicensingservicedevicelicensinglasterrordescription)
|
||||
- [DeviceLicensingStatus](#devicelicensingservicedevicelicensingstatus)
|
||||
- [LicenseType](#devicelicensingservicelicensetype)
|
||||
- [RemoveDeviceLicense](#devicelicensingserviceremovedevicelicense)
|
||||
- [Edition](#edition)
|
||||
- [LicenseKeyType](#licensekeytype)
|
||||
- [SMode](#smode)
|
||||
@ -45,6 +43,12 @@ The following list shows the WindowsLicensing configuration service provider nod
|
||||
- [{SubscriptionId}](#subscriptionssubscriptionid)
|
||||
- [Name](#subscriptionssubscriptionidname)
|
||||
- [Status](#subscriptionssubscriptionidstatus)
|
||||
- [DisableSubscription](#subscriptionsdisablesubscription)
|
||||
- [RemoveSubscription](#subscriptionsremovesubscription)
|
||||
- [SubscriptionLastError](#subscriptionssubscriptionlasterror)
|
||||
- [SubscriptionLastErrorDescription](#subscriptionssubscriptionlasterrordescription)
|
||||
- [SubscriptionStatus](#subscriptionssubscriptionstatus)
|
||||
- [SubscriptionType](#subscriptionssubscriptiontype)
|
||||
- [UpgradeEditionWithLicense](#upgradeeditionwithlicense)
|
||||
- [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey)
|
||||
<!-- WindowsLicensing-Tree-End -->
|
||||
@ -167,7 +171,8 @@ Returns TRUE if the entered product key can be used for an edition upgrade of Wi
|
||||
<!-- Device-DeviceLicensingService-OmaUri-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-Description-Begin -->
|
||||
<!-- Description-Source-Not-Found -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Device Based Subscription.
|
||||
<!-- Device-DeviceLicensingService-Description-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-Editable-Begin -->
|
||||
@ -189,45 +194,6 @@ Returns TRUE if the entered product key can be used for an edition upgrade of Wi
|
||||
|
||||
<!-- Device-DeviceLicensingService-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Begin -->
|
||||
### DeviceLicensingService/AcquireDeviceLicense
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Applicability-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/DeviceLicensingService/AcquireDeviceLicense
|
||||
```
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-OmaUri-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Acquire and Refresh Device License. Does not reboot.
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Description-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Editable-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | null |
|
||||
| Access Type | Exec |
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-DFProperties-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-Examples-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-AcquireDeviceLicense-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-DeviceLicensingLastError-Begin -->
|
||||
### DeviceLicensingService/DeviceLicensingLastError
|
||||
|
||||
@ -375,7 +341,7 @@ License Type: User Based Subscription or Device Based Subscription.
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Add, Delete, Get, Replace |
|
||||
| Access Type | Get, Replace |
|
||||
<!-- Device-DeviceLicensingService-LicenseType-DFProperties-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-LicenseType-AllowedValues-Begin -->
|
||||
@ -393,45 +359,6 @@ License Type: User Based Subscription or Device Based Subscription.
|
||||
|
||||
<!-- Device-DeviceLicensingService-LicenseType-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Begin -->
|
||||
### DeviceLicensingService/RemoveDeviceLicense
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Applicability-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/DeviceLicensingService/RemoveDeviceLicense
|
||||
```
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-OmaUri-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Remove Device License. Device would be ready for user based license after this operation. Does not reboot.
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Description-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Editable-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | null |
|
||||
| Access Type | Exec |
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-DFProperties-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-Examples-End -->
|
||||
|
||||
<!-- Device-DeviceLicensingService-RemoveDeviceLicense-End -->
|
||||
|
||||
<!-- Device-Edition-Begin -->
|
||||
## Edition
|
||||
|
||||
@ -1064,6 +991,258 @@ Returns the status of the subscription.
|
||||
|
||||
<!-- Device-Subscriptions-{SubscriptionId}-Status-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-Begin -->
|
||||
### Subscriptions/DisableSubscription
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Subscriptions-DisableSubscription-Applicability-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/Subscriptions/DisableSubscription
|
||||
```
|
||||
<!-- Device-Subscriptions-DisableSubscription-OmaUri-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Disable or Enable subscription activation on a device.
|
||||
<!-- Device-Subscriptions-DisableSubscription-Description-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-DisableSubscription-Editable-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Replace |
|
||||
<!-- Device-Subscriptions-DisableSubscription-DFProperties-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | Enable Subscription. |
|
||||
| 1 | Disable Subscription. It also removes any existing subscription on the device. |
|
||||
<!-- Device-Subscriptions-DisableSubscription-AllowedValues-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-DisableSubscription-Examples-End -->
|
||||
|
||||
<!-- Device-Subscriptions-DisableSubscription-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Begin -->
|
||||
### Subscriptions/RemoveSubscription
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Applicability-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/Subscriptions/RemoveSubscription
|
||||
```
|
||||
<!-- Device-Subscriptions-RemoveSubscription-OmaUri-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Remove subscription uninstall subscription license. It also reset subscription type to User Based Subscription.
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Description-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Editable-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | null |
|
||||
| Access Type | Exec |
|
||||
<!-- Device-Subscriptions-RemoveSubscription-DFProperties-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-RemoveSubscription-Examples-End -->
|
||||
|
||||
<!-- Device-Subscriptions-RemoveSubscription-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Begin -->
|
||||
### Subscriptions/SubscriptionLastError
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Applicability-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/Subscriptions/SubscriptionLastError
|
||||
```
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-OmaUri-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Error code of last subscription operation. Value would be empty(0) in absence of error.
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Description-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Editable-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Get |
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-DFProperties-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-Examples-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastError-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Begin -->
|
||||
### Subscriptions/SubscriptionLastErrorDescription
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Applicability-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/Subscriptions/SubscriptionLastErrorDescription
|
||||
```
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-OmaUri-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Error description of last subscription operation. Value would be empty, if error description cannot be evaluated.
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Description-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Editable-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | chr (string) |
|
||||
| Access Type | Get |
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-DFProperties-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-Examples-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionLastErrorDescription-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Begin -->
|
||||
### Subscriptions/SubscriptionStatus
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Applicability-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/Subscriptions/SubscriptionStatus
|
||||
```
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-OmaUri-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Status of last subscription operation.
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Description-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Editable-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Get |
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-DFProperties-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-Examples-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionStatus-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-Begin -->
|
||||
### Subscriptions/SubscriptionType
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-Applicability-Begin -->
|
||||
| Scope | Editions | Applicable OS |
|
||||
|:--|:--|:--|
|
||||
| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
|
||||
<!-- Device-Subscriptions-SubscriptionType-Applicability-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-OmaUri-Begin -->
|
||||
```Device
|
||||
./Vendor/MSFT/WindowsLicensing/Subscriptions/SubscriptionType
|
||||
```
|
||||
<!-- Device-Subscriptions-SubscriptionType-OmaUri-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
Set device to Device Based Subscription or User Based Subscription. For Device Based Subscription this action will automatically acquire the subscription on the device. For User Based Subscription the existing process of user logon will be required.
|
||||
<!-- Device-Subscriptions-SubscriptionType-Description-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-Editable-Begin -->
|
||||
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionType-Editable-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-DFProperties-Begin -->
|
||||
**Description framework properties**:
|
||||
|
||||
| Property name | Property value |
|
||||
|:--|:--|
|
||||
| Format | int |
|
||||
| Access Type | Get, Replace |
|
||||
<!-- Device-Subscriptions-SubscriptionType-DFProperties-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-AllowedValues-Begin -->
|
||||
**Allowed values**:
|
||||
|
||||
| Value | Description |
|
||||
|:--|:--|
|
||||
| 0 | User Based Subscription. |
|
||||
| 1 | Device Based Subscription. |
|
||||
<!-- Device-Subscriptions-SubscriptionType-AllowedValues-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-Examples-Begin -->
|
||||
<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
|
||||
<!-- Device-Subscriptions-SubscriptionType-Examples-End -->
|
||||
|
||||
<!-- Device-Subscriptions-SubscriptionType-End -->
|
||||
|
||||
<!-- Device-UpgradeEditionWithLicense-Begin -->
|
||||
## UpgradeEditionWithLicense
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
|
||||
author: vinaypamnani-msft
|
||||
manager: aaroncz
|
||||
ms.author: vinpa
|
||||
ms.date: 02/17/2023
|
||||
ms.date: 05/01/2023
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-manage
|
||||
@ -322,6 +322,153 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SubscriptionType</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Set device to Device Based Subscription or User Based Subscription. For Device Based Subscription this action will automatically acquire the subscription on the device. For User Based Subscription the existing process of user logon will be required.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>User Based Subscription</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Device Based Subscription</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SubscriptionStatus</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Status of last subscription operation.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SubscriptionLastError</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Error code of last subscription operation. Value would be empty(0) in absence of error.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SubscriptionLastErrorDescription</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Error description of last subscription operation. Value would be empty, if error description cannot be evaluated.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DisableSubscription</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Disable or Enable subscription activation on a device</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
<MSFT:AllowedValues ValueType="ENUM">
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>0</MSFT:Value>
|
||||
<MSFT:ValueDescription>Enable Subscription</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
<MSFT:Enum>
|
||||
<MSFT:Value>1</MSFT:Value>
|
||||
<MSFT:ValueDescription>Disable Subscription. It also removes any existing subscription on the device.</MSFT:ValueDescription>
|
||||
</MSFT:Enum>
|
||||
</MSFT:AllowedValues>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>RemoveSubscription</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<Description>Remove subscription uninstall subscription license. It also reset subscription type to User Based Subscription.</Description>
|
||||
<DFFormat>
|
||||
<null />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SMode</NodeName>
|
||||
@ -439,7 +586,7 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Insert Description Here</Description>
|
||||
<Description>Device Based Subscription</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
@ -461,8 +608,6 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
<NodeName>LicenseType</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
@ -554,48 +699,6 @@ The following XML file contains the device description framework (DDF) for the W
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>AcquireDeviceLicense</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<Description>Acquire and Refresh Device License. Does not reboot.</Description>
|
||||
<DFFormat>
|
||||
<null />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>RemoveDeviceLicense</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<Description>Remove Device License. Device would be ready for user based license after this operation. Does not reboot.</Description>
|
||||
<DFFormat>
|
||||
<null />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME />
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</MgmtTree>
|
||||
|
||||
@ -92,7 +92,7 @@ There are several calculated values that appear on the Delivery Optimization rep
|
||||
In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded SHA256 hash. You can create a mapping of original to encoded GroupIDs using the following PowerShell example:
|
||||
|
||||
```powershell
|
||||
$text = "<myEncodedGroupID>" ;
|
||||
$text = "<myEncodedGroupID>`0"; (the null-terminator (`0) must be included in the string hash)
|
||||
|
||||
$hashObj = [System.Security.Cryptography.HashAlgorithm]::Create('sha256') ; $dig = $hashObj.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($text)) ; $digB64 = [System.Convert]::ToBase64String($dig) ; Write-Host "$text ==> $digB64"
|
||||
```
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Device registration overview
|
||||
description: This article provides an overview on how to register devices in Autopatch
|
||||
ms.date: 05/02/2023
|
||||
ms.date: 05/08/2023
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
@ -141,6 +141,9 @@ If your Autopatch groups have more than five deployment rings, and you must move
|
||||
|
||||
If you want to move devices to different deployment rings (either service or software update-based), after Windows Autopatch's deployment ring assignment, you can repeat the following steps for one or more devices from the **Registered** tab.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> You can only move devices in between deployment rings within the **same** Autopatch group. You can't move devices in between deployment rings across different Autopatch groups. If you try to select a device that belongs to one Autopatch group, and another device that belongs to a different Autopatch group, you'll receive the following error message on the top right corner of the Microsoft Intune portal: "**An error occurred. Please select devices within the same Autopatch group**.
|
||||
|
||||
**To move devices in between deployment rings:**
|
||||
|
||||
> [!NOTE]
|
||||
@ -150,7 +153,7 @@ If you want to move devices to different deployment rings (either service or sof
|
||||
1. In the **Windows Autopatch** section, select **Devices**.
|
||||
1. In the **Registered** tab, select one or more devices you want to assign. All selected devices will be assigned to the deployment ring you specify.
|
||||
1. Select **Device actions** from the menu.
|
||||
1. Select **Assign device group**. A fly-in opens.
|
||||
1. Select **Assign ring**. A fly-in opens.
|
||||
1. Use the dropdown menu to select the deployment ring to move devices to, and then select Save. The Ring assigned by column will change to Pending.
|
||||
1. When the assignment is complete, the **Ring assigned by** column changes to Admin (which indicates that you made the change) and the **Ring** column shows the new deployment ring assignment.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Manage Windows Autopatch groups
|
||||
description: This article explains how to manage Autopatch groups
|
||||
ms.date: 05/03/2023
|
||||
ms.date: 05/05/2023
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: how-to
|
||||
@ -46,8 +46,8 @@ Before you start managing Autopatch groups, ensure you’ve met the following pr
|
||||
- Windows Autopatch – Ring2
|
||||
- Windows Autopatch – Ring3
|
||||
- Windows Autopatch – Last
|
||||
- Additionally, **don't** modify the Azure AD group ownership of any of the groups above otherwise, Autopatch groups device registration process won't be able to add devices into these groups.
|
||||
- For more information, see [assign an owner of member of a group in Azure AD](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group) on how to remediate Azure Azure AD group ownership.
|
||||
- Additionally, **don't** modify the Azure AD group ownership of any of the groups above otherwise, Autopatch groups device registration process won't be able to add devices into these groups. If the ownership is modified, you must add the **Modern Workplace Management** Service Principal as the owner of these groups.
|
||||
- For more information, see [assign an owner or member of a group in Azure AD](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group) for steps on how to add owners to Azure Azure AD groups.
|
||||
- Make sure you have [app-only auth turned on in your Windows Autopatch tenant](../operate/windows-autopatch-maintain-environment.md#windows-autopatch-tenant-actions). Otherwise, the Autopatch groups functionality won’t work properly. Autopatch uses app-only auth to:
|
||||
- Read device attributes to successfully register devices.
|
||||
- Manage all configurations related to the operation of the service.
|
||||
@ -123,7 +123,11 @@ You **can’t** delete the Default Autopatch group. However, you can delete a Cu
|
||||
> [!CAUTION]
|
||||
> You can’t delete a Custom Autopatch group when it’s being used as part of one or more active or paused feature update releases. However, you can delete a Custom Autopatch group when the release for either Windows quality or feature updates have either the **Scheduled** or **Paused** statuses.
|
||||
|
||||
## Manage device conflict scenarios when Autopatch groups
|
||||
## Manage device conflict scenarios when using Autopatch groups
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The Windows Autopatch groups functionaliy is in **public preview**. This feature is being actively developed and not all device conflict detection and resolution scenarios are working as expected.
|
||||
> For more information on what to expect for this scenario during public preview, see [Known issues](#known-issues).
|
||||
|
||||
Overlap in device membership is a common scenario when working with device-based Azure AD groups since sometimes dynamic queries can be large in scope or the same assigned device membership can be used across different Azure AD groups.
|
||||
|
||||
@ -170,4 +174,48 @@ When you create or edit the Custom or Default Autopatch group, Windows Autopatch
|
||||
|
||||
#### Device conflict post device registration
|
||||
|
||||
Autopatch groups will keep monitoring for all device conflict scenarios listed in the [Manage device conflict scenarios when using Autopatch groups](#manage-device-conflict-scenarios-when-autopatch-groups) section even after devices were successfully registered with the service.
|
||||
Autopatch groups will keep monitoring for all device conflict scenarios listed in the [Manage device conflict scenarios when using Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#manage-device-conflict-scenarios-when-using-autopatch-groups) section even after devices were successfully registered with the service.
|
||||
|
||||
## Known issues
|
||||
|
||||
This section lists known issues with Autopatch groups during its public preview.
|
||||
|
||||
### Device conflict scenarios when using Autopatch groups
|
||||
|
||||
- **Status: Active**
|
||||
|
||||
The Windows Autopatch team is aware that all device conflict scenarios listed below are currently being evaluated during the device registration process to make sure devices are properly registered with the service, and not evaluated post-device registration. The Windows Autopatch team is currently developing detection and resolution for the followin device conflict scenarios, and plan to make them available during public preview.
|
||||
|
||||
- Default to Custom Autopatch device conflict detection and resolution.
|
||||
- Device conflict detection and resolution within an Autopatch group.
|
||||
- Custom to Custom Autopatch group device conflict detection.
|
||||
|
||||
> [!TIP]
|
||||
> Use the following two best practices to help minimize device conflict scenarios when using Autopatch groups during the public preview:
|
||||
>
|
||||
> - Review your software update deployment requirements thoroughly. If your deployment requirements allow, try using the Default Autopatch group as much as possible, instead of start creating Custom Autopatch groups. You can customize the Default Autopatch to have up to 15 deployment rings, and you can use your existing device-based Azure AD groups with custom update deployment cadences.
|
||||
> - If creating Custom Autopatch groups, try to avoid using device-based Azure AD groups that have device membership overlaps with the devices that are already registered with Windows Autopatch, and already belong to the Default Autopatch group.
|
||||
|
||||
### Autopatch group Azure AD group remediator
|
||||
|
||||
- **Status: Active**
|
||||
|
||||
The Windows Autopatch team is aware that the Windows Autopatch service isn't automatically restoring the Azure AD groups that get created during the Autopatch groups creation/editing process. If the following Azure AD groups, that belong to the Default Autopatch group and other Azure AD groups that get created with Custom Autopatch groups, are deleted or renamed, they won't be automatically remediated on your behalf yet:
|
||||
|
||||
- Windows Autopatch – Test
|
||||
- Windows Autopatch – Ring1
|
||||
- Windows Autopatch – Ring2
|
||||
- Windows Autopatch – Ring3
|
||||
- Windows Autopatch – Last
|
||||
|
||||
The Windows Autopatch team is currently developing the Autopatch group Azure AD group remediator feature and plan to make it available during public preview.
|
||||
|
||||
> [!NOTE]
|
||||
> The Autopatch group remediator won't remediate the service-based deployment rings:
|
||||
>
|
||||
> - Modern Workplace Devices-Windows Autopatch-Test
|
||||
> - Modern Workplace Devices-Windows Autopatch-First
|
||||
> - Modern Workplace Devices-Windows Autopatch-Fast
|
||||
> - Modern Workplace Devices-Windows Autopatch-Broad
|
||||
>
|
||||
> Use the [Policy health feature](../operate/windows-autopatch-policy-health-and-remediation.md) to restore these groups, if needed. For more information, see [restore deployment groups](../operate/windows-autopatch-policy-health-and-remediation.md#restore-deployment-groups).
|
||||
|
||||
@ -58,12 +58,12 @@ Alert resolutions are provided through the Windows Update service and provide th
|
||||
| `DeviceRegistrationInvalidGlobalDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Global Device ID. |The Windows Update service has reported that the MSA Service may be disabled preventing Global Device ID assignment.<p>Check that the MSA Service is running or able to run on device.</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DeviceRegistrationIssue` | The device isn't able to register or authenticate properly with Windows Update. | The Windows Update service has reported a device registration issue.<p>For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DeviceRegistrationNoTrustType` | The device isn't able to register or authenticate properly with Windows Update because it can't establish Trust. | The Windows Update service has reported a device registration issue.<p>For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DiskFull` | The installation couldn't be completed because the Windows partition is full. | The Windows Update service has reported there's insufficient disk space to perform the update. Free up disk space on the Windows partition and retry the installation.<p>For more information, see [Free up space for Windows Updates](/windows/free-up-space-for-windows-updates-429b12ba-f514-be0b-4924-ca6d16fa1d65#:~:text=Here%E2%80%99s%20how%20to%20get%20more%20storage%20space%20on,to%20Windows%20needs%20space%20to%20update.%20More%20items).</p> |
|
||||
| `DiskFull` | The installation couldn't be completed because the Windows partition is full. | The Windows Update service has reported there's insufficient disk space to perform the update. Free up disk space on the Windows partition and retry the installation.<p>For more information, see [Free up space for Windows Updates](https://support.microsoft.com/windows/free-up-space-for-windows-updates-429b12ba-f514-be0b-4924-ca6d16fa1d65).</p> |
|
||||
| `DownloadCancelled` | Windows Update couldn't download the update because the update server stopped the connection. | The Windows Update service has reported an issue with your update server. Validate your network is working and retry the download. If the alert persists, review your network configuration to make sure that this computer can access the internet.<p>For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).</p> |
|
||||
| `DownloadConnectionIssue` | Windows Update couldn't connect to the update server and the update couldn't download. | The Windows Update service has reported an issue connecting to Windows Update. Review your network configuration, and to make sure that this computer can access the internet and Windows Update Online.<p>For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DownloadCredentialsIssue` | Windows Update couldn't download the file because the Background Intelligent Transfer Service (BITS) couldn't connect to the internet. A proxy server or firewall on your network might require credentials. | The Windows Update service Windows has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client. Retry the download.<p>Review your network configuration to make sure that this computer can access the internet. Validate and/or allowlist Windows Update and Delivery Optimization endpoint.</p><p>For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DownloadCredentialsIssue` | Windows Update couldn't download the file because the Background Intelligent Transfer Service ([BITS](/windows/win32/bits/about-bits)) couldn't connect to the internet. A proxy server or firewall on your network might require credentials. | The Windows Update service Windows has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client. Retry the download.<p>Review your network configuration to make sure that this computer can access the internet. Validate and/or allowlist Windows Update and Delivery Optimization endpoint.</p><p>For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DownloadIssue` | There was an issue downloading the update. | The Windows Update service has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client.<p>For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).</p><p>If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DownloadIssueServiceDisabled` | There was a problem with the Background Intelligent Transfer Service (BITS). The BITS service or a service it depends on might be disabled. | The Windows Updates service has reported that the BITS service is disabled. In the local client services, make sure that the Background Intelligent Transfer Service is enabled. If the service isn't running, try starting it manually. For more information, see [Issues with BITS](/security-updates/WindowsUpdateServices/18127392).<p>If it will not start, check the event log for errors or [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DownloadIssueServiceDisabled` | There was a problem with the Background Intelligent Transfer Service (BITS). The BITS service or a service it depends on might be disabled. | The Windows Updates service has reported that the BITS service is disabled. In the local client services, make sure that the Background Intelligent Transfer Service is enabled. If the service isn't running, try starting it manually. For more information, see [Issues with BITS](/windows/win32/bits/about-bits).<p>If it will not start, check the event log for errors or [submit a support request](../operate/windows-autopatch-support-request.md).</p> |
|
||||
| `DownloadTimeout` | A timeout occurred while Windows tried to contact the update service or the server containing the update's payload. | The Windows Update service has reported it attempted to download the payload and the connection timed out.<p>Retry downloading the payload. If not successful, review your network configuration to make sure that this computer can access the internet.</p>For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5). |
|
||||
| `EndOfService` | The device is on a version of Windows that has passed its end of service date. | Windows Update service has reported the current version is past End of Service. Update device to a version that is currently serviced in [Feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).<p>For more information on OS versioning, see [Windows 10 release information](/windows/release-health/release-information).</p> |
|
||||
| `EndOfServiceApproaching` | The device is on a version of Windows that is approaching its end of service date. | Update device to a version that is currently serviced in [Feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).<p>For more information on OS versioning, see [Windows 10 release information](/windows/release-health/release-information).</p> |
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Manage Windows feature update releases
|
||||
description: This article explains how you can manage Windows feature updates with Autopatch groups
|
||||
ms.date: 05/01/2023
|
||||
ms.date: 05/05/2023
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
|
||||
@ -29,6 +29,9 @@ The policy setting has three components:
|
||||
|
||||
## Configure unlock factors
|
||||
|
||||
> [!CAUTION]
|
||||
> On Windows 11, when the [DontDisplayLastUserName](/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name) security policy is enabled, it is known to interfere with the ability to use multi factor unlock.
|
||||
|
||||
The **First unlock factor credential providers** and **Second unlock factor credential providers** portion of the policy setting each contain a comma separated list of credential providers.
|
||||
|
||||
Supported credential providers include:
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user