From 7268626854daaf8b68408f9f97081b92a7047db2 Mon Sep 17 00:00:00 2001 From: Liz Long <104389055+lizgt2000@users.noreply.github.com> Date: Thu, 5 Jan 2023 09:23:57 -0500 Subject: [PATCH] settingsync sharedfolders sharing shellcommandpromptregedittools --- .../mdm/policy-csp-admx-settingsync.md | 939 ++++++++++-------- .../mdm/policy-csp-admx-sharedfolders.md | 216 ++-- .../mdm/policy-csp-admx-sharing.md | 182 +++- ...csp-admx-shellcommandpromptregedittools.md | 420 ++++---- 4 files changed, 983 insertions(+), 774 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 116e79b9a4..45c357c51b 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -1,505 +1,594 @@ --- -title: Policy CSP - ADMX_SettingSync -description: Learn about Policy CSP - ADMX_SettingSync. +title: ADMX_SettingSync Policy CSP +description: Learn more about the ADMX_SettingSync Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/05/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 12/01/2020 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_SettingSync + > [!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - -
- - -## ADMX_SettingSync policies - -
-
- ADMX_SettingSync/DisableAppSyncSettingSync -
-
- ADMX_SettingSync/DisableApplicationSettingSync -
-
- ADMX_SettingSync/DisableCredentialsSettingSync -
-
- ADMX_SettingSync/DisableDesktopThemeSettingSync -
-
- ADMX_SettingSync/DisablePersonalizationSettingSync -
-
- ADMX_SettingSync/DisableSettingSync -
-
- ADMX_SettingSync/DisableStartLayoutSettingSync -
-
- ADMX_SettingSync/DisableSyncOnPaidNetwork -
-
- ADMX_SettingSync/DisableWindowsSettingSync -
-
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + + -
+ +## DisableApplicationSettingSync - -**ADMX_SettingSync/DisableAppSyncSettingSync** + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + - + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableApplicationSettingSync +``` + + + + +Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "app settings" group will not be synced. + +Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "app settings" group is on by default and configurable by the user. + + + + + + + +**Description framework properties**: -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: - -
+| Name | Value | +|:--|:--| +| Name | DisableApplicationSettingSync | +| Friendly Name | Do not sync app settings | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableApplicationSettingSync | +| ADMX File Name | SettingSync.admx | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + + + +## DisableAppSyncSettingSync -
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + - - -This policy setting prevents the "AppSync" group from syncing to and from this PC. This option turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableAppSyncSettingSync +``` + + + + +Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "AppSync" group will not be synced. + +Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "AppSync" group is on by default and configurable by the user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableAppSyncSettingSync | +| Friendly Name | Do not sync Apps | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableAppSyncSettingSync | +| ADMX File Name | SettingSync.admx | + -If you enable this policy setting, the "AppSync" group won't be synced. + + + + + + + +## DisableCredentialsSettingSync + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableCredentialsSettingSync +``` + + + + +Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "passwords" group will not be synced. + +Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "passwords" group is on by default and configurable by the user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableCredentialsSettingSync | +| Friendly Name | Do not sync passwords | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableCredentialsSettingSync | +| ADMX File Name | SettingSync.admx | + -Use the option "Allow users to turn app syncing on" so that syncing it is turned off by default but not disabled. - -If you don't set or disable this setting, syncing of the "AppSync" group is on by default and configurable by the user. - - - - - -ADMX Info: -- GP Friendly name: *Do not sync Apps* -- GP name: *DisableAppSyncSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* - - - -
- - -**ADMX_SettingSync/DisableApplicationSettingSync** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy seting prevents the "app settings" group from syncing to and from this PC. This option turns off and disables the "app settings" group on the "sync your settings" page in PC settings. - -If you enable this policy setting, the "app settings" group won't be synced. - -Use the option "Allow users to turn app settings syncing on" so that syncing it is turned off by default but not disabled. - -If you don't set or disable this setting, syncing of the "app settings" group is on by default and configurable by the user. - - - - - -ADMX Info: -- GP Friendly name: *Do not sync app settings* -- GP name: *DisableApplicationSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* - - - -
- - -**ADMX_SettingSync/DisableCredentialsSettingSync** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy seting prevents the "passwords" group from syncing to and from this PC. This option turns off and disables the "passwords" group on the "sync your settings" page in PC settings. - -If you enable this policy setting, the "passwords" group won't be synced. - -Use the option "Allow users to turn passwords syncing on" so that syncing it is turned off by default but not disabled. - -If you don't set or disable this setting, syncing of the "passwords" group is on by default and configurable by the user. - - - - - -ADMX Info: -- GP Friendly name: *Do not sync passwords* -- GP name: *DisableCredentialsSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* - - - -
- - -**ADMX_SettingSync/DisableDesktopThemeSettingSync** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting prevents the "desktop personalization" group from syncing to and from this PC. This option turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. - -If you enable this policy setting, the "desktop personalization" group won't be synced. - -Use the option "Allow users to turn desktop personalization syncing on" so that syncing it is turned off by default but not disabled. - -If you don't set or disable this setting, syncing of the "desktop personalization" group is on by default and configurable by the user. - - - - - -ADMX Info: -- GP Friendly name: *Do not sync desktop personalization* -- GP name: *DisableDesktopThemeSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* - - - -
- - -**ADMX_SettingSync/DisablePersonalizationSettingSync** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting prevents the "personalize" group from syncing to and from this PC. This option turns off and disables the "personalize" group on the "sync your settings" page in PC settings. - -If you enable this policy setting, the "personalize" group won't be synced. - -Use the option "Allow users to turn personalize syncing on" so that syncing it is turned off by default but not disabled. - -If you don't set or disable this setting, syncing of the "personalize" group is on by default and configurable by the user. - - - - - -ADMX Info: -- GP Friendly name: *Do not sync personalize* -- GP name: *DisablePersonalizationSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* - - - -
- - -**ADMX_SettingSync/DisableSettingSync** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting prevents syncing to and from this PC. This option turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. + + + + + + + +## DisableDesktopThemeSettingSync + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableDesktopThemeSettingSync +``` + + + + +Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "desktop personalization" group will not be synced. + +Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "desktop personalization" group is on by default and configurable by the user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableDesktopThemeSettingSync | +| Friendly Name | Do not sync desktop personalization | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableDesktopThemeSettingSync | +| ADMX File Name | SettingSync.admx | + + + + + + + + + +## DisablePersonalizationSettingSync + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisablePersonalizationSettingSync +``` + + + + +Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "personalize" group will not be synced. + +Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "personalize" group is on by default and configurable by the user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisablePersonalizationSettingSync | +| Friendly Name | Do not sync personalize | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisablePersonalizationSettingSync | +| ADMX File Name | SettingSync.admx | + + + + + + + + + +## DisableSettingSync + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableSettingSync +``` + + + + +Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. -Use the option "Allow users to turn syncing on" so that syncing it is turned off by default but not disabled. +Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled. -If you don't set or disable this setting, "sync your settings" is on by default and configurable by the user. +If you do not set or disable this setting, "sync your settings" is on by default and configurable by the user. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Do not sync* -- GP name: *DisableSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_SettingSync/DisableStartLayoutSettingSync** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | DisableSettingSync | +| Friendly Name | Do not sync | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableSettingSync | +| ADMX File Name | SettingSync.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DisableStartLayoutSettingSync -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableStartLayoutSettingSync +``` + - - -This policy setting prevents the "Start layout" group from syncing to and from this PC. This option turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. + + +Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. -If you enable this policy setting, the "Start layout" group won't be synced. +If you enable this policy setting, the "Start layout" group will not be synced. -Use the option "Allow users to turn on start syncing" so that syncing is turned off by default but not disabled. +Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled. -If you don't set or disable this setting, syncing of the "Start layout" group is on by default and configurable by the user. +If you do not set or disable this setting, syncing of the "Start layout" group is on by default and configurable by the user. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Do not sync start settings* -- GP name: *DisableStartLayoutSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_SettingSync/DisableSyncOnPaidNetwork** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | DisableStartLayoutSettingSync | +| Friendly Name | Do not sync start settings | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableStartLayoutSettingSync | +| ADMX File Name | SettingSync.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DisableSyncOnPaidNetwork -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableSyncOnPaidNetwork +``` + - - -This policy setting prevents syncing to and from this PC when on metered Internet connections. This option turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. + + +Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. -If you don't set or disable this setting, syncing on metered connections is configurable by the user. +If you do not set or disable this setting, syncing on metered connections is configurable by the user. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Do not sync on metered connections* -- GP name: *DisableSyncOnPaidNetwork* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_SettingSync/DisableWindowsSettingSync** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | DisableSyncOnPaidNetwork | +| Friendly Name | Do not sync on metered connections | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableSyncOnPaidNetwork | +| ADMX File Name | SettingSync.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DisableWindowsSettingSync -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_SettingSync/DisableWindowsSettingSync +``` + - - -This policy setting prevents the "Other Windows settings" group from syncing to and from this PC. This option turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. + + +Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. -If you enable this policy setting, the "Other Windows settings" group won't be synced. +If you enable this policy setting, the "Other Windows settings" group will not be synced. -Use the option "Allow users to turn other Windows settings syncing on" so that syncing it is turned off by default but not disabled. +Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled. -If you don't set or disable this setting, syncing of the "Other Windows settings" group is on by default and configurable by the user. +If you do not set or disable this setting, syncing of the "Other Windows settings" group is on by default and configurable by the user. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Do not sync other Windows settings* -- GP name: *DisableWindowsSettingSync* -- GP path: *Windows Components\Sync your settings* -- GP ADMX file name: *SettingSync.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | DisableWindowsSettingSync | +| Friendly Name | Do not sync other Windows settings | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableWindowsSettingSync | +| ADMX File Name | SettingSync.admx | + -## Related topics + + + -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 1aa619b1dc..92e980608b 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -1,146 +1,162 @@ --- -title: Policy CSP - ADMX_SharedFolders -description: Learn about Policy CSP - ADMX_SharedFolders. +title: ADMX_SharedFolders Policy CSP +description: Learn more about the ADMX_SharedFolders Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/05/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 09/21/2020 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_SharedFolders + > [!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
+ + + - -## ADMX_SharedFolders policies + +## PublishDfsRoots -
-
- ADMX_SharedFolders/PublishDfsRoots -
-
- ADMX_SharedFolders/PublishSharedFolders -
-
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```User +./User/Vendor/MSFT/Policy/Config/ADMX_SharedFolders/PublishDfsRoots +``` + - -**ADMX_SharedFolders/PublishDfsRoots** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - + + This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS). -If you enable or don't configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. -> [!NOTE] -> The default is to allow shared folders to be published when this setting is not configured. +**Note**: The default is to allow shared folders to be published when this setting is not configured. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Allow DFS roots to be published* -- GP name: *PublishDfsRoots* -- GP path: *Shared Folders* -- GP ADMX file name: *SharedFolders.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -
+**ADMX mapping**: - -**ADMX_SharedFolders/PublishSharedFolders** +| Name | Value | +|:--|:--| +| Name | PublishDfsRoots | +| Friendly Name | Allow DFS roots to be published | +| Location | User Configuration | +| Path | Shared Folders | +| Registry Key Name | Software\Policies\Microsoft\Windows NT\SharedFolders | +| Registry Value Name | PublishDfsRoots | +| ADMX File Name | SharedFolders.admx | + - + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## PublishSharedFolders - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -> [!div class = "checklist"] -> * User + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_SharedFolders/PublishSharedFolders +``` + -
- - - + + This policy setting determines whether the user can publish shared folders in Active Directory Domain Services (AD DS). -If you enable or don't configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. -If you disable this policy setting, users can't publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. +If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. -> [!NOTE] -> The default is to allow shared folders to be published when this setting is not configured. +**Note**: The default is to allow shared folders to be published when this setting is not configured. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Allow shared folders to be published* -- GP name: *PublishSharedFolders* -- GP path: *Shared Folders* -- GP ADMX file name: *SharedFolders.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +**ADMX mapping**: +| Name | Value | +|:--|:--| +| Name | PublishSharedFolders | +| Friendly Name | Allow shared folders to be published | +| Location | User Configuration | +| Path | Shared Folders | +| Registry Key Name | Software\Policies\Microsoft\Windows NT\SharedFolders | +| Registry Value Name | PublishSharedFolders | +| ADMX File Name | SharedFolders.admx | + - + + + -## Related topics + -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md index 7b02e8d272..1a0e859eda 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharing.md +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -1,88 +1,162 @@ --- -title: Policy CSP - ADMX_Sharing -description: Learn about Policy CSP - ADMX_Sharing. +title: ADMX_Sharing Policy CSP +description: Learn more about the ADMX_Sharing Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/05/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 09/21/2020 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_Sharing + > [!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
+ + + - -## ADMX_Sharing policies + +## DisableHomeGroup -
-
- ADMX_Sharing/NoInplaceSharing -
-
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_Sharing/DisableHomeGroup +``` + - -**ADMX_Sharing/NoInplaceSharing** + + +This policy setting specifies whether users can add computers to a homegroup. By default, users can add their computer to a homegroup on a private network. - +If you enable this policy setting, users cannot add computers to a homegroup. This policy setting does not affect other network sharing features. -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +If you disable or do not configure this policy setting, users can add computers to a homegroup. However, data on a domain-joined computer is not shared with the homegroup. - -
+This policy setting is not configured by default. - -[Scope](./policy-configuration-service-provider.md#policy-scope): +You must restart the computer for this policy setting to take effect. + -> [!div class = "checklist"] -> * User + + + -
+ +**Description framework properties**: - - -This policy setting specifies whether users can share files within their profile. By default, users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -If you enable this policy setting, users can't share files within their profile using the sharing wizard. Also, the sharing wizard can't create a share at %root%\users and can only be used to create SMB shares on folders. + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableHomeGroup | +| Friendly Name | Prevent the computer from joining a homegroup | +| Location | Computer Configuration | +| Path | Windows Components > HomeGroup | +| Registry Key Name | Software\Policies\Microsoft\Windows\HomeGroup | +| Registry Value Name | DisableHomeGroup | +| ADMX File Name | Sharing.admx | + + + + + + + + + +## NoInplaceSharing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_Sharing/NoInplaceSharing +``` + + + + +This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. + +If you enable this policy setting, users cannot share files within their profile using the sharing wizard. Also, the sharing wizard cannot create a share at %root%\users and can only be used to create SMB shares on folders. If you disable or don't configure this policy setting, users can share files out of their user profile after an administrator has opted in the computer. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Prevent users from sharing files within their profile.* -- GP name: *NoInplaceSharing* -- GP path: *Windows Components\Network Sharing* -- GP ADMX file name: *Sharing.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | NoInplaceSharing | +| Friendly Name | Prevent users from sharing files within their profile. | +| Location | User Configuration | +| Path | Windows Components > Network Sharing | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | +| Registry Value Name | NoInplaceSharing | +| ADMX File Name | Sharing.admx | + -## Related topics + + + -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index 0329365c45..e13b8bc97f 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -1,260 +1,290 @@ --- -title: Policy CSP - ADMX_ShellCommandPromptRegEditTools -description: Learn about Policy CSP - ADMX_ShellCommandPromptRegEditTools. +title: ADMX_ShellCommandPromptRegEditTools Policy CSP +description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/05/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 09/18/2020 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_ShellCommandPromptRegEditTools -
- - -## ADMX_ShellCommandPromptRegEditTools policies - > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
-
- ADMX_ShellCommandPromptRegEditTools/DisallowApps -
-
- ADMX_ShellCommandPromptRegEditTools/DisableRegedit -
-
- ADMX_ShellCommandPromptRegEditTools/DisableCMD -
-
- ADMX_ShellCommandPromptRegEditTools/RestrictApps -
-
+ + + + +## DisableCMD -
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + - -**ADMX_ShellCommandPromptRegEditTools/DisallowApps** + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_ShellCommandPromptRegEditTools/DisableCMD +``` + - + + +This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer. -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action. - -
+If you disable this policy setting or do not configure it, users can run Cmd.exe and batch files normally. - -[Scope](./policy-configuration-service-provider.md#policy-scope): +Note: Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Remote Desktop Services. + -> [!div class = "checklist"] -> * User + + + -
+ +**Description framework properties**: - - -This policy setting prevents users from running the interactive command prompt `Cmd.exe`. +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -This policy setting also determines whether batch files (.cmd and .bat) can run on the computer. + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action. . +**ADMX mapping**: -If you disable this policy setting or don't configure it, users can run Cmd.exe and batch files normally. +| Name | Value | +|:--|:--| +| Name | DisableCMD | +| Friendly Name | Prevent access to the command prompt | +| Location | User Configuration | +| Path | System | +| Registry Key Name | Software\Policies\Microsoft\Windows\System | +| ADMX File Name | Shell-CommandPrompt-RegEditTools.admx | + -> [!NOTE] -> Don't prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Remote Desktop Services. + + + + - + +## DisableRegedit + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + - -ADMX Info: -- GP Friendly name: *Prevent access to the command prompt* -- GP name: *DisallowApps* -- GP path: *System* -- GP ADMX file name: *ShellCommandPromptRegEditTools.admx* + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_ShellCommandPromptRegEditTools/DisableRegedit +``` + - - -
+ + +Disables the Windows registry editor Regedit.exe. +If you enable this policy setting and the user tries to start Regedit.exe, a message appears explaining that a policy setting prevents the action. - -**ADMX_ShellCommandPromptRegEditTools/DisableRegedit** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - -This policy setting disables the Windows registry editor `Regedit.exe`. - -If you enable this policy setting and the user tries to start `Regedit.exe`, a message appears explaining that a policy setting prevents the action. - -If you disable this policy setting or don't configure it, users can run `Regedit.exe` normally. +If you disable this policy setting or do not configure it, users can run Regedit.exe normally. To prevent users from using other administrative tools, use the "Run only specified Windows applications" policy setting. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Prevent access to registry editing tools* -- GP name: *DisableRegedit* -- GP path: *System\Server Manager* -- GP ADMX file name: *ShellCommandPromptRegEditTools.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_ShellCommandPromptRegEditTools/DisableCMD** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | DisableRegedit | +| Friendly Name | Prevent access to registry editing tools | +| Location | User Configuration | +| Path | System | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| ADMX File Name | Shell-CommandPrompt-RegEditTools.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DisallowApps -> [!div class = "checklist"] -> * User + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```User +./User/Vendor/MSFT/Policy/Config/ADMX_ShellCommandPromptRegEditTools/DisallowApps +``` + - - -This policy setting limits the Windows programs that users have permission to run on the computer. + + +Prevents Windows from running the programs you specify in this policy setting. + +If you enable this policy setting, users cannot run programs that you add to the list of disallowed applications. + +If you disable this policy setting or do not configure it, users can run any programs. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +Note: Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisallowApps | +| Friendly Name | Don't run specified Windows applications | +| Location | User Configuration | +| Path | System | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | +| Registry Value Name | DisallowRun | +| ADMX File Name | Shell-CommandPrompt-RegEditTools.admx | + + + + + + + + + +## RestrictApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_ShellCommandPromptRegEditTools/RestrictApps +``` + + + + +Limits the Windows programs that users have permission to run on the computer. If you enable this policy setting, users can only run programs that you add to the list of allowed applications. -If you disable this policy setting or don't configure it, users can run all applications. This policy setting only prevents users from running programs that are started by the File Explorer process. +If you disable this policy setting or do not configure it, users can run all applications. -It doesn't prevent users from running programs such as Task Manager, which is started by the system process or by other processes. Also, if users have access to the command prompt `Cmd.exe`, this policy setting doesn't prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. -Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +Note: Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). + -To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + + - + +**Description framework properties**: +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - -ADMX Info: -- GP Friendly name: *Run only specified Windows applications* -- GP name: *DisableCMD* -- GP path: *System* -- GP ADMX file name: *ShellCommandPromptRegEditTools.admx* + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - - -
+**ADMX mapping**: - -**ADMX_ShellCommandPromptRegEditTools/RestrictApps** +| Name | Value | +|:--|:--| +| Name | RestrictApps | +| Friendly Name | Run only specified Windows applications | +| Location | User Configuration | +| Path | System | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | +| Registry Value Name | RestrictRun | +| ADMX File Name | Shell-CommandPrompt-RegEditTools.admx | + - + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ + + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + -> [!div class = "checklist"] -> * User +## Related articles -
- - - -This policy setting prevents Windows from running the programs you specify in this policy setting. - -If you enable this policy setting, users can't run programs that you add to the list of disallowed applications. - -If you disable this policy setting or don't configure it, users can run any programs. - -This policy setting only prevents users from running programs that are started by the File Explorer process. It doesn't prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting doesn't prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. - -Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. - -To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). - - - - - - -ADMX Info: -- GP Friendly name: *Don't run specified Windows applications* -- GP name: *RestrictApps* -- GP path: *System* -- GP ADMX file name: *ShellCommandPromptRegEditTools.admx* - - - - - - -## Related topics - -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) +[Policy configuration service provider](policy-configuration-service-provider.md)