Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech.
@@ -96,6 +128,7 @@ ms.date: 08/30/2017
+
Specifies whether to allow toast notifications above the device lock screen.
diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md
index f2e678427b..cbec351d99 100644
--- a/windows/client-management/mdm/policy-csp-accounts.md
+++ b/windows/client-management/mdm/policy-csp-accounts.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Accounts
@@ -14,11 +14,27 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Specifies whether user is allowed to add non-MSA email accounts.
@@ -60,6 +85,7 @@ ms.date: 08/30/2017
+
Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services.
@@ -98,6 +133,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service.
@@ -134,6 +179,7 @@ ms.date: 08/30/2017
+
Specifies a list of the domains that are allowed to sync email on the device.
diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md
index 755aeb5a2e..d01ca2a458 100644
--- a/windows/client-management/mdm/policy-csp-activexcontrols.md
+++ b/windows/client-management/mdm/policy-csp-activexcontrols.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - ActiveXControls
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Added in Windows 10, version 1703. This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml), and then needs to be base64 encoded before being added to SyncML.
diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md
index db13ecc123..7953580ab4 100644
--- a/windows/client-management/mdm/policy-csp-applicationmanagement.md
+++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - ApplicationManagement
@@ -14,11 +14,48 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Specifies whether non Windows Store apps are allowed.
@@ -58,6 +104,7 @@ ms.date: 08/30/2017
+
Specifies whether automatic update of apps from Windows Store are allowed.
@@ -96,6 +152,7 @@ ms.date: 08/30/2017
+
Specifies whether developer unlock is allowed.
@@ -135,6 +201,7 @@ ms.date: 08/30/2017
+
Specifies whether multiple users of the same app can share data.
@@ -214,6 +300,7 @@ ms.date: 08/30/2017
+
Specifies whether app store is allowed at the device.
@@ -252,6 +348,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Windows Store that came pre-installed or were downloaded.
@@ -341,6 +457,7 @@ ms.date: 08/30/2017
+
Allows disabling of the retail catalog and only enables the Private store.
@@ -388,6 +514,7 @@ ms.date: 08/30/2017
+
Specifies whether application data is restricted to the system drive.
@@ -426,6 +562,7 @@ ms.date: 08/30/2017
+
Specifies whether the installation of applications is restricted to the system drive.
diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md
index e44fda0b34..512cbecf60 100644
--- a/windows/client-management/mdm/policy-csp-appvirtualization.md
+++ b/windows/client-management/mdm/policy-csp-appvirtualization.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - AppVirtualization
@@ -14,11 +14,99 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.
@@ -55,6 +80,7 @@ ms.date: 09/06/2017
+
Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources.
@@ -98,6 +133,7 @@ ms.date: 09/06/2017
+
Allows EAP Fast Reconnect from being attempted for EAP Method TLS.
@@ -136,6 +181,7 @@ ms.date: 09/06/2017
+
Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows.
diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md
index daac26b55d..f63666cdc6 100644
--- a/windows/client-management/mdm/policy-csp-autoplay.md
+++ b/windows/client-management/mdm/policy-csp-autoplay.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Autoplay
@@ -14,11 +14,24 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Specifies the BitLocker Drive Encryption method and cipher strength.
diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md
index 7bd2ea4992..d874f9ffa2 100644
--- a/windows/client-management/mdm/policy-csp-bluetooth.md
+++ b/windows/client-management/mdm/policy-csp-bluetooth.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Bluetooth
@@ -14,11 +14,30 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Specifies whether the device can send out Bluetooth advertisements.
@@ -59,6 +87,7 @@ ms.date: 08/30/2017
+
Specifies whether other Bluetooth-enabled devices can discover the device.
@@ -99,6 +137,7 @@ ms.date: 08/30/2017
+
Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device.
@@ -135,6 +183,7 @@ ms.date: 08/30/2017
+
Sets the local Bluetooth device name.
@@ -170,6 +228,7 @@ ms.date: 08/30/2017
+
Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}.
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index 82c992e8eb..2c7f399858 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Browser
@@ -14,11 +14,123 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Added in Windows 10, version 1703. Specifies whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality.
@@ -60,6 +182,7 @@ ms.date: 08/30/2017
+
Specifies whether autofill on websites is allowed.
@@ -105,6 +238,7 @@ ms.date: 08/30/2017
+
Specifies whether cookies are allowed.
@@ -194,6 +349,7 @@ ms.date: 08/30/2017
+
Specifies whether Do Not Track headers are allowed.
@@ -281,6 +458,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1607. Specifies whether Microsoft Edge extensions are allowed.
@@ -317,6 +505,7 @@ ms.date: 08/30/2017
+
Added in Windows 10. Specifies whether Adobe Flash can run in Microsoft Edge.
@@ -353,6 +552,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1703. Specifies whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash.
@@ -389,6 +599,7 @@ ms.date: 08/30/2017
+
Specifies whether InPrivate browsing is allowed on corporate networks.
@@ -427,6 +648,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1703. Specifies whether to use the Microsoft compatibility list in Microsoft Edge. The Microsoft compatibility list is a Microsoft-provided list that enables sites with known compatibility issues to display properly.
By default, the Microsoft compatibility list is enabled and can be viewed by visiting "about:compat".
@@ -468,6 +700,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Specifies whether saving and managing passwords locally on the device is allowed.
@@ -513,6 +756,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Specifies whether pop-up blocker is allowed or enabled.
@@ -558,6 +812,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Added in Windows 10, version 1703. Allows search engine customization for MDM-enrolled devices. Users can change their default search engine.
@@ -598,6 +863,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Specifies whether search suggestions are allowed in the address bar.
@@ -636,6 +912,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Specifies whether Windows Defender SmartScreen is allowed.
@@ -681,9 +968,20 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
@@ -691,6 +989,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Added in Windows 10, version 1703. Specifies whether to clear browsing data on exiting Microsoft Edge.
@@ -735,6 +1044,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
+
Added in Windows 10, version 1703. Allows you to add up to 5 additional search engines for MDM-enrolled devices.
@@ -781,6 +1101,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1703. Boolean value that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when the Browser/HomePages policy is in effect.
@@ -825,6 +1156,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1709. This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge.
@@ -1022,6 +1408,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Specifies whether users can access the about:flags page, which is used to change developer settings and to enable experimental features.
@@ -1058,6 +1455,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1703. Specifies whether to enable or disable the First Run webpage. On the first explicit user-launch of Microsoft Edge, a First Run webpage hosted on Microsoft.com opens automatically via a FWLINK. This policy allows enterprises (such as those enrolled in a zero-emissions configuration) to prevent this page from opening.
@@ -1096,6 +1504,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1703. Specifies whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge.
@@ -1134,6 +1553,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Specifies whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites.
@@ -1172,6 +1602,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Specifies whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from downloading unverified files. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about unverified files and lets them continue the download process.
@@ -1208,6 +1649,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1709. This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Edge and use that html file for provisioning user machines.
@@ -1292,6 +1755,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1703. Allows you configure the default search engine for your employees. By default, your employees can change the default search engine at any time. If you want to prevent your employees from changing the default search engine that you set, you can do so by configuring the AllowSearchEngineCustomization policy.
@@ -1379,6 +1864,7 @@ Employees cannot remove these search engines, but they can set any one as the de
+
Added in Windows 10, version 1703. Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering.
diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md
index ca7b98ecc5..ce33fa4faa 100644
--- a/windows/client-management/mdm/policy-csp-camera.md
+++ b/windows/client-management/mdm/policy-csp-camera.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Camera
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Disables or enables the camera.
diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md
index b1c206e118..183748ec41 100644
--- a/windows/client-management/mdm/policy-csp-cellular.md
+++ b/windows/client-management/mdm/policy-csp-cellular.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Cellular
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
Allows the user to enable Bluetooth or restrict access.
@@ -64,6 +116,7 @@ ms.date: 08/30/2017
+
Allows the cellular data channel on the device. Device reboot is not required to enforce the policy.
@@ -101,6 +163,7 @@ ms.date: 08/30/2017
+
Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy.
@@ -148,6 +220,7 @@ ms.date: 08/30/2017
+
Specifies what type of underlying connections VPN is allowed to use.
@@ -311,6 +423,7 @@ ms.date: 08/30/2017
+
Prevents the device from connecting to VPN when the device roams over cellular networks.
@@ -349,6 +471,7 @@ ms.date: 08/30/2017
+
Allows or disallows the Federal Information Processing Standard (FIPS) policy.
@@ -55,6 +74,7 @@ ms.date: 08/30/2017
+
Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win.
diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md
index edba750722..1261f2c311 100644
--- a/windows/client-management/mdm/policy-csp-dataprotection.md
+++ b/windows/client-management/mdm/policy-csp-dataprotection.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - DataProtection
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host plug PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug PCI ports with no children devices until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged. This policy setting is only enforced when BitLocker or device encryption is enabled.
@@ -57,6 +76,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer. Supported values:
@@ -55,6 +77,7 @@ ms.date: 08/30/2017
+
Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer. Supported values:
@@ -93,6 +125,7 @@ ms.date: 08/30/2017
+
diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md
index 4b04c4567d..c57bc0a0a1 100644
--- a/windows/client-management/mdm/policy-csp-deviceinstallation.md
+++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - DeviceInstallation
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## DeviceInstallation policies
+
+ -
+ DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
+
+ -
+ DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
+
+
+
+
**DeviceInstallation/PreventInstallationOfMatchingDeviceIDs**
@@ -45,6 +55,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
@@ -69,6 +88,7 @@ ADMX Info:
+
**DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses**
@@ -95,6 +115,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md
index dcfc34f488..4767db8c6f 100644
--- a/windows/client-management/mdm/policy-csp-devicelock.md
+++ b/windows/client-management/mdm/policy-csp-devicelock.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - DeviceLock
@@ -14,11 +14,63 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## DeviceLock policies
+
+ -
+ DeviceLock/AllowIdleReturnWithoutPassword
+
+ -
+ DeviceLock/AllowScreenTimeoutWhileLockedUserConfig
+
+ -
+ DeviceLock/AllowSimpleDevicePassword
+
+ -
+ DeviceLock/AlphanumericDevicePasswordRequired
+
+ -
+ DeviceLock/DevicePasswordEnabled
+
+ -
+ DeviceLock/DevicePasswordExpiration
+
+ -
+ DeviceLock/DevicePasswordHistory
+
+ -
+ DeviceLock/EnforceLockScreenAndLogonImage
+
+ -
+ DeviceLock/EnforceLockScreenProvider
+
+ -
+ DeviceLock/MaxDevicePasswordFailedAttempts
+
+ -
+ DeviceLock/MaxInactivityTimeDeviceLock
+
+ -
+ DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
+
+ -
+ DeviceLock/MinDevicePasswordComplexCharacters
+
+ -
+ DeviceLock/MinDevicePasswordLength
+
+ -
+ DeviceLock/PreventLockScreenSlideShow
+
+ -
+ DeviceLock/ScreenTimeoutWhileLocked
+
+
+
+
**DeviceLock/AllowIdleReturnWithoutPassword**
@@ -45,6 +97,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -63,6 +124,7 @@ ms.date: 08/30/2017
+
**DeviceLock/AllowScreenTimeoutWhileLockedUserConfig**
@@ -89,6 +151,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -110,6 +181,7 @@ ms.date: 08/30/2017
+
**DeviceLock/AllowSimpleDevicePassword**
@@ -136,6 +208,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords.
@@ -152,6 +233,7 @@ ms.date: 08/30/2017
+
**DeviceLock/AlphanumericDevicePasswordRequired**
@@ -178,6 +260,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Determines the type of PIN or password required. This policy only applies if the **DeviceLock/DevicePasswordEnabled** policy is set to 0 (required).
@@ -202,6 +293,7 @@ ms.date: 08/30/2017
+
**DeviceLock/DevicePasswordEnabled**
@@ -228,6 +320,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether device lock is enabled.
@@ -278,6 +379,7 @@ ms.date: 08/30/2017
+
**DeviceLock/DevicePasswordExpiration**
@@ -304,6 +406,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies when the password expires (in days).
@@ -322,6 +433,7 @@ ms.date: 08/30/2017
+
**DeviceLock/DevicePasswordHistory**
@@ -348,6 +460,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies how many passwords can be stored in the history that can’t be used.
@@ -368,6 +489,7 @@ ms.date: 08/30/2017
+
**DeviceLock/EnforceLockScreenAndLogonImage**
@@ -394,6 +516,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies the default lock screen and logon image shown when no user is signed in. It also sets the specified image for all users, which replaces the default image. The same image is used for both the lock and logon screens. Users will not be able to change this image.
@@ -405,6 +536,7 @@ ms.date: 08/30/2017
+
**DeviceLock/EnforceLockScreenProvider**
@@ -431,6 +563,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider.
@@ -442,6 +583,7 @@ ms.date: 08/30/2017
+
**DeviceLock/MaxDevicePasswordFailedAttempts**
@@ -468,6 +610,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality.
@@ -493,6 +644,7 @@ The number of authentication failures allowed before the device will be wiped. A
+
**DeviceLock/MaxInactivityTimeDeviceLock**
@@ -519,6 +671,15 @@ The number of authentication failures allowed before the device will be wiped. A
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. Note the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy.
@@ -535,6 +696,7 @@ The number of authentication failures allowed before the device will be wiped. A
+
**DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay**
@@ -561,6 +723,15 @@ The number of authentication failures allowed before the device will be wiped. A
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display.
@@ -575,6 +746,7 @@ The number of authentication failures allowed before the device will be wiped. A
+
**DeviceLock/MinDevicePasswordComplexCharacters**
@@ -601,6 +773,15 @@ The number of authentication failures allowed before the device will be wiped. A
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password.
@@ -677,6 +858,7 @@ The number of authentication failures allowed before the device will be wiped. A
+
**DeviceLock/MinDevicePasswordLength**
@@ -703,6 +885,15 @@ The number of authentication failures allowed before the device will be wiped. A
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies the minimum number or characters required in the PIN or password.
@@ -724,6 +915,7 @@ The number of authentication failures allowed before the device will be wiped. A
+
**DeviceLock/PreventLockScreenSlideShow**
@@ -750,6 +942,15 @@ The number of authentication failures allowed before the device will be wiped. A
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.
@@ -774,6 +975,7 @@ ADMX Info:
+
**DeviceLock/ScreenTimeoutWhileLocked**
@@ -800,6 +1002,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md
index 7af8189ba0..43c616c9a7 100644
--- a/windows/client-management/mdm/policy-csp-display.md
+++ b/windows/client-management/mdm/policy-csp-display.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Display
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Display policies
+
+ -
+ Display/TurnOffGdiDPIScalingForApps
+
+ -
+ Display/TurnOnGdiDPIScalingForApps
+
+
+
+
**Display/TurnOffGdiDPIScalingForApps**
@@ -45,6 +55,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
@@ -63,6 +82,7 @@ ms.date: 08/30/2017
+
**Display/TurnOnGdiDPIScalingForApps**
@@ -89,6 +109,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md
index 6be666c341..dcb33c8647 100644
--- a/windows/client-management/mdm/policy-csp-education.md
+++ b/windows/client-management/mdm/policy-csp-education.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Education
@@ -14,11 +14,24 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Education policies
+
+ -
+ Education/DefaultPrinterName
+
+ -
+ Education/PreventAddingNewPrinters
+
+ -
+ Education/PrinterNames
+
+
+
+
**Education/DefaultPrinterName**
@@ -45,6 +58,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1709. This policy allows IT Admins to set the user's default printer.
@@ -52,6 +74,7 @@ The policy value is expected to be the name (network host name) of an installed
+
**Education/PreventAddingNewPrinters**
@@ -78,6 +101,15 @@ The policy value is expected to be the name (network host name) of an installed
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1709. Allows IT Admins to prevent user installation of additional printers from the printers settings.
@@ -88,6 +120,7 @@ The following list shows the supported values:
+
**Education/PrinterNames**
@@ -114,6 +147,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names).
diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
index c11c6d066d..6f3068b82d 100644
--- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
+++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - EnterpriseCloudPrint
@@ -14,11 +14,33 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## EnterpriseCloudPrint policies
+
+ -
+ EnterpriseCloudPrint/CloudPrintOAuthAuthority
+
+ -
+ EnterpriseCloudPrint/CloudPrintOAuthClientId
+
+ -
+ EnterpriseCloudPrint/CloudPrintResourceId
+
+ -
+ EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
+
+ -
+ EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
+
+ -
+ EnterpriseCloudPrint/MopriaDiscoveryResourceId
+
+
+
+
**EnterpriseCloudPrint/CloudPrintOAuthAuthority**
@@ -45,6 +67,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. This policy must target ./User, otherwise it fails.
@@ -54,6 +85,7 @@ ms.date: 08/30/2017
+
**EnterpriseCloudPrint/CloudPrintOAuthClientId**
@@ -80,6 +112,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. This policy must target ./User, otherwise it fails.
@@ -89,6 +130,7 @@ ms.date: 08/30/2017
+
**EnterpriseCloudPrint/CloudPrintResourceId**
@@ -115,6 +157,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. This policy must target ./User, otherwise it fails.
@@ -124,6 +175,7 @@ ms.date: 08/30/2017
+
**EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint**
@@ -150,6 +202,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. This policy must target ./User, otherwise it fails.
@@ -159,6 +220,7 @@ ms.date: 08/30/2017
+
**EnterpriseCloudPrint/DiscoveryMaxPrinterLimit**
@@ -185,6 +247,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. This policy must target ./User, otherwise it fails.
@@ -194,6 +265,7 @@ ms.date: 08/30/2017
+
**EnterpriseCloudPrint/MopriaDiscoveryResourceId**
@@ -220,6 +292,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. This policy must target ./User, otherwise it fails.
diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md
index 98c03c6579..c86f76ed58 100644
--- a/windows/client-management/mdm/policy-csp-errorreporting.md
+++ b/windows/client-management/mdm/policy-csp-errorreporting.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - ErrorReporting
@@ -14,11 +14,30 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## ErrorReporting policies
+
+ -
+ ErrorReporting/CustomizeConsentSettings
+
+ -
+ ErrorReporting/DisableWindowsErrorReporting
+
+ -
+ ErrorReporting/DisplayErrorNotification
+
+ -
+ ErrorReporting/DoNotSendAdditionalData
+
+ -
+ ErrorReporting/PreventCriticalErrorDisplay
+
+
+
+
**ErrorReporting/CustomizeConsentSettings**
@@ -45,6 +64,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting determines the consent behavior of Windows Error Reporting for specific event types.
@@ -79,6 +107,7 @@ ADMX Info:
+
**ErrorReporting/DisableWindowsErrorReporting**
@@ -105,6 +134,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails.
@@ -129,6 +167,7 @@ ADMX Info:
+
**ErrorReporting/DisplayErrorNotification**
@@ -155,6 +194,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls whether users are shown an error dialog box that lets them report an error.
@@ -183,6 +231,7 @@ ADMX Info:
+
**ErrorReporting/DoNotSendAdditionalData**
@@ -209,6 +258,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically.
@@ -233,6 +291,7 @@ ADMX Info:
+
**ErrorReporting/PreventCriticalErrorDisplay**
@@ -259,6 +318,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting prevents the display of the user interface for critical errors.
diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md
index a73f5c2b18..60434439fa 100644
--- a/windows/client-management/mdm/policy-csp-eventlogservice.md
+++ b/windows/client-management/mdm/policy-csp-eventlogservice.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - EventLogService
@@ -14,11 +14,27 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## EventLogService policies
+
+ -
+ EventLogService/ControlEventLogBehavior
+
+ -
+ EventLogService/SpecifyMaximumFileSizeApplicationLog
+
+ -
+ EventLogService/SpecifyMaximumFileSizeSecurityLog
+
+ -
+ EventLogService/SpecifyMaximumFileSizeSystemLog
+
+
+
+
**EventLogService/ControlEventLogBehavior**
@@ -45,6 +61,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls Event Log behavior when the log file reaches its maximum size.
@@ -71,6 +96,7 @@ ADMX Info:
+
**EventLogService/SpecifyMaximumFileSizeApplicationLog**
@@ -97,6 +123,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies the maximum size of the log file in kilobytes.
@@ -121,6 +156,7 @@ ADMX Info:
+
**EventLogService/SpecifyMaximumFileSizeSecurityLog**
@@ -147,6 +183,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies the maximum size of the log file in kilobytes.
@@ -171,6 +216,7 @@ ADMX Info:
+
**EventLogService/SpecifyMaximumFileSizeSystemLog**
@@ -197,6 +243,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies the maximum size of the log file in kilobytes.
diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md
index b5e7a8bfe2..4dfcea0e83 100644
--- a/windows/client-management/mdm/policy-csp-experience.md
+++ b/windows/client-management/mdm/policy-csp-experience.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Experience
@@ -14,11 +14,72 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Experience policies
+
+ -
+ Experience/AllowCopyPaste
+
+ -
+ Experience/AllowCortana
+
+ -
+ Experience/AllowDeviceDiscovery
+
+ -
+ Experience/AllowFindMyDevice
+
+ -
+ Experience/AllowManualMDMUnenrollment
+
+ -
+ Experience/AllowSIMErrorDialogPromptWhenNoSIM
+
+ -
+ Experience/AllowScreenCapture
+
+ -
+ Experience/AllowSyncMySettings
+
+ -
+ Experience/AllowTailoredExperiencesWithDiagnosticData
+
+ -
+ Experience/AllowTaskSwitcher
+
+ -
+ Experience/AllowThirdPartySuggestionsInWindowsSpotlight
+
+ -
+ Experience/AllowVoiceRecording
+
+ -
+ Experience/AllowWindowsConsumerFeatures
+
+ -
+ Experience/AllowWindowsSpotlight
+
+ -
+ Experience/AllowWindowsSpotlightOnActionCenter
+
+ -
+ Experience/AllowWindowsSpotlightWindowsWelcomeExperience
+
+ -
+ Experience/AllowWindowsTips
+
+ -
+ Experience/ConfigureWindowsSpotlightOnLockScreen
+
+ -
+ Experience/DoNotShowFeedbackNotifications
+
+
+
+
**Experience/AllowCopyPaste**
@@ -45,6 +106,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -60,6 +130,7 @@ ms.date: 08/30/2017
+
**Experience/AllowCortana**
@@ -86,6 +157,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether Cortana is allowed on the device. If you enable or don’t configure this setting, Cortana is allowed on the device. If you disable this setting, Cortana is turned off. When Cortana is off, users will still be able to use search to find items on the device.
@@ -106,6 +186,7 @@ ms.date: 08/30/2017
+
**Experience/AllowDeviceDiscovery**
@@ -132,6 +213,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows users to turn on/off device discovery UX.
@@ -146,6 +236,7 @@ ms.date: 08/30/2017
+
**Experience/AllowFindMyDevice**
@@ -172,6 +263,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy turns on Find My Device.
@@ -186,6 +286,7 @@ ms.date: 08/30/2017
+
**Experience/AllowManualMDMUnenrollment**
@@ -212,6 +313,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to allow the user to delete the workplace account using the workplace control panel.
@@ -228,6 +338,7 @@ ms.date: 08/30/2017
+
**Experience/AllowSIMErrorDialogPromptWhenNoSIM**
@@ -254,6 +365,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -268,6 +388,7 @@ ms.date: 08/30/2017
+
**Experience/AllowScreenCapture**
@@ -294,6 +415,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -310,6 +440,7 @@ ms.date: 08/30/2017
+
**Experience/AllowSyncMySettings**
@@ -336,6 +467,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices).
@@ -346,6 +486,7 @@ ms.date: 08/30/2017
+
**Experience/AllowTailoredExperiencesWithDiagnosticData**
@@ -372,6 +513,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -391,6 +541,7 @@ ms.date: 08/30/2017
+
**Experience/AllowTaskSwitcher**
@@ -417,6 +568,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -431,6 +591,7 @@ ms.date: 08/30/2017
+
**Experience/AllowThirdPartySuggestionsInWindowsSpotlight**
@@ -457,6 +618,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only available for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education.
@@ -471,6 +641,7 @@ ms.date: 08/30/2017
+
**Experience/AllowVoiceRecording**
@@ -497,6 +668,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -513,6 +693,7 @@ ms.date: 08/30/2017
+
**Experience/AllowWindowsConsumerFeatures**
@@ -539,6 +720,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -562,6 +752,7 @@ ms.date: 08/30/2017
+
**Experience/AllowWindowsSpotlight**
@@ -588,6 +779,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only available for Windows 10 Enterprise and Windows 10 Education.
@@ -604,6 +804,7 @@ ms.date: 08/30/2017
+
**Experience/AllowWindowsSpotlightOnActionCenter**
@@ -630,6 +831,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -645,6 +855,7 @@ ms.date: 08/30/2017
+
**Experience/AllowWindowsSpotlightWindowsWelcomeExperience**
@@ -671,6 +882,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -687,6 +907,7 @@ The Windows welcome experience feature introduces onboard users to Windows; for
+
**Experience/AllowWindowsTips**
@@ -713,6 +934,15 @@ The Windows welcome experience feature introduces onboard users to Windows; for
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Enables or disables Windows Tips / soft landing.
@@ -723,6 +953,7 @@ Enables or disables Windows Tips / soft landing.
+
**Experience/ConfigureWindowsSpotlightOnLockScreen**
@@ -749,6 +980,15 @@ Enables or disables Windows Tips / soft landing.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!NOTE]
> This policy is only available for Windows 10 Enterprise and Windows 10 Education.
@@ -764,6 +1004,7 @@ Enables or disables Windows Tips / soft landing.
+
**Experience/DoNotShowFeedbackNotifications**
@@ -790,6 +1031,15 @@ Enables or disables Windows Tips / soft landing.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Prevents devices from showing feedback questions from Microsoft.
diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md
index 292dfa31bc..f408206e83 100644
--- a/windows/client-management/mdm/policy-csp-exploitguard.md
+++ b/windows/client-management/mdm/policy-csp-exploitguard.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - ExploitGuard
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## ExploitGuard policies
+
+ -
+ ExploitGuard/ExploitProtectionSettings
+
+
+
+
**ExploitGuard/ExploitProtectionSettings**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml).
diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md
index f6fc32cc9f..868f23aa8e 100644
--- a/windows/client-management/mdm/policy-csp-games.md
+++ b/windows/client-management/mdm/policy-csp-games.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/31/2017
+ms.date: 09/29/2017
---
# Policy CSP - Games
@@ -14,11 +14,18 @@ ms.date: 08/31/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Games policies
+
+ -
+ Games/AllowAdvancedGamingServices
+
+
+
+
**Games/AllowAdvancedGamingServices**
@@ -45,6 +52,15 @@ ms.date: 08/31/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. Value type is integer.
@@ -52,6 +68,7 @@ ms.date: 08/31/2017
- 1 (default) - Allowed
This policy can only be turned off in Windows 10 Education and Enterprise editions.
+
diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md
index b2cdcd1ae0..e00909e922 100644
--- a/windows/client-management/mdm/policy-csp-handwriting.md
+++ b/windows/client-management/mdm/policy-csp-handwriting.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 09/07/2017
+ms.date: 09/29/2017
---
# Policy CSP - Handwriting
@@ -14,11 +14,18 @@ ms.date: 09/07/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
-## Handwriting policies
+
+## Handwriting policies
+
+ -
+ Handwriting/PanelDefaultModeDocked
+
+
+
+
**Handwriting/PanelDefaultModeDocked**
@@ -45,6 +52,15 @@ ms.date: 09/07/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10. version 1709. This policy allows an enterprise to configure the default mode for the handwriting panel.
@@ -69,4 +85,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
\ No newline at end of file
+
+
diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md
index 7be92bcfc1..1a97e52c6c 100644
--- a/windows/client-management/mdm/policy-csp-internetexplorer.md
+++ b/windows/client-management/mdm/policy-csp-internetexplorer.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - InternetExplorer
@@ -14,11 +14,771 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## InternetExplorer policies
+
+ -
+ InternetExplorer/AddSearchProvider
+
+ -
+ InternetExplorer/AllowActiveXFiltering
+
+ -
+ InternetExplorer/AllowAddOnList
+
+ -
+ InternetExplorer/AllowAutoComplete
+
+ -
+ InternetExplorer/AllowCertificateAddressMismatchWarning
+
+ -
+ InternetExplorer/AllowDeletingBrowsingHistoryOnExit
+
+ -
+ InternetExplorer/AllowEnhancedProtectedMode
+
+ -
+ InternetExplorer/AllowEnterpriseModeFromToolsMenu
+
+ -
+ InternetExplorer/AllowEnterpriseModeSiteList
+
+ -
+ InternetExplorer/AllowFallbackToSSL3
+
+ -
+ InternetExplorer/AllowInternetExplorer7PolicyList
+
+ -
+ InternetExplorer/AllowInternetExplorerStandardsMode
+
+ -
+ InternetExplorer/AllowInternetZoneTemplate
+
+ -
+ InternetExplorer/AllowIntranetZoneTemplate
+
+ -
+ InternetExplorer/AllowLocalMachineZoneTemplate
+
+ -
+ InternetExplorer/AllowLockedDownInternetZoneTemplate
+
+ -
+ InternetExplorer/AllowLockedDownIntranetZoneTemplate
+
+ -
+ InternetExplorer/AllowLockedDownLocalMachineZoneTemplate
+
+ -
+ InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate
+
+ -
+ InternetExplorer/AllowOneWordEntry
+
+ -
+ InternetExplorer/AllowSiteToZoneAssignmentList
+
+ -
+ InternetExplorer/AllowSoftwareWhenSignatureIsInvalid
+
+ -
+ InternetExplorer/AllowSuggestedSites
+
+ -
+ InternetExplorer/AllowTrustedSitesZoneTemplate
+
+ -
+ InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate
+
+ -
+ InternetExplorer/AllowsRestrictedSitesZoneTemplate
+
+ -
+ InternetExplorer/CheckServerCertificateRevocation
+
+ -
+ InternetExplorer/CheckSignaturesOnDownloadedPrograms
+
+ -
+ InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses
+
+ -
+ InternetExplorer/DisableAdobeFlash
+
+ -
+ InternetExplorer/DisableBlockingOfOutdatedActiveXControls
+
+ -
+ InternetExplorer/DisableBypassOfSmartScreenWarnings
+
+ -
+ InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles
+
+ -
+ InternetExplorer/DisableConfiguringHistory
+
+ -
+ InternetExplorer/DisableCrashDetection
+
+ -
+ InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation
+
+ -
+ InternetExplorer/DisableDeletingUserVisitedWebsites
+
+ -
+ InternetExplorer/DisableEnclosureDownloading
+
+ -
+ InternetExplorer/DisableEncryptionSupport
+
+ -
+ InternetExplorer/DisableFirstRunWizard
+
+ -
+ InternetExplorer/DisableFlipAheadFeature
+
+ -
+ InternetExplorer/DisableHomePageChange
+
+ -
+ InternetExplorer/DisableIgnoringCertificateErrors
+
+ -
+ InternetExplorer/DisableInPrivateBrowsing
+
+ -
+ InternetExplorer/DisableProcessesInEnhancedProtectedMode
+
+ -
+ InternetExplorer/DisableProxyChange
+
+ -
+ InternetExplorer/DisableSearchProviderChange
+
+ -
+ InternetExplorer/DisableSecondaryHomePageChange
+
+ -
+ InternetExplorer/DisableSecuritySettingsCheck
+
+ -
+ InternetExplorer/DisableUpdateCheck
+
+ -
+ InternetExplorer/DoNotAllowActiveXControlsInProtectedMode
+
+ -
+ InternetExplorer/DoNotAllowUsersToAddSites
+
+ -
+ InternetExplorer/DoNotAllowUsersToChangePolicies
+
+ -
+ InternetExplorer/DoNotBlockOutdatedActiveXControls
+
+ -
+ InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains
+
+ -
+ InternetExplorer/IncludeAllLocalSites
+
+ -
+ InternetExplorer/IncludeAllNetworkPaths
+
+ -
+ InternetExplorer/InternetZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/InternetZoneAllowCopyPasteViaScript
+
+ -
+ InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles
+
+ -
+ InternetExplorer/InternetZoneAllowFontDownloads
+
+ -
+ InternetExplorer/InternetZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles
+
+ -
+ InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls
+
+ -
+ InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl
+
+ -
+ InternetExplorer/InternetZoneAllowScriptInitiatedWindows
+
+ -
+ InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls
+
+ -
+ InternetExplorer/InternetZoneAllowScriptlets
+
+ -
+ InternetExplorer/InternetZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript
+
+ -
+ InternetExplorer/InternetZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls
+
+ -
+ InternetExplorer/InternetZoneDownloadSignedActiveXControls
+
+ -
+ InternetExplorer/InternetZoneDownloadUnsignedActiveXControls
+
+ -
+ InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter
+
+ -
+ InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows
+
+ -
+ InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows
+
+ -
+ InternetExplorer/InternetZoneEnableMIMESniffing
+
+ -
+ InternetExplorer/InternetZoneEnableProtectedMode
+
+ -
+ InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer
+
+ -
+ InternetExplorer/InternetZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe
+
+ -
+ InternetExplorer/InternetZoneJavaPermissions
+
+ -
+ InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME
+
+ -
+ InternetExplorer/InternetZoneLogonOptions
+
+ -
+ InternetExplorer/InternetZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsNotSignedWithAuthenticode
+
+ -
+ InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode
+
+ -
+ InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles
+
+ -
+ InternetExplorer/InternetZoneUsePopupBlocker
+
+ -
+ InternetExplorer/InternetZoneWebsitesInLessPrivilegedZonesCanNavigateIntoThisZone
+
+ -
+ InternetExplorer/IntranetZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/IntranetZoneAllowFontDownloads
+
+ -
+ InternetExplorer/IntranetZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/IntranetZoneAllowScriptlets
+
+ -
+ InternetExplorer/IntranetZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/IntranetZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls
+
+ -
+ InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe
+
+ -
+ InternetExplorer/IntranetZoneJavaPermissions
+
+ -
+ InternetExplorer/IntranetZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/LocalMachineZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/LocalMachineZoneAllowFontDownloads
+
+ -
+ InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/LocalMachineZoneAllowScriptlets
+
+ -
+ InternetExplorer/LocalMachineZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/LocalMachineZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls
+
+ -
+ InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/LocalMachineZoneJavaPermissions
+
+ -
+ InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowFontDownloads
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowScriptlets
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/LockedDownInternetZoneJavaPermissions
+
+ -
+ InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowFontDownloads
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowScriptlets
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneJavaPermissions
+
+ -
+ InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions
+
+ -
+ InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions
+
+ -
+ InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses
+
+ -
+ InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses
+
+ -
+ InternetExplorer/NotificationBarInternetExplorerProcesses
+
+ -
+ InternetExplorer/PreventManagingSmartScreenFilter
+
+ -
+ InternetExplorer/PreventPerUserInstallationOfActiveXControls
+
+ -
+ InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses
+
+ -
+ InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls
+
+ -
+ InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses
+
+ -
+ InternetExplorer/RestrictFileDownloadInternetExplorerProcesses
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowActiveScripting
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowFileDownloads
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowFontDownloads
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowScriptlets
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript
+
+ -
+ InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter
+
+ -
+ InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows
+
+ -
+ InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows
+
+ -
+ InternetExplorer/RestrictedSitesZoneEnableMIMESniffing
+
+ -
+ InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer
+
+ -
+ InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/RestrictedSitesZoneJavaPermissions
+
+ -
+ InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME
+
+ -
+ InternetExplorer/RestrictedSitesZoneLogonOptions
+
+ -
+ InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames
+
+ -
+ InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFramesAcrossDomains
+
+ -
+ InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins
+
+ -
+ InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode
+
+ -
+ InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting
+
+ -
+ InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets
+
+ -
+ InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles
+
+ -
+ InternetExplorer/RestrictedSitesZoneTurnOnCrossSiteScriptingFilter
+
+ -
+ InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode
+
+ -
+ InternetExplorer/RestrictedSitesZoneUsePopupBlocker
+
+ -
+ InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses
+
+ -
+ InternetExplorer/SearchProviderList
+
+ -
+ InternetExplorer/SecurityZonesUseOnlyMachineSettings
+
+ -
+ InternetExplorer/SpecifyUseOfActiveXInstallerService
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowAccessToDataSources
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowFontDownloads
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowScriptlets
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowSmartScreenIE
+
+ -
+ InternetExplorer/TrustedSitesZoneAllowUserDataPersistence
+
+ -
+ InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls
+
+ -
+ InternetExplorer/TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls
+
+ -
+ InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls
+
+ -
+ InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe
+
+ -
+ InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe
+
+ -
+ InternetExplorer/TrustedSitesZoneJavaPermissions
+
+ -
+ InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames
+
+
+
+
**InternetExplorer/AddSearchProvider**
@@ -45,6 +805,16 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website.
@@ -69,6 +839,7 @@ ADMX Info:
+
**InternetExplorer/AllowActiveXFiltering**
@@ -95,6 +866,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls the ActiveX Filtering feature for websites that are running ActiveX controls. The user can choose to turn off ActiveX Filtering for specific websites so that ActiveX controls can run properly.
@@ -119,6 +900,7 @@ ADMX Info:
+
**InternetExplorer/AllowAddOnList**
@@ -145,6 +927,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and Browser Helper Objects (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.
@@ -175,6 +967,7 @@ ADMX Info:
+
**InternetExplorer/AllowAutoComplete**
@@ -201,6 +994,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
> [!TIP]
@@ -219,6 +1021,7 @@ ADMX Info:
+
**InternetExplorer/AllowCertificateAddressMismatchWarning**
@@ -245,6 +1048,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -263,6 +1076,7 @@ ADMX Info:
+
**InternetExplorer/AllowDeletingBrowsingHistoryOnExit**
@@ -289,6 +1103,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -307,6 +1131,7 @@ ADMX Info:
+
**InternetExplorer/AllowEnhancedProtectedMode**
@@ -333,6 +1158,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system.
@@ -359,6 +1194,7 @@ ADMX Info:
+
**InternetExplorer/AllowEnterpriseModeFromToolsMenu**
@@ -385,6 +1221,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the Tools menu.
@@ -409,6 +1255,7 @@ ADMX Info:
+
**InternetExplorer/AllowEnterpriseModeSiteList**
@@ -435,6 +1282,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode IE, instead of Standard mode, because of compatibility issues. Users can't edit this list.
@@ -459,6 +1316,7 @@ ADMX Info:
+
**InternetExplorer/AllowFallbackToSSL3**
@@ -485,6 +1343,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -503,6 +1370,7 @@ ADMX Info:
+
**InternetExplorer/AllowInternetExplorer7PolicyList**
@@ -529,6 +1397,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View.
@@ -553,6 +1431,7 @@ ADMX Info:
+
**InternetExplorer/AllowInternetExplorerStandardsMode**
@@ -579,6 +1458,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls how Internet Explorer displays local intranet content. Intranet content is defined as any webpage that belongs to the local intranet security zone.
@@ -605,6 +1494,7 @@ ADMX Info:
+
**InternetExplorer/AllowInternetZoneTemplate**
@@ -631,6 +1521,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -661,6 +1561,7 @@ ADMX Info:
+
**InternetExplorer/AllowIntranetZoneTemplate**
@@ -687,6 +1588,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -717,6 +1628,7 @@ ADMX Info:
+
**InternetExplorer/AllowLocalMachineZoneTemplate**
@@ -743,6 +1655,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -773,6 +1695,7 @@ ADMX Info:
+
**InternetExplorer/AllowLockedDownInternetZoneTemplate**
@@ -799,6 +1722,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -829,6 +1762,7 @@ ADMX Info:
+
**InternetExplorer/AllowLockedDownIntranetZoneTemplate**
@@ -855,6 +1789,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -885,6 +1829,7 @@ ADMX Info:
+
**InternetExplorer/AllowLockedDownLocalMachineZoneTemplate**
@@ -911,6 +1856,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -941,6 +1896,7 @@ ADMX Info:
+
**InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate**
@@ -967,6 +1923,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -997,6 +1963,7 @@ ADMX Info:
+
**InternetExplorer/AllowOneWordEntry**
@@ -1023,6 +1990,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy allows the user to go directly to an intranet site for a one-word entry in the Address bar.
@@ -1047,6 +2024,7 @@ ADMX Info:
+
**InternetExplorer/AllowSiteToZoneAssignmentList**
@@ -1073,6 +2051,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.
@@ -1103,6 +2091,7 @@ ADMX Info:
+
**InternetExplorer/AllowSoftwareWhenSignatureIsInvalid**
@@ -1129,6 +2118,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1147,6 +2146,7 @@ ADMX Info:
+
**InternetExplorer/AllowSuggestedSites**
@@ -1173,6 +2173,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls the Suggested Sites feature, which recommends websites based on the users browsing activity. Suggested Sites reports a users browsing history to Microsoft to suggest sites that the user might want to visit.
@@ -1199,6 +2209,7 @@ ADMX Info:
+
**InternetExplorer/AllowTrustedSitesZoneTemplate**
@@ -1225,6 +2236,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -1255,6 +2276,7 @@ ADMX Info:
+
**InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate**
@@ -1281,6 +2303,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -1311,6 +2343,7 @@ ADMX Info:
+
**InternetExplorer/AllowsRestrictedSitesZoneTemplate**
@@ -1337,6 +2370,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
@@ -1367,6 +2410,7 @@ ADMX Info:
+
**InternetExplorer/CheckServerCertificateRevocation**
@@ -1393,6 +2437,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1411,6 +2465,7 @@ ADMX Info:
+
**InternetExplorer/CheckSignaturesOnDownloadedPrograms**
@@ -1437,6 +2492,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1455,6 +2520,7 @@ ADMX Info:
+
**InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses**
@@ -1481,6 +2547,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1499,6 +2575,7 @@ ADMX Info:
+
**InternetExplorer/DisableAdobeFlash**
@@ -1525,6 +2602,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting turns off Adobe Flash in Internet Explorer and prevents applications from using Internet Explorer technology to instantiate Flash objects.
@@ -1551,6 +2638,7 @@ ADMX Info:
+
**InternetExplorer/DisableBlockingOfOutdatedActiveXControls**
@@ -1577,6 +2665,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1595,6 +2693,7 @@ ADMX Info:
+
**InternetExplorer/DisableBypassOfSmartScreenWarnings**
@@ -1621,6 +2720,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious.
@@ -1645,6 +2754,7 @@ ADMX Info:
+
**InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles**
@@ -1671,6 +2781,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the Internet.
@@ -1695,6 +2815,7 @@ ADMX Info:
+
**InternetExplorer/DisableConfiguringHistory**
@@ -1721,6 +2842,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1739,6 +2870,7 @@ ADMX Info:
+
**InternetExplorer/DisableCrashDetection**
@@ -1765,6 +2897,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1783,6 +2925,7 @@ ADMX Info:
+
**InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation**
@@ -1809,6 +2952,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting prevents the user from participating in the Customer Experience Improvement Program (CEIP).
@@ -1835,6 +2988,7 @@ ADMX Info:
+
**InternetExplorer/DisableDeletingUserVisitedWebsites**
@@ -1861,6 +3015,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -1879,6 +3043,7 @@ ADMX Info:
+
**InternetExplorer/DisableEnclosureDownloading**
@@ -1905,6 +3070,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user's computer.
@@ -1929,6 +3104,7 @@ ADMX Info:
+
**InternetExplorer/DisableEncryptionSupport**
@@ -1955,6 +3131,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each others list of supported protocols and versions, and they select the most preferred match.
@@ -1981,6 +3167,7 @@ ADMX Info:
+
**InternetExplorer/DisableFirstRunWizard**
@@ -2007,6 +3194,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
@@ -2035,6 +3232,7 @@ ADMX Info:
+
**InternetExplorer/DisableFlipAheadFeature**
@@ -2061,6 +3259,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.
@@ -2089,6 +3297,7 @@ ADMX Info:
+
**InternetExplorer/DisableHomePageChange**
@@ -2115,6 +3324,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
The Home page specified on the General tab of the Internet Options dialog box is the default Web page that Internet Explorer loads whenever it is run.
@@ -2139,6 +3357,7 @@ ADMX Info:
+
**InternetExplorer/DisableIgnoringCertificateErrors**
@@ -2165,6 +3384,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -2183,6 +3412,7 @@ ADMX Info:
+
**InternetExplorer/DisableInPrivateBrowsing**
@@ -2209,6 +3439,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -2227,6 +3467,7 @@ ADMX Info:
+
**InternetExplorer/DisableProcessesInEnhancedProtectedMode**
@@ -2253,6 +3494,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -2271,6 +3522,7 @@ ADMX Info:
+
**InternetExplorer/DisableProxyChange**
@@ -2297,6 +3549,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting specifies if a user can change proxy settings.
@@ -2321,6 +3583,7 @@ ADMX Info:
+
**InternetExplorer/DisableSearchProviderChange**
@@ -2347,6 +3610,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting prevents the user from changing the default search provider for the Address bar and the toolbar Search box.
@@ -2371,6 +3644,7 @@ ADMX Info:
+
**InternetExplorer/DisableSecondaryHomePageChange**
@@ -2397,6 +3671,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.
@@ -2423,6 +3707,7 @@ ADMX Info:
+
**InternetExplorer/DisableSecuritySettingsCheck**
@@ -2449,6 +3734,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -2467,6 +3762,7 @@ ADMX Info:
+
**InternetExplorer/DisableUpdateCheck**
@@ -2493,6 +3789,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Prevents Internet Explorer from checking whether a new version of the browser is available.
@@ -2519,6 +3824,7 @@ ADMX Info:
+
**InternetExplorer/DoNotAllowActiveXControlsInProtectedMode**
@@ -2545,6 +3851,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -2563,6 +3879,7 @@ ADMX Info:
+
**InternetExplorer/DoNotAllowUsersToAddSites**
@@ -2589,6 +3906,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.
@@ -2619,6 +3945,7 @@ ADMX Info:
+
**InternetExplorer/DoNotAllowUsersToChangePolicies**
@@ -2645,6 +3972,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.
@@ -2675,6 +4011,7 @@ ADMX Info:
+
**InternetExplorer/DoNotBlockOutdatedActiveXControls**
@@ -2701,6 +4038,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether Internet Explorer blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.
@@ -2727,6 +4074,7 @@ ADMX Info:
+
**InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains**
@@ -2753,6 +4101,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage a list of domains on which Internet Explorer will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.
@@ -2783,6 +4141,7 @@ ADMX Info:
+
**InternetExplorer/IncludeAllLocalSites**
@@ -2809,6 +4168,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.
@@ -2835,6 +4204,7 @@ ADMX Info:
+
**InternetExplorer/IncludeAllNetworkPaths**
@@ -2861,6 +4231,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.
@@ -2887,6 +4267,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowAccessToDataSources**
@@ -2913,6 +4294,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -2939,6 +4330,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls**
@@ -2965,6 +4357,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -2991,6 +4393,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads**
@@ -3017,6 +4420,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -3041,6 +4454,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowCopyPasteViaScript**
@@ -3067,6 +4481,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3085,6 +4509,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles**
@@ -3111,6 +4536,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3129,6 +4564,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowFontDownloads**
@@ -3155,6 +4591,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -3181,6 +4627,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowLessPrivilegedSites**
@@ -3207,6 +4654,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
@@ -3233,6 +4690,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles**
@@ -3259,6 +4717,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3277,6 +4745,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents**
@@ -3303,6 +4772,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -3329,6 +4808,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls**
@@ -3355,6 +4835,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3373,6 +4863,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl**
@@ -3399,6 +4890,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3417,6 +4918,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowScriptInitiatedWindows**
@@ -3443,6 +4945,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3461,6 +4973,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls**
@@ -3487,6 +5000,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3505,6 +5028,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowScriptlets**
@@ -3531,6 +5055,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -3557,6 +5091,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowSmartScreenIE**
@@ -3583,6 +5118,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -3611,6 +5156,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript**
@@ -3637,6 +5183,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3655,6 +5211,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneAllowUserDataPersistence**
@@ -3681,6 +5238,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -3707,6 +5274,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls**
@@ -3733,6 +5301,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3751,6 +5329,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneDownloadSignedActiveXControls**
@@ -3777,6 +5356,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3795,6 +5384,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneDownloadUnsignedActiveXControls**
@@ -3821,6 +5411,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3839,6 +5439,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter**
@@ -3865,6 +5466,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3883,6 +5494,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows**
@@ -3909,6 +5521,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3927,6 +5549,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows**
@@ -3953,6 +5576,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -3971,6 +5604,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneEnableMIMESniffing**
@@ -3997,6 +5631,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4015,6 +5659,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneEnableProtectedMode**
@@ -4041,6 +5686,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4059,6 +5714,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer**
@@ -4085,6 +5741,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4103,6 +5769,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneInitializeAndScriptActiveXControls**
@@ -4129,6 +5796,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -4157,6 +5834,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe**
@@ -4186,6 +5864,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneJavaPermissions**
@@ -4212,6 +5891,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4230,6 +5919,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME**
@@ -4256,6 +5946,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4274,6 +5974,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneLogonOptions**
@@ -4300,6 +6001,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4318,6 +6029,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneNavigateWindowsAndFrames**
@@ -4344,6 +6056,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -4370,6 +6092,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsNotSignedWithAuthenticode**
@@ -4396,6 +6119,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4414,6 +6147,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode**
@@ -4440,6 +6174,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4458,6 +6202,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles**
@@ -4484,6 +6229,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4502,6 +6257,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneUsePopupBlocker**
@@ -4528,6 +6284,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4546,6 +6312,7 @@ ADMX Info:
+
**InternetExplorer/InternetZoneWebsitesInLessPrivilegedZonesCanNavigateIntoThisZone**
@@ -4572,6 +6339,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -4590,6 +6367,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowAccessToDataSources**
@@ -4616,6 +6394,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -4642,6 +6430,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls**
@@ -4668,6 +6457,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -4694,6 +6493,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads**
@@ -4720,6 +6520,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -4744,6 +6554,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowFontDownloads**
@@ -4770,6 +6581,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -4796,6 +6617,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowLessPrivilegedSites**
@@ -4822,6 +6644,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
@@ -4848,6 +6680,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents**
@@ -4874,6 +6707,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -4900,6 +6743,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowScriptlets**
@@ -4926,6 +6770,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -4952,6 +6806,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowSmartScreenIE**
@@ -4978,6 +6833,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -5006,6 +6871,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneAllowUserDataPersistence**
@@ -5032,6 +6898,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -5058,6 +6934,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls**
@@ -5084,6 +6961,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -5102,6 +6989,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls**
@@ -5128,6 +7016,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -5156,6 +7054,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe**
@@ -5182,6 +7081,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -5200,6 +7109,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneJavaPermissions**
@@ -5226,6 +7136,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -5244,6 +7164,7 @@ ADMX Info:
+
**InternetExplorer/IntranetZoneNavigateWindowsAndFrames**
@@ -5270,6 +7191,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -5296,6 +7227,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowAccessToDataSources**
@@ -5322,6 +7254,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -5348,6 +7290,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls**
@@ -5374,6 +7317,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -5400,6 +7353,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads**
@@ -5426,6 +7380,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -5450,6 +7414,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowFontDownloads**
@@ -5476,6 +7441,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -5502,6 +7477,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites**
@@ -5528,6 +7504,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -5554,6 +7540,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents**
@@ -5580,6 +7567,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -5606,6 +7603,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowScriptlets**
@@ -5632,6 +7630,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -5658,6 +7666,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowSmartScreenIE**
@@ -5684,6 +7693,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -5712,6 +7731,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneAllowUserDataPersistence**
@@ -5738,6 +7758,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -5764,6 +7794,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls**
@@ -5790,6 +7821,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -5808,6 +7849,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls**
@@ -5834,6 +7876,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -5862,6 +7914,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneJavaPermissions**
@@ -5888,6 +7941,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -5906,6 +7969,7 @@ ADMX Info:
+
**InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames**
@@ -5932,6 +7996,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -5958,6 +8032,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources**
@@ -5984,6 +8059,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -6010,6 +8095,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls**
@@ -6036,6 +8122,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -6062,6 +8158,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads**
@@ -6088,6 +8185,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -6112,6 +8219,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowFontDownloads**
@@ -6138,6 +8246,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -6164,6 +8282,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites**
@@ -6190,6 +8309,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -6216,6 +8345,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents**
@@ -6242,6 +8372,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -6268,6 +8408,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowScriptlets**
@@ -6294,6 +8435,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -6320,6 +8471,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE**
@@ -6346,6 +8498,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -6374,6 +8536,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence**
@@ -6400,6 +8563,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -6426,6 +8599,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls**
@@ -6452,6 +8626,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -6480,6 +8664,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneJavaPermissions**
@@ -6506,6 +8691,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -6524,6 +8719,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames**
@@ -6550,6 +8746,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -6576,6 +8782,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources**
@@ -6602,6 +8809,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -6628,6 +8845,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls**
@@ -6654,6 +8872,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -6680,6 +8908,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads**
@@ -6706,6 +8935,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -6730,6 +8969,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowFontDownloads**
@@ -6756,6 +8996,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -6782,6 +9032,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites**
@@ -6808,6 +9059,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -6834,6 +9095,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents**
@@ -6860,6 +9122,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -6886,6 +9158,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowScriptlets**
@@ -6912,6 +9185,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -6938,6 +9221,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE**
@@ -6964,6 +9248,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -6992,6 +9286,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence**
@@ -7018,6 +9313,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -7044,6 +9349,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls**
@@ -7070,6 +9376,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -7098,6 +9414,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames**
@@ -7124,6 +9441,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -7150,6 +9477,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources**
@@ -7176,6 +9504,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -7202,6 +9540,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls**
@@ -7228,6 +9567,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -7254,6 +9603,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads**
@@ -7280,6 +9630,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -7304,6 +9664,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads**
@@ -7330,6 +9691,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -7356,6 +9727,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites**
@@ -7382,6 +9754,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -7408,6 +9790,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents**
@@ -7434,6 +9817,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -7460,6 +9853,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets**
@@ -7486,6 +9880,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -7512,6 +9916,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE**
@@ -7538,6 +9943,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -7566,6 +9981,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence**
@@ -7592,6 +10008,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -7618,6 +10044,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls**
@@ -7644,6 +10071,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -7672,6 +10109,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneJavaPermissions**
@@ -7698,6 +10136,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -7716,6 +10164,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames**
@@ -7742,6 +10191,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -7768,6 +10227,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources**
@@ -7794,6 +10254,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -7820,6 +10290,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls**
@@ -7846,6 +10317,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -7872,6 +10353,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads**
@@ -7898,6 +10380,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -7922,6 +10414,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads**
@@ -7948,6 +10441,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -7974,6 +10477,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites**
@@ -8000,6 +10504,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -8026,6 +10540,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents**
@@ -8052,6 +10567,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -8078,6 +10603,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets**
@@ -8104,6 +10630,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -8130,6 +10666,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE**
@@ -8156,6 +10693,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -8184,6 +10731,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence**
@@ -8210,6 +10758,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -8236,6 +10794,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls**
@@ -8262,6 +10821,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -8290,6 +10859,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions**
@@ -8316,6 +10886,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -8334,6 +10914,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames**
@@ -8360,6 +10941,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -8386,6 +10977,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources**
@@ -8412,6 +11004,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -8438,6 +11040,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls**
@@ -8464,6 +11067,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -8490,6 +11103,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads**
@@ -8516,6 +11130,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -8540,6 +11164,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads**
@@ -8566,6 +11191,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -8592,6 +11227,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites**
@@ -8618,6 +11254,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -8644,6 +11290,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents**
@@ -8670,6 +11317,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -8696,6 +11353,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets**
@@ -8722,6 +11380,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -8748,6 +11416,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE**
@@ -8774,6 +11443,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -8802,6 +11481,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence**
@@ -8828,6 +11508,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -8854,6 +11544,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls**
@@ -8880,6 +11571,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -8908,6 +11609,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions**
@@ -8934,6 +11636,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -8952,6 +11664,7 @@ ADMX Info:
+
**InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames**
@@ -8978,6 +11691,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -9004,6 +11727,7 @@ ADMX Info:
+
**InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses**
@@ -9030,6 +11754,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9048,6 +11782,7 @@ ADMX Info:
+
**InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses**
@@ -9074,6 +11809,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9092,6 +11837,7 @@ ADMX Info:
+
**InternetExplorer/NotificationBarInternetExplorerProcesses**
@@ -9118,6 +11864,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9136,6 +11892,7 @@ ADMX Info:
+
**InternetExplorer/PreventManagingSmartScreenFilter**
@@ -9162,6 +11919,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9180,6 +11947,7 @@ ADMX Info:
+
**InternetExplorer/PreventPerUserInstallationOfActiveXControls**
@@ -9206,6 +11974,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9224,6 +12002,7 @@ ADMX Info:
+
**InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses**
@@ -9250,6 +12029,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9268,6 +12057,7 @@ ADMX Info:
+
**InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls**
@@ -9294,6 +12084,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9312,6 +12112,7 @@ ADMX Info:
+
**InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses**
@@ -9338,6 +12139,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9356,6 +12167,7 @@ ADMX Info:
+
**InternetExplorer/RestrictFileDownloadInternetExplorerProcesses**
@@ -9382,6 +12194,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9400,6 +12222,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources**
@@ -9426,6 +12249,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -9452,6 +12285,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowActiveScripting**
@@ -9478,6 +12312,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9496,6 +12340,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls**
@@ -9522,6 +12367,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -9548,6 +12403,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads**
@@ -9574,6 +12430,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -9598,6 +12464,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors**
@@ -9624,6 +12491,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9642,6 +12519,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript**
@@ -9668,6 +12546,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9686,6 +12574,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles**
@@ -9712,6 +12601,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9730,6 +12629,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowFileDownloads**
@@ -9756,6 +12656,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9774,6 +12684,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowFontDownloads**
@@ -9800,6 +12711,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -9826,6 +12747,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites**
@@ -9852,6 +12774,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
@@ -9878,6 +12810,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles**
@@ -9904,6 +12837,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9922,6 +12865,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH**
@@ -9948,6 +12892,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -9966,6 +12920,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents**
@@ -9992,6 +12947,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -10018,6 +12983,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls**
@@ -10044,6 +13010,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10062,6 +13038,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl**
@@ -10088,6 +13065,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10106,6 +13093,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows**
@@ -10132,6 +13120,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10150,6 +13148,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls**
@@ -10176,6 +13175,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10194,6 +13203,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowScriptlets**
@@ -10220,6 +13230,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -10246,6 +13266,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE**
@@ -10272,6 +13293,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -10300,6 +13331,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript**
@@ -10326,6 +13358,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10344,6 +13386,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence**
@@ -10370,6 +13413,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -10396,6 +13449,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls**
@@ -10422,6 +13476,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10440,6 +13504,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls**
@@ -10466,6 +13531,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10484,6 +13559,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls**
@@ -10510,6 +13586,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10528,6 +13614,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter**
@@ -10554,6 +13641,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10572,6 +13669,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows**
@@ -10598,6 +13696,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10616,6 +13724,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows**
@@ -10642,6 +13751,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10660,6 +13779,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneEnableMIMESniffing**
@@ -10686,6 +13806,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10704,6 +13834,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer**
@@ -10730,6 +13861,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10748,6 +13889,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls**
@@ -10774,6 +13916,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -10802,6 +13954,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneJavaPermissions**
@@ -10828,6 +13981,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10846,6 +14009,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME**
@@ -10872,6 +14036,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10890,6 +14064,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneLogonOptions**
@@ -10916,6 +14091,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -10934,6 +14119,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames**
@@ -10960,6 +14146,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
@@ -10986,6 +14182,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFramesAcrossDomains**
@@ -11012,6 +14209,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11030,6 +14237,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins**
@@ -11056,6 +14264,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11074,6 +14292,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode**
@@ -11100,6 +14319,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11118,6 +14347,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting**
@@ -11144,6 +14374,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11162,6 +14402,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets**
@@ -11188,6 +14429,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11206,6 +14457,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles**
@@ -11232,6 +14484,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11250,6 +14512,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneTurnOnCrossSiteScriptingFilter**
@@ -11276,6 +14539,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11294,6 +14567,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode**
@@ -11320,6 +14594,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11338,6 +14622,7 @@ ADMX Info:
+
**InternetExplorer/RestrictedSitesZoneUsePopupBlocker**
@@ -11364,6 +14649,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11382,6 +14677,7 @@ ADMX Info:
+
**InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses**
@@ -11408,6 +14704,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11426,6 +14732,7 @@ ADMX Info:
+
**InternetExplorer/SearchProviderList**
@@ -11452,6 +14759,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website.
@@ -11476,6 +14793,7 @@ ADMX Info:
+
**InternetExplorer/SecurityZonesUseOnlyMachineSettings**
@@ -11502,6 +14820,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -11520,6 +14847,7 @@ ADMX Info:
+
**InternetExplorer/SpecifyUseOfActiveXInstallerService**
@@ -11546,6 +14874,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -11564,6 +14902,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowAccessToDataSources**
@@ -11590,6 +14929,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
@@ -11616,6 +14965,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls**
@@ -11642,6 +14992,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
@@ -11668,6 +15028,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads**
@@ -11694,6 +15055,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
@@ -11718,6 +15089,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowFontDownloads**
@@ -11744,6 +15116,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
@@ -11770,6 +15152,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites**
@@ -11796,6 +15179,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
@@ -11822,6 +15215,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents**
@@ -11848,6 +15242,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
@@ -11874,6 +15278,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowScriptlets**
@@ -11900,6 +15305,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage whether the user can run scriptlets.
@@ -11926,6 +15341,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowSmartScreenIE**
@@ -11952,6 +15368,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
@@ -11980,6 +15406,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneAllowUserDataPersistence**
@@ -12006,6 +15433,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
@@ -12032,6 +15469,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls**
@@ -12058,6 +15496,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -12076,6 +15524,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls**
@@ -12102,6 +15551,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -12120,6 +15579,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls**
@@ -12146,6 +15606,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
@@ -12174,6 +15644,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe**
@@ -12200,6 +15671,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -12218,6 +15699,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe**
@@ -12244,6 +15726,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -12262,6 +15754,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneJavaPermissions**
@@ -12288,6 +15781,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!TIP]
@@ -12306,6 +15809,7 @@ ADMX Info:
+
**InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames**
@@ -12332,6 +15836,16 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md
index d4683f4ded..0297e2a41a 100644
--- a/windows/client-management/mdm/policy-csp-kerberos.md
+++ b/windows/client-management/mdm/policy-csp-kerberos.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Kerberos
@@ -14,11 +14,30 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Kerberos policies
+
+ -
+ Kerberos/AllowForestSearchOrder
+
+ -
+ Kerberos/KerberosClientSupportsClaimsCompoundArmor
+
+ -
+ Kerberos/RequireKerberosArmoring
+
+ -
+ Kerberos/RequireStrictKDCValidation
+
+ -
+ Kerberos/SetMaximumContextTokenSize
+
+
+
+
**Kerberos/AllowForestSearchOrder**
@@ -45,6 +64,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).
@@ -69,6 +97,7 @@ ADMX Info:
+
**Kerberos/KerberosClientSupportsClaimsCompoundArmor**
@@ -95,6 +124,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features.
If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.
@@ -118,6 +156,7 @@ ADMX Info:
+
**Kerberos/RequireKerberosArmoring**
@@ -144,6 +183,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller.
@@ -172,6 +220,7 @@ ADMX Info:
+
**Kerberos/RequireStrictKDCValidation**
@@ -198,6 +247,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon.
@@ -222,6 +280,7 @@ ADMX Info:
+
**Kerberos/SetMaximumContextTokenSize**
@@ -248,6 +307,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size.
diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md
index a8f855bc5e..47c63e821c 100644
--- a/windows/client-management/mdm/policy-csp-licensing.md
+++ b/windows/client-management/mdm/policy-csp-licensing.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Licensing
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Licensing policies
+
+ -
+ Licensing/AllowWindowsEntitlementReactivation
+
+ -
+ Licensing/DisallowKMSClientOnlineAVSValidation
+
+
+
+
**Licensing/AllowWindowsEntitlementReactivation**
@@ -45,6 +55,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Enables or Disable Windows license reactivation on managed devices.
@@ -55,6 +74,7 @@ ms.date: 08/30/2017
+
**Licensing/DisallowKMSClientOnlineAVSValidation**
@@ -81,6 +101,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
index 5eb02ceae2..f2c1e120e8 100644
--- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
+++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - LocalPoliciesSecurityOptions
@@ -14,11 +14,87 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## LocalPoliciesSecurityOptions policies
+
+ -
+ LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
+
+ -
+ LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
+
+ -
+ LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus
+
+ -
+ LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
+
+ -
+ LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
+
+ -
+ LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
+
+ -
+ LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
+
+ -
+ LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
+
+ -
+ LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
+
+ -
+ LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
+
+ -
+ LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
+
+
+
+
**LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts**
@@ -45,6 +121,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting prevents users from adding new Microsoft accounts on this computer.
@@ -61,6 +146,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus**
@@ -87,6 +173,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This security setting determines whether the local Administrator account is enabled or disabled.
@@ -104,6 +199,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus**
@@ -130,6 +226,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This security setting determines if the Guest account is enabled or disabled.
@@ -144,6 +249,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly**
@@ -170,6 +276,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Accounts: Limit local account use of blank passwords to console logon only
@@ -192,6 +307,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount**
@@ -218,6 +334,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Accounts: Rename administrator account
@@ -229,6 +354,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount**
@@ -255,6 +381,15 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Accounts: Rename guest account
@@ -266,6 +401,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked**
@@ -292,6 +428,15 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive Logon:Display user information when the session is locked
@@ -304,6 +449,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn**
@@ -330,6 +476,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive logon: Don't display last signed-in
@@ -347,6 +502,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn**
@@ -373,6 +529,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive logon: Don't display username at sign-in
@@ -391,6 +556,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL**
@@ -417,6 +583,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive logon: Do not require CTRL+ALT+DEL
@@ -436,6 +611,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit**
@@ -462,6 +638,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive logon: Machine inactivity limit.
@@ -476,6 +661,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn**
@@ -502,6 +688,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive logon: Message text for users attempting to log on
@@ -515,6 +710,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn**
@@ -541,6 +737,15 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Interactive logon: Message title for users attempting to log on
@@ -552,6 +757,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests**
@@ -578,6 +784,15 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Network security: Allow PKU2U authentication requests to this computer to use online identities.
@@ -591,6 +806,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon**
@@ -631,6 +847,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn**
@@ -657,6 +874,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Shutdown: Allow system to be shut down without having to log on
@@ -676,6 +902,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation**
@@ -702,6 +929,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop.
@@ -720,6 +956,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators**
@@ -746,6 +983,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
@@ -769,6 +1015,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers**
@@ -795,6 +1042,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Behavior of the elevation prompt for standard users
This policy setting controls the behavior of the elevation prompt for standard users.
@@ -811,6 +1067,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated**
@@ -837,6 +1094,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Only elevate executable files that are signed and validated
@@ -850,6 +1116,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations**
@@ -876,6 +1143,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Only elevate UIAccess applications that are installed in secure locations
@@ -895,6 +1171,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode**
@@ -921,6 +1198,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Turn on Admin Approval Mode
@@ -935,6 +1221,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation**
@@ -961,6 +1248,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Switch to the secure desktop when prompting for elevation
@@ -974,6 +1270,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
**LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations**
@@ -1000,6 +1297,15 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
User Account Control: Virtualize file and registry write failures to per-user locations
diff --git a/windows/client-management/mdm/policy-csp-location.md b/windows/client-management/mdm/policy-csp-location.md
index 130111a793..f1124ffad4 100644
--- a/windows/client-management/mdm/policy-csp-location.md
+++ b/windows/client-management/mdm/policy-csp-location.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Location
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Location policies
+
+ -
+ Location/EnableLocation
+
+
+
+
**Location/EnableLocation**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Optional policy that allows for IT admin to preconfigure whether or not Location Service's Device Switch is enabled or disabled for the device. Setting this policy is not required for Location Services to function. This policy controls a device wide state that affects all users, apps, and services ability to find the device's latitude and longitude on a map. There is a separate user switch that defines whether the location service is allowed to retrieve a position for the current user. In order to retrieve a position for a specific user, both the Device Switch and the User Switch must be enabled. If either is disabled, positions cannot be retrieved for the user. The user can later change both the User Switch and the Device Switch through the user interface on the Settings -> Privacy -> Location page.
diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md
index ff2b494dee..038d477577 100644
--- a/windows/client-management/mdm/policy-csp-lockdown.md
+++ b/windows/client-management/mdm/policy-csp-lockdown.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - LockDown
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## LockDown policies
+
+ -
+ LockDown/AllowEdgeSwipe
+
+
+
+
**LockDown/AllowEdgeSwipe**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch.
diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md
index 40abac41bc..5c1dab3c54 100644
--- a/windows/client-management/mdm/policy-csp-maps.md
+++ b/windows/client-management/mdm/policy-csp-maps.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Maps
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Maps policies
+
+ -
+ Maps/AllowOfflineMapsDownloadOverMeteredConnection
+
+ -
+ Maps/EnableOfflineMapsAutoUpdate
+
+
+
+
**Maps/AllowOfflineMapsDownloadOverMeteredConnection**
@@ -45,6 +55,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows the download and update of map data over metered connections.
@@ -58,6 +77,7 @@ ms.date: 08/30/2017
+
**Maps/EnableOfflineMapsAutoUpdate**
@@ -84,6 +104,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Disables the automatic download and update of map data.
diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md
index edaff6765e..eac7199c3e 100644
--- a/windows/client-management/mdm/policy-csp-messaging.md
+++ b/windows/client-management/mdm/policy-csp-messaging.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Messaging
@@ -14,11 +14,24 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Messaging policies
+
+ -
+ Messaging/AllowMMS
+
+ -
+ Messaging/AllowMessageSync
+
+ -
+ Messaging/AllowRCS
+
+
+
+
**Messaging/AllowMMS**
@@ -45,6 +58,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -58,6 +80,7 @@ ms.date: 08/30/2017
+
**Messaging/AllowMessageSync**
@@ -84,6 +107,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Enables text message back up and restore and Messaging Everywhere. This policy allows an organization to disable these features to avoid information being stored on servers outside of their control.
@@ -94,6 +126,7 @@ ms.date: 08/30/2017
+
**Messaging/AllowRCS**
@@ -120,6 +153,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md
index 3196840a3b..95dcb7e362 100644
--- a/windows/client-management/mdm/policy-csp-networkisolation.md
+++ b/windows/client-management/mdm/policy-csp-networkisolation.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - NetworkIsolation
@@ -14,11 +14,39 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## NetworkIsolation policies
+
+ -
+ NetworkIsolation/EnterpriseCloudResources
+
+ -
+ NetworkIsolation/EnterpriseIPRange
+
+ -
+ NetworkIsolation/EnterpriseIPRangesAreAuthoritative
+
+ -
+ NetworkIsolation/EnterpriseInternalProxyServers
+
+ -
+ NetworkIsolation/EnterpriseNetworkDomainNames
+
+ -
+ NetworkIsolation/EnterpriseProxyServers
+
+ -
+ NetworkIsolation/EnterpriseProxyServersAreAuthoritative
+
+ -
+ NetworkIsolation/NeutralResources
+
+
+
+
**NetworkIsolation/EnterpriseCloudResources**
@@ -45,11 +73,21 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the **EnterpriseInternalProxyServers** policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, **<*cloudresource*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|**.
+
**NetworkIsolation/EnterpriseIPRange**
@@ -76,6 +114,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. For example:
@@ -90,6 +137,7 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
**NetworkIsolation/EnterpriseIPRangesAreAuthoritative**
@@ -116,11 +164,21 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets.
+
**NetworkIsolation/EnterpriseInternalProxyServers**
@@ -147,11 +205,21 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This is the comma-separated list of internal proxy servers. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the **EnterpriseCloudResources** policy to force traffic to the matched cloud resources through these proxies.
+
**NetworkIsolation/EnterpriseNetworkDomainNames**
@@ -178,6 +246,15 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example "contoso.sharepoint.com, Fabrikam.com".
@@ -193,6 +270,7 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
**NetworkIsolation/EnterpriseProxyServers**
@@ -219,11 +297,21 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59".
+
**NetworkIsolation/EnterpriseProxyServersAreAuthoritative**
@@ -250,11 +338,21 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies.
+
**NetworkIsolation/NeutralResources**
@@ -281,6 +379,15 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
List of domain names that can used for work or personal resource.
diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md
index 2a291f8ba6..f85714b12c 100644
--- a/windows/client-management/mdm/policy-csp-notifications.md
+++ b/windows/client-management/mdm/policy-csp-notifications.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Notifications
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Notifications policies
+
+ -
+ Notifications/DisallowNotificationMirroring
+
+
+
+
**Notifications/DisallowNotificationMirroring**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1607. Boolean value that turns off notification mirroring.
diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md
index 17298b3cdf..e981b7483e 100644
--- a/windows/client-management/mdm/policy-csp-power.md
+++ b/windows/client-management/mdm/policy-csp-power.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Power
@@ -14,11 +14,42 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Power policies
+
+ -
+ Power/AllowStandbyWhenSleepingPluggedIn
+
+ -
+ Power/DisplayOffTimeoutOnBattery
+
+ -
+ Power/DisplayOffTimeoutPluggedIn
+
+ -
+ Power/HibernateTimeoutOnBattery
+
+ -
+ Power/HibernateTimeoutPluggedIn
+
+ -
+ Power/RequirePasswordWhenComputerWakesOnBattery
+
+ -
+ Power/RequirePasswordWhenComputerWakesPluggedIn
+
+ -
+ Power/StandbyTimeoutOnBattery
+
+ -
+ Power/StandbyTimeoutPluggedIn
+
+
+
+
**Power/AllowStandbyWhenSleepingPluggedIn**
@@ -45,6 +76,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state.
@@ -69,6 +109,7 @@ ADMX Info:
+
**Power/DisplayOffTimeoutOnBattery**
@@ -95,6 +136,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Turn off the display (on battery). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
@@ -121,6 +171,7 @@ ADMX Info:
+
**Power/DisplayOffTimeoutPluggedIn**
@@ -147,6 +198,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Turn off the display (plugged in). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
@@ -173,6 +233,7 @@ ADMX Info:
+
**Power/HibernateTimeoutOnBattery**
@@ -199,6 +260,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Specify the system hibernate timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
@@ -226,6 +296,7 @@ ADMX Info:
+
**Power/HibernateTimeoutPluggedIn**
@@ -252,6 +323,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Specify the system hibernate timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
@@ -278,6 +358,7 @@ ADMX Info:
+
**Power/RequirePasswordWhenComputerWakesOnBattery**
@@ -304,6 +385,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
@@ -328,6 +418,7 @@ ADMX Info:
+
**Power/RequirePasswordWhenComputerWakesPluggedIn**
@@ -354,6 +445,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
@@ -378,6 +478,7 @@ ADMX Info:
+
**Power/StandbyTimeoutOnBattery**
@@ -404,6 +505,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Specify the system sleep timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
@@ -430,6 +540,7 @@ ADMX Info:
+
**Power/StandbyTimeoutPluggedIn**
@@ -456,6 +567,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Specify the system sleep timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md
index ffd1d93c3c..2e7c8296f2 100644
--- a/windows/client-management/mdm/policy-csp-printers.md
+++ b/windows/client-management/mdm/policy-csp-printers.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Printers
@@ -14,11 +14,24 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Printers policies
+
+ -
+ Printers/PointAndPrintRestrictions
+
+ -
+ Printers/PointAndPrintRestrictions_User
+
+ -
+ Printers/PublishPrinters
+
+
+
+
**Printers/PointAndPrintRestrictions**
@@ -45,6 +58,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
@@ -82,6 +104,7 @@ ADMX Info:
+
**Printers/PointAndPrintRestrictions_User**
@@ -108,6 +131,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
@@ -145,6 +177,7 @@ ADMX Info:
+
**Printers/PublishPrinters**
@@ -171,6 +204,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Determines whether the computer's shared printers can be published in Active Directory.
diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md
index fae39d1341..79333d939d 100644
--- a/windows/client-management/mdm/policy-csp-privacy.md
+++ b/windows/client-management/mdm/policy-csp-privacy.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Privacy
@@ -14,11 +14,246 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Privacy policies
+
+ -
+ Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
+
+ -
+ Privacy/AllowInputPersonalization
+
+ -
+ Privacy/DisableAdvertisingId
+
+ -
+ Privacy/EnableActivityFeed
+
+ -
+ Privacy/LetAppsAccessAccountInfo
+
+ -
+ Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessCalendar
+
+ -
+ Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessCallHistory
+
+ -
+ Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessCamera
+
+ -
+ Privacy/LetAppsAccessCamera_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessCamera_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessContacts
+
+ -
+ Privacy/LetAppsAccessContacts_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessContacts_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessEmail
+
+ -
+ Privacy/LetAppsAccessEmail_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessEmail_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessLocation
+
+ -
+ Privacy/LetAppsAccessLocation_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessLocation_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessMessaging
+
+ -
+ Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessMicrophone
+
+ -
+ Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessMotion
+
+ -
+ Privacy/LetAppsAccessMotion_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessMotion_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessNotifications
+
+ -
+ Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessPhone
+
+ -
+ Privacy/LetAppsAccessPhone_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessPhone_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessRadios
+
+ -
+ Privacy/LetAppsAccessRadios_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessRadios_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessTasks
+
+ -
+ Privacy/LetAppsAccessTasks_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessTasks_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsAccessTrustedDevices
+
+ -
+ Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsGetDiagnosticInfo
+
+ -
+ Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsRunInBackground
+
+ -
+ Privacy/LetAppsRunInBackground_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsRunInBackground_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
+
+ -
+ Privacy/LetAppsSyncWithDevices
+
+ -
+ Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
+
+ -
+ Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
+
+ -
+ Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
+
+ -
+ Privacy/PublishUserActivities
+
+
+
+
**Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts**
@@ -45,6 +280,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps.
@@ -60,6 +304,7 @@ ms.date: 08/30/2017
+
**Privacy/AllowInputPersonalization**
@@ -86,6 +331,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Updated in Windows 10, version 1709. Allows the usage of cloud based speech services for Cortana, dictation, or Store applications. Setting this policy to 1, lets Microsoft use the user's voice data to improve cloud speech services for all users.
@@ -99,6 +353,7 @@ ms.date: 08/30/2017
+
**Privacy/DisableAdvertisingId**
@@ -125,6 +380,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Enables or disables the Advertising ID.
@@ -138,6 +402,7 @@ ms.date: 08/30/2017
+
**Privacy/EnableActivityFeed**
@@ -164,6 +429,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish to the activity feed.
@@ -174,6 +448,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessAccountInfo**
@@ -200,6 +475,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access account information.
@@ -213,6 +497,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps**
@@ -239,11 +524,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps**
@@ -270,11 +565,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps**
@@ -301,11 +606,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCalendar**
@@ -332,6 +647,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access the calendar.
@@ -345,6 +669,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessCalendar_ForceAllowTheseApps**
@@ -371,11 +696,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCalendar_ForceDenyTheseApps**
@@ -402,11 +737,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps**
@@ -433,11 +778,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCallHistory**
@@ -464,6 +819,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access call history.
@@ -477,6 +841,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps**
@@ -503,11 +868,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps**
@@ -534,11 +909,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps**
@@ -565,11 +950,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
**Privacy/LetAppsAccessCamera**
@@ -596,6 +991,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access the camera.
@@ -609,6 +1013,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessCamera_ForceAllowTheseApps**
@@ -635,11 +1040,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
**Privacy/LetAppsAccessCamera_ForceDenyTheseApps**
@@ -666,11 +1081,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
**Privacy/LetAppsAccessCamera_UserInControlOfTheseApps**
@@ -697,11 +1122,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
**Privacy/LetAppsAccessContacts**
@@ -728,6 +1163,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access contacts.
@@ -741,6 +1185,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessContacts_ForceAllowTheseApps**
@@ -767,11 +1212,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
**Privacy/LetAppsAccessContacts_ForceDenyTheseApps**
@@ -798,11 +1253,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
**Privacy/LetAppsAccessContacts_UserInControlOfTheseApps**
@@ -829,11 +1294,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
**Privacy/LetAppsAccessEmail**
@@ -860,6 +1335,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access email.
@@ -873,6 +1357,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessEmail_ForceAllowTheseApps**
@@ -899,11 +1384,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
**Privacy/LetAppsAccessEmail_ForceDenyTheseApps**
@@ -930,11 +1425,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
**Privacy/LetAppsAccessEmail_UserInControlOfTheseApps**
@@ -961,11 +1466,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
**Privacy/LetAppsAccessLocation**
@@ -992,6 +1507,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access location.
@@ -1005,6 +1529,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessLocation_ForceAllowTheseApps**
@@ -1031,11 +1556,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
**Privacy/LetAppsAccessLocation_ForceDenyTheseApps**
@@ -1062,11 +1597,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
**Privacy/LetAppsAccessLocation_UserInControlOfTheseApps**
@@ -1093,11 +1638,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
**Privacy/LetAppsAccessMessaging**
@@ -1124,6 +1679,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can read or send messages (text or MMS).
@@ -1137,6 +1701,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessMessaging_ForceAllowTheseApps**
@@ -1163,11 +1728,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
**Privacy/LetAppsAccessMessaging_ForceDenyTheseApps**
@@ -1194,11 +1769,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
**Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps**
@@ -1225,11 +1810,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
**Privacy/LetAppsAccessMicrophone**
@@ -1256,6 +1851,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access the microphone.
@@ -1269,6 +1873,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps**
@@ -1295,11 +1900,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
**Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps**
@@ -1326,11 +1941,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
**Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps**
@@ -1357,11 +1982,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
**Privacy/LetAppsAccessMotion**
@@ -1388,6 +2023,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access motion data.
@@ -1401,6 +2045,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessMotion_ForceAllowTheseApps**
@@ -1427,11 +2072,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
**Privacy/LetAppsAccessMotion_ForceDenyTheseApps**
@@ -1458,11 +2113,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
**Privacy/LetAppsAccessMotion_UserInControlOfTheseApps**
@@ -1489,11 +2154,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
**Privacy/LetAppsAccessNotifications**
@@ -1520,6 +2195,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access notifications.
@@ -1533,6 +2217,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessNotifications_ForceAllowTheseApps**
@@ -1559,11 +2244,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
**Privacy/LetAppsAccessNotifications_ForceDenyTheseApps**
@@ -1590,11 +2285,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
**Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps**
@@ -1621,11 +2326,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
**Privacy/LetAppsAccessPhone**
@@ -1652,6 +2367,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can make phone calls.
@@ -1665,6 +2389,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessPhone_ForceAllowTheseApps**
@@ -1691,11 +2416,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
**Privacy/LetAppsAccessPhone_ForceDenyTheseApps**
@@ -1722,11 +2457,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
**Privacy/LetAppsAccessPhone_UserInControlOfTheseApps**
@@ -1753,11 +2498,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
**Privacy/LetAppsAccessRadios**
@@ -1784,6 +2539,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps have access to control radios.
@@ -1797,6 +2561,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessRadios_ForceAllowTheseApps**
@@ -1823,11 +2588,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
**Privacy/LetAppsAccessRadios_ForceDenyTheseApps**
@@ -1854,11 +2629,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
**Privacy/LetAppsAccessRadios_UserInControlOfTheseApps**
@@ -1885,11 +2670,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
**Privacy/LetAppsAccessTasks**
@@ -1916,11 +2711,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks.
+
**Privacy/LetAppsAccessTasks_ForceAllowTheseApps**
@@ -1947,11 +2752,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
**Privacy/LetAppsAccessTasks_ForceDenyTheseApps**
@@ -1978,11 +2793,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
**Privacy/LetAppsAccessTasks_UserInControlOfTheseApps**
@@ -2009,11 +2834,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
**Privacy/LetAppsAccessTrustedDevices**
@@ -2040,6 +2875,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can access trusted devices.
@@ -2053,6 +2897,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps**
@@ -2079,11 +2924,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
**Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps**
@@ -2110,11 +2965,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
**Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps**
@@ -2141,11 +3006,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
**Privacy/LetAppsGetDiagnosticInfo**
@@ -2172,6 +3047,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Force allow, force deny or give user control of apps that can get diagnostic information about other running apps.
@@ -2185,6 +3069,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps**
@@ -2211,11 +3096,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
**Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps**
@@ -2242,11 +3137,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
**Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps**
@@ -2273,11 +3178,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
**Privacy/LetAppsRunInBackground**
@@ -2304,6 +3219,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies whether Windows apps can run in the background.
@@ -2319,6 +3243,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsRunInBackground_ForceAllowTheseApps**
@@ -2345,11 +3270,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
**Privacy/LetAppsRunInBackground_ForceDenyTheseApps**
@@ -2376,11 +3311,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
**Privacy/LetAppsRunInBackground_UserInControlOfTheseApps**
@@ -2407,11 +3352,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
**Privacy/LetAppsSyncWithDevices**
@@ -2438,6 +3393,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether Windows apps can sync with devices.
@@ -2451,6 +3415,7 @@ The following list shows the supported values:
+
**Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps**
@@ -2477,11 +3442,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
**Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps**
@@ -2508,11 +3483,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
**Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps**
@@ -2539,11 +3524,21 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
**Privacy/PublishUserActivities**
@@ -2570,6 +3565,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Allows It Admins to enable publishing of user activities to the activity feed.
diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md
index 61751bca3b..71e7c1ee14 100644
--- a/windows/client-management/mdm/policy-csp-remoteassistance.md
+++ b/windows/client-management/mdm/policy-csp-remoteassistance.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - RemoteAssistance
@@ -14,11 +14,27 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## RemoteAssistance policies
+
+ -
+ RemoteAssistance/CustomizeWarningMessages
+
+ -
+ RemoteAssistance/SessionLogging
+
+ -
+ RemoteAssistance/SolicitedRemoteAssistance
+
+ -
+ RemoteAssistance/UnsolicitedRemoteAssistance
+
+
+
+
**RemoteAssistance/CustomizeWarningMessages**
@@ -45,6 +61,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting lets you customize warning messages.
@@ -75,6 +100,7 @@ ADMX Info:
+
**RemoteAssistance/SessionLogging**
@@ -101,6 +127,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.
@@ -127,6 +162,7 @@ ADMX Info:
+
**RemoteAssistance/SolicitedRemoteAssistance**
@@ -153,6 +189,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.
@@ -187,6 +232,7 @@ ADMX Info:
+
**RemoteAssistance/UnsolicitedRemoteAssistance**
@@ -213,6 +259,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.
diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md
index 411214069f..589ff8b724 100644
--- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md
+++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - RemoteDesktopServices
@@ -14,11 +14,33 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## RemoteDesktopServices policies
+
+ -
+ RemoteDesktopServices/AllowUsersToConnectRemotely
+
+ -
+ RemoteDesktopServices/ClientConnectionEncryptionLevel
+
+ -
+ RemoteDesktopServices/DoNotAllowDriveRedirection
+
+ -
+ RemoteDesktopServices/DoNotAllowPasswordSaving
+
+ -
+ RemoteDesktopServices/PromptForPasswordUponConnection
+
+ -
+ RemoteDesktopServices/RequireSecureRPCCommunication
+
+
+
+
**RemoteDesktopServices/AllowUsersToConnectRemotely**
@@ -45,6 +67,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to configure remote access to computers by using Remote Desktop Services.
@@ -75,6 +106,7 @@ ADMX Info:
+
**RemoteDesktopServices/ClientConnectionEncryptionLevel**
@@ -101,6 +133,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.
@@ -135,6 +176,7 @@ ADMX Info:
+
**RemoteDesktopServices/DoNotAllowDriveRedirection**
@@ -161,6 +203,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).
@@ -189,6 +240,7 @@ ADMX Info:
+
**RemoteDesktopServices/DoNotAllowPasswordSaving**
@@ -215,6 +267,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Controls whether passwords can be saved on this computer from Remote Desktop Connection.
@@ -239,6 +300,7 @@ ADMX Info:
+
**RemoteDesktopServices/PromptForPasswordUponConnection**
@@ -265,6 +327,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection.
@@ -295,6 +366,7 @@ ADMX Info:
+
**RemoteDesktopServices/RequireSecureRPCCommunication**
@@ -321,6 +393,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.
diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md
index d084b5d609..7ed74820ef 100644
--- a/windows/client-management/mdm/policy-csp-remotemanagement.md
+++ b/windows/client-management/mdm/policy-csp-remotemanagement.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - RemoteManagement
@@ -14,11 +14,60 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## RemoteManagement policies
+
+ -
+ RemoteManagement/AllowBasicAuthentication_Client
+
+ -
+ RemoteManagement/AllowBasicAuthentication_Service
+
+ -
+ RemoteManagement/AllowCredSSPAuthenticationClient
+
+ -
+ RemoteManagement/AllowCredSSPAuthenticationService
+
+ -
+ RemoteManagement/AllowRemoteServerManagement
+
+ -
+ RemoteManagement/AllowUnencryptedTraffic_Client
+
+ -
+ RemoteManagement/AllowUnencryptedTraffic_Service
+
+ -
+ RemoteManagement/DisallowDigestAuthentication
+
+ -
+ RemoteManagement/DisallowNegotiateAuthenticationClient
+
+ -
+ RemoteManagement/DisallowNegotiateAuthenticationService
+
+ -
+ RemoteManagement/DisallowStoringOfRunAsCredentials
+
+ -
+ RemoteManagement/SpecifyChannelBindingTokenHardeningLevel
+
+ -
+ RemoteManagement/TrustedHosts
+
+ -
+ RemoteManagement/TurnOnCompatibilityHTTPListener
+
+ -
+ RemoteManagement/TurnOnCompatibilityHTTPSListener
+
+
+
+
**RemoteManagement/AllowBasicAuthentication_Client**
@@ -45,6 +94,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -63,6 +121,7 @@ ADMX Info:
+
**RemoteManagement/AllowBasicAuthentication_Service**
@@ -89,6 +148,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -107,6 +175,7 @@ ADMX Info:
+
**RemoteManagement/AllowCredSSPAuthenticationClient**
@@ -133,6 +202,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -151,6 +229,7 @@ ADMX Info:
+
**RemoteManagement/AllowCredSSPAuthenticationService**
@@ -177,6 +256,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -195,6 +283,7 @@ ADMX Info:
+
**RemoteManagement/AllowRemoteServerManagement**
@@ -221,6 +310,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -239,6 +337,7 @@ ADMX Info:
+
**RemoteManagement/AllowUnencryptedTraffic_Client**
@@ -265,6 +364,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -283,6 +391,7 @@ ADMX Info:
+
**RemoteManagement/AllowUnencryptedTraffic_Service**
@@ -309,6 +418,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -327,6 +445,7 @@ ADMX Info:
+
**RemoteManagement/DisallowDigestAuthentication**
@@ -353,6 +472,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -371,6 +499,7 @@ ADMX Info:
+
**RemoteManagement/DisallowNegotiateAuthenticationClient**
@@ -397,6 +526,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -415,6 +553,7 @@ ADMX Info:
+
**RemoteManagement/DisallowNegotiateAuthenticationService**
@@ -441,6 +580,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -459,6 +607,7 @@ ADMX Info:
+
**RemoteManagement/DisallowStoringOfRunAsCredentials**
@@ -485,6 +634,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -503,6 +661,7 @@ ADMX Info:
+
**RemoteManagement/SpecifyChannelBindingTokenHardeningLevel**
@@ -529,6 +688,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -547,6 +715,7 @@ ADMX Info:
+
**RemoteManagement/TrustedHosts**
@@ -573,6 +742,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -591,6 +769,7 @@ ADMX Info:
+
**RemoteManagement/TurnOnCompatibilityHTTPListener**
@@ -617,6 +796,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -635,6 +823,7 @@ ADMX Info:
+
**RemoteManagement/TurnOnCompatibilityHTTPSListener**
@@ -661,6 +850,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
index dc1dab2c86..37e4a03a6a 100644
--- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
+++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - RemoteProcedureCall
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## RemoteProcedureCall policies
+
+ -
+ RemoteProcedureCall/RPCEndpointMapperClientAuthentication
+
+ -
+ RemoteProcedureCall/RestrictUnauthenticatedRPCClients
+
+
+
+
**RemoteProcedureCall/RPCEndpointMapperClientAuthentication**
@@ -45,6 +55,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner.
@@ -73,6 +92,7 @@ ADMX Info:
+
**RemoteProcedureCall/RestrictUnauthenticatedRPCClients**
@@ -99,6 +119,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.
diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md
index 32309bdf9d..9dd90c60be 100644
--- a/windows/client-management/mdm/policy-csp-remoteshell.md
+++ b/windows/client-management/mdm/policy-csp-remoteshell.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - RemoteShell
@@ -14,11 +14,36 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## RemoteShell policies
+
+ -
+ RemoteShell/AllowRemoteShellAccess
+
+ -
+ RemoteShell/MaxConcurrentUsers
+
+ -
+ RemoteShell/SpecifyIdleTimeout
+
+ -
+ RemoteShell/SpecifyMaxMemory
+
+ -
+ RemoteShell/SpecifyMaxProcesses
+
+ -
+ RemoteShell/SpecifyMaxRemoteShells
+
+ -
+ RemoteShell/SpecifyShellTimeout
+
+
+
+
**RemoteShell/AllowRemoteShellAccess**
@@ -45,6 +70,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -63,6 +97,7 @@ ADMX Info:
+
**RemoteShell/MaxConcurrentUsers**
@@ -89,6 +124,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -107,6 +151,7 @@ ADMX Info:
+
**RemoteShell/SpecifyIdleTimeout**
@@ -133,6 +178,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -151,6 +205,7 @@ ADMX Info:
+
**RemoteShell/SpecifyMaxMemory**
@@ -177,6 +232,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -195,6 +259,7 @@ ADMX Info:
+
**RemoteShell/SpecifyMaxProcesses**
@@ -221,6 +286,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -239,6 +313,7 @@ ADMX Info:
+
**RemoteShell/SpecifyMaxRemoteShells**
@@ -265,6 +340,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
@@ -283,6 +367,7 @@ ADMX Info:
+
**RemoteShell/SpecifyShellTimeout**
@@ -309,6 +394,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!TIP]
diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md
index 783aac1e8d..d8d759bd86 100644
--- a/windows/client-management/mdm/policy-csp-search.md
+++ b/windows/client-management/mdm/policy-csp-search.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Search
@@ -14,11 +14,45 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Search policies
+
+ -
+ Search/AllowCloudSearch
+
+ -
+ Search/AllowIndexingEncryptedStoresOrItems
+
+ -
+ Search/AllowSearchToUseLocation
+
+ -
+ Search/AllowUsingDiacritics
+
+ -
+ Search/AlwaysUseAutoLangDetection
+
+ -
+ Search/DisableBackoff
+
+ -
+ Search/DisableRemovableDriveIndexing
+
+ -
+ Search/PreventIndexingLowDiskSpaceMB
+
+ -
+ Search/PreventRemoteQueries
+
+ -
+ Search/SafeSearchPermissions
+
+
+
+
**Search/AllowCloudSearch**
@@ -45,6 +79,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources.
@@ -55,6 +98,7 @@ ms.date: 08/30/2017
+
**Search/AllowIndexingEncryptedStoresOrItems**
@@ -81,6 +125,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows or disallows the indexing of items. This switch is for the Windows Search Indexer, which controls whether it will index items that are encrypted, such as the Windows Information Protection (WIP) protected files.
@@ -97,6 +150,7 @@ ms.date: 08/30/2017
+
**Search/AllowSearchToUseLocation**
@@ -123,6 +177,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether search can leverage location information.
@@ -135,6 +198,7 @@ ms.date: 08/30/2017
+
**Search/AllowUsingDiacritics**
@@ -161,6 +225,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows the use of diacritics.
@@ -173,6 +246,7 @@ ms.date: 08/30/2017
+
**Search/AlwaysUseAutoLangDetection**
@@ -199,6 +273,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to always use automatic language detection when indexing content and properties.
@@ -211,6 +294,7 @@ ms.date: 08/30/2017
+
**Search/DisableBackoff**
@@ -237,6 +321,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
If enabled, the search indexer backoff feature will be disabled. Indexing will continue at full speed even when system activity is high. If disabled, backoff logic will be used to throttle back indexing activity when system activity is high. Default is disabled.
@@ -247,6 +340,7 @@ ms.date: 08/30/2017
+
**Search/DisableRemovableDriveIndexing**
@@ -273,6 +367,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting configures whether or not locations on removable drives can be added to libraries.
@@ -287,6 +390,7 @@ ms.date: 08/30/2017
+
**Search/PreventIndexingLowDiskSpaceMB**
@@ -313,6 +417,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 1.
@@ -327,6 +440,7 @@ ms.date: 08/30/2017
+
**Search/PreventRemoteQueries**
@@ -353,6 +467,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
If enabled, clients will be unable to query this computer's index remotely. Thus, when they are browsing network shares that are stored on this computer, they will not search them using the index. If disabled, client search requests will use this computer's index..
@@ -363,6 +486,7 @@ ms.date: 08/30/2017
+
**Search/SafeSearchPermissions**
@@ -389,6 +513,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md
index 229903014f..be8599f45e 100644
--- a/windows/client-management/mdm/policy-csp-security.md
+++ b/windows/client-management/mdm/policy-csp-security.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Security
@@ -14,11 +14,45 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Security policies
+
+ -
+ Security/AllowAddProvisioningPackage
+
+ -
+ Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
+
+ -
+ Security/AllowManualRootCertificateInstallation
+
+ -
+ Security/AllowRemoveProvisioningPackage
+
+ -
+ Security/AntiTheftMode
+
+ -
+ Security/ClearTPMIfNotReady
+
+ -
+ Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
+
+ -
+ Security/RequireDeviceEncryption
+
+ -
+ Security/RequireProvisioningPackageSignature
+
+ -
+ Security/RequireRetrieveHealthCertificateOnBoot
+
+
+
+
**Security/AllowAddProvisioningPackage**
@@ -45,6 +79,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to allow the runtime configuration agent to install provisioning packages.
@@ -55,6 +98,7 @@ ms.date: 08/30/2017
+
**Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices**
@@ -100,6 +144,7 @@ ms.date: 08/30/2017
+
**Security/AllowManualRootCertificateInstallation**
@@ -126,6 +171,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -142,6 +196,7 @@ ms.date: 08/30/2017
+
**Security/AllowRemoveProvisioningPackage**
@@ -168,6 +223,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to allow the runtime configuration agent to remove provisioning packages.
@@ -178,6 +242,7 @@ ms.date: 08/30/2017
+
**Security/AntiTheftMode**
@@ -204,6 +269,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
@@ -218,6 +292,7 @@ ms.date: 08/30/2017
+
**Security/ClearTPMIfNotReady**
@@ -244,6 +319,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -257,6 +341,7 @@ The following list shows the supported values:
+
**Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices**
@@ -283,6 +368,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -299,6 +393,7 @@ The following list shows the supported values:
+
**Security/RequireDeviceEncryption**
@@ -325,6 +420,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile. In Windows 10 for desktop, you can query encryption status by using the [DeviceStatus CSP](devicestatus-csp.md) node **DeviceStatus/Compliance/EncryptionCompliance**.
@@ -343,6 +447,7 @@ The following list shows the supported values:
+
**Security/RequireProvisioningPackageSignature**
@@ -369,6 +474,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether provisioning packages must have a certificate signed by a device trusted authority.
@@ -379,6 +493,7 @@ The following list shows the supported values:
+
**Security/RequireRetrieveHealthCertificateOnBoot**
@@ -405,6 +520,15 @@ The following list shows the supported values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots.
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md
index 50a3295347..987f2c639b 100644
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Settings
@@ -14,11 +14,54 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Settings policies
+
+ -
+ Settings/AllowAutoPlay
+
+ -
+ Settings/AllowDataSense
+
+ -
+ Settings/AllowDateTime
+
+ -
+ Settings/AllowEditDeviceName
+
+ -
+ Settings/AllowLanguage
+
+ -
+ Settings/AllowPowerSleep
+
+ -
+ Settings/AllowRegion
+
+ -
+ Settings/AllowSignInOptions
+
+ -
+ Settings/AllowVPN
+
+ -
+ Settings/AllowWorkplace
+
+ -
+ Settings/AllowYourAccount
+
+ -
+ Settings/ConfigureTaskbarCalendar
+
+ -
+ Settings/PageVisibilityList
+
+
+
+
**Settings/AllowAutoPlay**
@@ -45,6 +88,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -62,6 +114,7 @@ ms.date: 08/30/2017
+
**Settings/AllowDataSense**
@@ -88,6 +141,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows the user to change Data Sense settings.
@@ -98,6 +160,7 @@ ms.date: 08/30/2017
+
**Settings/AllowDateTime**
@@ -124,6 +187,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows the user to change date and time settings.
@@ -134,6 +206,7 @@ ms.date: 08/30/2017
+
**Settings/AllowEditDeviceName**
@@ -160,6 +233,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows editing of the device name.
@@ -170,6 +252,7 @@ ms.date: 08/30/2017
+
**Settings/AllowLanguage**
@@ -196,6 +279,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -210,6 +302,7 @@ ms.date: 08/30/2017
+
**Settings/AllowPowerSleep**
@@ -236,6 +329,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -250,6 +352,7 @@ ms.date: 08/30/2017
+
**Settings/AllowRegion**
@@ -276,6 +379,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -290,6 +402,7 @@ ms.date: 08/30/2017
+
**Settings/AllowSignInOptions**
@@ -316,6 +429,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -330,6 +452,7 @@ ms.date: 08/30/2017
+
**Settings/AllowVPN**
@@ -356,6 +479,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows the user to change VPN settings.
@@ -366,6 +498,7 @@ ms.date: 08/30/2017
+
**Settings/AllowWorkplace**
@@ -392,6 +525,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -406,6 +548,7 @@ ms.date: 08/30/2017
+
**Settings/AllowYourAccount**
@@ -432,6 +575,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows user to change account settings.
@@ -442,6 +594,7 @@ ms.date: 08/30/2017
+
**Settings/ConfigureTaskbarCalendar**
@@ -468,6 +621,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select "Don't show additional calendars" to prevent showing other calendars besides the default calendar for the locale.
@@ -480,6 +642,7 @@ ms.date: 08/30/2017
+
**Settings/PageVisibilityList**
@@ -506,6 +669,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:". Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons.
diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md
index adc515f986..2437d31e21 100644
--- a/windows/client-management/mdm/policy-csp-smartscreen.md
+++ b/windows/client-management/mdm/policy-csp-smartscreen.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - SmartScreen
@@ -14,11 +14,24 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## SmartScreen policies
+
+ -
+ SmartScreen/EnableAppInstallControl
+
+ -
+ SmartScreen/EnableSmartScreenInShell
+
+ -
+ SmartScreen/PreventOverrideForFilesInShell
+
+
+
+
**SmartScreen/EnableAppInstallControl**
@@ -45,6 +58,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.
@@ -55,6 +77,7 @@ ms.date: 08/30/2017
+
**SmartScreen/EnableSmartScreenInShell**
@@ -81,6 +104,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen for Windows.
@@ -91,6 +123,7 @@ ms.date: 08/30/2017
+
**SmartScreen/PreventOverrideForFilesInShell**
@@ -117,6 +150,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.
diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md
index 833057f11a..de1665ee8d 100644
--- a/windows/client-management/mdm/policy-csp-speech.md
+++ b/windows/client-management/mdm/policy-csp-speech.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Speech
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Speech policies
+
+ -
+ Speech/AllowSpeechModelUpdate
+
+
+
+
**Speech/AllowSpeechModelUpdate**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether the device will receive updates to the speech recognition and speech synthesis models. A speech model contains data used by the speech engine to convert audio to text (or vice-versa). The models are periodically updated to improve accuracy and performance. Models are non-executable data files. If enabled, the device will periodically check for updated speech models and then download them from a Microsoft service using the Background Internet Transfer Service (BITS).
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md
index 75e90f86a0..f73f1b8331 100644
--- a/windows/client-management/mdm/policy-csp-start.md
+++ b/windows/client-management/mdm/policy-csp-start.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Start
@@ -14,11 +14,99 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Start policies
+
+ -
+ Start/AllowPinnedFolderDocuments
+
+ -
+ Start/AllowPinnedFolderDownloads
+
+ -
+ Start/AllowPinnedFolderFileExplorer
+
+ -
+ Start/AllowPinnedFolderHomeGroup
+
+ -
+ Start/AllowPinnedFolderMusic
+
+ -
+ Start/AllowPinnedFolderNetwork
+
+ -
+ Start/AllowPinnedFolderPersonalFolder
+
+ -
+ Start/AllowPinnedFolderPictures
+
+ -
+ Start/AllowPinnedFolderSettings
+
+ -
+ Start/AllowPinnedFolderVideos
+
+ -
+ Start/ForceStartSize
+
+ -
+ Start/HideAppList
+
+ -
+ Start/HideChangeAccountSettings
+
+ -
+ Start/HideFrequentlyUsedApps
+
+ -
+ Start/HideHibernate
+
+ -
+ Start/HideLock
+
+ -
+ Start/HidePowerButton
+
+ -
+ Start/HideRecentJumplists
+
+ -
+ Start/HideRecentlyAddedApps
+
+ -
+ Start/HideRestart
+
+ -
+ Start/HideShutDown
+
+ -
+ Start/HideSignOut
+
+ -
+ Start/HideSleep
+
+ -
+ Start/HideSwitchAccount
+
+ -
+ Start/HideUserTile
+
+ -
+ Start/ImportEdgeAssets
+
+ -
+ Start/NoPinningToTaskbar
+
+ -
+ Start/StartLayout
+
+
+
+
**Start/AllowPinnedFolderDocuments**
@@ -45,6 +133,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Documents shortcut on the Start menu.
@@ -56,6 +153,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderDownloads**
@@ -82,6 +180,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Downloads shortcut on the Start menu.
@@ -93,6 +200,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderFileExplorer**
@@ -119,6 +227,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the File Explorer shortcut on the Start menu.
@@ -130,6 +247,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderHomeGroup**
@@ -156,6 +274,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the HomeGroup shortcut on the Start menu.
@@ -167,6 +294,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderMusic**
@@ -193,6 +321,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Music shortcut on the Start menu.
@@ -204,6 +341,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderNetwork**
@@ -230,6 +368,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Network shortcut on the Start menu.
@@ -241,6 +388,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderPersonalFolder**
@@ -267,6 +415,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the PersonalFolder shortcut on the Start menu.
@@ -278,6 +435,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderPictures**
@@ -304,6 +462,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Pictures shortcut on the Start menu.
@@ -315,6 +482,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderSettings**
@@ -341,6 +509,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Settings shortcut on the Start menu.
@@ -352,6 +529,7 @@ ms.date: 08/30/2017
+
**Start/AllowPinnedFolderVideos**
@@ -378,6 +556,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Videos shortcut on the Start menu.
@@ -389,6 +576,7 @@ ms.date: 08/30/2017
+
**Start/ForceStartSize**
@@ -415,6 +603,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
@@ -432,6 +629,7 @@ ms.date: 08/30/2017
+
**Start/HideAppList**
@@ -458,6 +656,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -483,6 +690,7 @@ ms.date: 08/30/2017
+
**Start/HideChangeAccountSettings**
@@ -509,6 +717,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Change account settings" from appearing in the user tile.
@@ -524,6 +741,7 @@ ms.date: 08/30/2017
+
**Start/HideFrequentlyUsedApps**
@@ -550,6 +768,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -572,6 +799,7 @@ ms.date: 08/30/2017
+
**Start/HideHibernate**
@@ -598,6 +826,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Hibernate" from appearing in the Power button.
@@ -616,6 +853,7 @@ ms.date: 08/30/2017
+
**Start/HideLock**
@@ -642,6 +880,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Lock" from appearing in the user tile.
@@ -657,6 +904,7 @@ ms.date: 08/30/2017
+
**Start/HidePowerButton**
@@ -683,6 +931,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -701,6 +958,7 @@ ms.date: 08/30/2017
+
**Start/HideRecentJumplists**
@@ -727,6 +985,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -752,6 +1019,7 @@ ms.date: 08/30/2017
+
**Start/HideRecentlyAddedApps**
@@ -778,6 +1046,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -800,6 +1077,7 @@ ms.date: 08/30/2017
+
**Start/HideRestart**
@@ -826,6 +1104,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Restart" and "Update and restart" from appearing in the Power button.
@@ -841,6 +1128,7 @@ ms.date: 08/30/2017
+
**Start/HideShutDown**
@@ -867,6 +1155,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Shut down" and "Update and shut down" from appearing in the Power button.
@@ -882,6 +1179,7 @@ ms.date: 08/30/2017
+
**Start/HideSignOut**
@@ -908,6 +1206,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Sign out" from appearing in the user tile.
@@ -923,6 +1230,7 @@ ms.date: 08/30/2017
+
**Start/HideSleep**
@@ -949,6 +1257,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Sleep" from appearing in the Power button.
@@ -964,6 +1281,7 @@ ms.date: 08/30/2017
+
**Start/HideSwitchAccount**
@@ -990,6 +1308,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Switch account" from appearing in the user tile.
@@ -1005,6 +1332,7 @@ ms.date: 08/30/2017
+
**Start/HideUserTile**
@@ -1031,6 +1359,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -1050,6 +1387,7 @@ ms.date: 08/30/2017
+
**Start/ImportEdgeAssets**
@@ -1076,6 +1414,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy requires reboot to take effect.
@@ -1096,6 +1443,7 @@ ms.date: 08/30/2017
+
**Start/NoPinningToTaskbar**
@@ -1122,6 +1470,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure the taskbar by disabling pinning and unpinning apps on the taskbar.
@@ -1140,6 +1497,7 @@ ms.date: 08/30/2017
+
**Start/StartLayout**
@@ -1166,6 +1524,16 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
> [!IMPORTANT]
> This node is set on a per-user basis and must be accessed using the following paths:
diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md
index e73be79d8b..f7485274a3 100644
--- a/windows/client-management/mdm/policy-csp-storage.md
+++ b/windows/client-management/mdm/policy-csp-storage.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Storage
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Storage policies
+
+ -
+ Storage/EnhancedStorageDevices
+
+
+
+
**Storage/EnhancedStorageDevices**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting configures whether or not Windows will activate an Enhanced Storage device.
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md
index a6ffde5756..e525611653 100644
--- a/windows/client-management/mdm/policy-csp-system.md
+++ b/windows/client-management/mdm/policy-csp-system.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 09/20/2017
+ms.date: 09/29/2017
---
# Policy CSP - System
@@ -14,11 +14,54 @@ ms.date: 09/20/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## System policies
+
+ -
+ System/AllowBuildPreview
+
+ -
+ System/AllowEmbeddedMode
+
+ -
+ System/AllowExperimentation
+
+ -
+ System/AllowFontProviders
+
+ -
+ System/AllowLocation
+
+ -
+ System/AllowStorageCard
+
+ -
+ System/AllowTelemetry
+
+ -
+ System/AllowUserToResetPhone
+
+ -
+ System/BootStartDriverInitialization
+
+ -
+ System/DisableOneDriveFileSync
+
+ -
+ System/DisableSystemRestore
+
+ -
+ System/LimitEnhancedDiagnosticDataWindowsAnalytics
+
+ -
+ System/TelemetryProxy
+
+
+
+
**System/AllowBuildPreview**
@@ -45,6 +88,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy setting applies only to devices running Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, Windows 10 Mobile, and Windows 10 Mobile Enterprise.
@@ -62,6 +114,7 @@ ms.date: 09/20/2017
+
**System/AllowEmbeddedMode**
@@ -88,6 +141,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether set general purpose device to be in embedded mode.
@@ -100,6 +162,7 @@ ms.date: 09/20/2017
+
**System/AllowExperimentation**
@@ -126,6 +189,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is not supported in Windows 10, version 1607.
@@ -142,6 +214,7 @@ ms.date: 09/20/2017
+
**System/AllowFontProviders**
@@ -168,6 +241,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
@@ -189,6 +271,7 @@ ms.date: 09/20/2017
+
**System/AllowLocation**
@@ -215,6 +298,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to allow app access to the Location service.
@@ -234,6 +326,7 @@ ms.date: 09/20/2017
+
**System/AllowStorageCard**
@@ -260,6 +353,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card.
@@ -272,6 +374,7 @@ ms.date: 09/20/2017
+
**System/AllowTelemetry**
@@ -298,6 +401,16 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
Allow the device to send diagnostic and usage telemetry data, such as Watson.
@@ -378,6 +491,7 @@ Windows 10 Values:
+
**System/AllowUserToResetPhone**
@@ -404,6 +518,15 @@ Windows 10 Values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination.
@@ -416,6 +539,7 @@ Windows 10 Values:
+
**System/BootStartDriverInitialization**
@@ -442,6 +566,15 @@ Windows 10 Values:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
N/A
@@ -460,6 +593,7 @@ ADMX Info:
+
**System/DisableOneDriveFileSync**
@@ -486,6 +620,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting:
@@ -510,6 +653,7 @@ ADMX Info:
+
**System/DisableSystemRestore**
@@ -536,6 +680,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows you to disable System Restore.
@@ -566,6 +719,7 @@ ADMX Info:
+
**System/LimitEnhancedDiagnosticDataWindowsAnalytics**
@@ -592,6 +746,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting, in combination with the System/AllowTelemetry
policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services.
@@ -608,9 +771,9 @@ ADMX Info:
If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.
-
+
**System/TelemetryProxy**
@@ -637,6 +800,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *<server>:<port>*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md
index 08041394b9..fde893e7ec 100644
--- a/windows/client-management/mdm/policy-csp-textinput.md
+++ b/windows/client-management/mdm/policy-csp-textinput.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - TextInput
@@ -14,11 +14,54 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## TextInput policies
+
+ -
+ TextInput/AllowIMELogging
+
+ -
+ TextInput/AllowIMENetworkAccess
+
+ -
+ TextInput/AllowInputPanel
+
+ -
+ TextInput/AllowJapaneseIMESurrogatePairCharacters
+
+ -
+ TextInput/AllowJapaneseIVSCharacters
+
+ -
+ TextInput/AllowJapaneseNonPublishingStandardGlyph
+
+ -
+ TextInput/AllowJapaneseUserDictionary
+
+ -
+ TextInput/AllowKeyboardTextSuggestions
+
+ -
+ TextInput/AllowKoreanExtendedHanja
+
+ -
+ TextInput/AllowLanguageFeaturesUninstall
+
+ -
+ TextInput/ExcludeJapaneseIMEExceptJIS0208
+
+ -
+ TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC
+
+ -
+ TextInput/ExcludeJapaneseIMEExceptShiftJIS
+
+
+
+
**TextInput/AllowIMELogging**
@@ -45,6 +88,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -61,6 +113,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowIMENetworkAccess**
@@ -87,6 +140,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -103,6 +165,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowInputPanel**
@@ -129,6 +192,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -145,6 +217,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowJapaneseIMESurrogatePairCharacters**
@@ -171,6 +244,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -187,6 +269,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowJapaneseIVSCharacters**
@@ -213,6 +296,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -229,6 +321,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowJapaneseNonPublishingStandardGlyph**
@@ -255,6 +348,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -271,6 +373,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowJapaneseUserDictionary**
@@ -297,6 +400,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -313,6 +425,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowKeyboardTextSuggestions**
@@ -339,6 +452,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -360,6 +482,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowKoreanExtendedHanja**
@@ -368,6 +491,7 @@ ms.date: 08/30/2017
+
**TextInput/AllowLanguageFeaturesUninstall**
@@ -394,6 +518,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -410,6 +543,7 @@ ms.date: 08/30/2017
+
**TextInput/ExcludeJapaneseIMEExceptJIS0208**
@@ -436,6 +570,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -450,6 +593,7 @@ ms.date: 08/30/2017
+
**TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC**
@@ -476,6 +620,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
@@ -490,6 +643,7 @@ ms.date: 08/30/2017
+
**TextInput/ExcludeJapaneseIMEExceptShiftJIS**
@@ -516,6 +670,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md
index 5eba1aac1c..5da538c24a 100644
--- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md
+++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - TimeLanguageSettings
@@ -14,11 +14,18 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## TimeLanguageSettings policies
+
+ -
+ TimeLanguageSettings/AllowSet24HourClock
+
+
+
+
**TimeLanguageSettings/AllowSet24HourClock**
@@ -45,6 +52,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting.
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index acd676eecb..1d27aafdd8 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 09/20/2017
+ms.date: 09/29/2017
---
# Policy CSP - Update
@@ -14,11 +14,150 @@ ms.date: 09/20/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Update policies
+
+ -
+ Update/ActiveHoursEnd
+
+ -
+ Update/ActiveHoursMaxRange
+
+ -
+ Update/ActiveHoursStart
+
+ -
+ Update/AllowAutoUpdate
+
+ -
+ Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
+
+ -
+ Update/AllowMUUpdateService
+
+ -
+ Update/AllowNonMicrosoftSignedUpdate
+
+ -
+ Update/AllowUpdateService
+
+ -
+ Update/AutoRestartDeadlinePeriodInDays
+
+ -
+ Update/AutoRestartNotificationSchedule
+
+ -
+ Update/AutoRestartRequiredNotificationDismissal
+
+ -
+ Update/BranchReadinessLevel
+
+ -
+ Update/DeferFeatureUpdatesPeriodInDays
+
+ -
+ Update/DeferQualityUpdatesPeriodInDays
+
+ -
+ Update/DeferUpdatePeriod
+
+ -
+ Update/DeferUpgradePeriod
+
+ -
+ Update/DetectionFrequency
+
+ -
+ Update/DisableDualScan
+
+ -
+ Update/EngagedRestartDeadline
+
+ -
+ Update/EngagedRestartSnoozeSchedule
+
+ -
+ Update/EngagedRestartTransitionSchedule
+
+ -
+ Update/ExcludeWUDriversInQualityUpdate
+
+ -
+ Update/FillEmptyContentUrls
+
+ -
+ Update/IgnoreMOAppDownloadLimit
+
+ -
+ Update/IgnoreMOUpdateDownloadLimit
+
+ -
+ Update/PauseDeferrals
+
+ -
+ Update/PauseFeatureUpdates
+
+ -
+ Update/PauseFeatureUpdatesStartTime
+
+ -
+ Update/PauseQualityUpdates
+
+ -
+ Update/PauseQualityUpdatesStartTime
+
+ -
+ Update/RequireDeferUpgrade
+
+ -
+ Update/RequireUpdateApproval
+
+ -
+ Update/ScheduleImminentRestartWarning
+
+ -
+ Update/ScheduleRestartWarning
+
+ -
+ Update/ScheduledInstallDay
+
+ -
+ Update/ScheduledInstallEveryWeek
+
+ -
+ Update/ScheduledInstallFirstWeek
+
+ -
+ Update/ScheduledInstallFourthWeek
+
+ -
+ Update/ScheduledInstallSecondWeek
+
+ -
+ Update/ScheduledInstallThirdWeek
+
+ -
+ Update/ScheduledInstallTime
+
+ -
+ Update/SetAutoRestartNotificationDisable
+
+ -
+ Update/SetEDURestart
+
+ -
+ Update/UpdateServiceUrl
+
+ -
+ Update/UpdateServiceUrlAlternate
+
+
+
+
**Update/ActiveHoursEnd**
@@ -45,6 +184,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time.
@@ -57,6 +205,7 @@ ms.date: 09/20/2017
+
**Update/ActiveHoursMaxRange**
@@ -83,6 +232,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time.
@@ -92,6 +250,7 @@ ms.date: 09/20/2017
+
**Update/ActiveHoursStart**
@@ -118,6 +277,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time.
@@ -130,6 +298,7 @@ ms.date: 09/20/2017
+
**Update/AllowAutoUpdate**
@@ -156,6 +325,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Enables the IT admin to manage automatic update behavior to scan, download, and install updates.
@@ -178,6 +356,7 @@ ms.date: 09/20/2017
+
**Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork**
@@ -204,6 +383,15 @@ ms.date: 09/20/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Option to download updates automatically over metered connections (off by default). Value type is integer.
@@ -213,8 +401,10 @@ ms.date: 09/20/2017
A significant number of devices primarily use cellular data and do not have Wi-Fi access, which leads to a lower number of devices getting updates. Since a large number of devices have large data plans or unlimited data, this policy can unblock devices from getting updates.
This policy is accessible through the Update setting in the user interface or Group Policy.
+
+
**Update/AllowMUUpdateService**
@@ -241,6 +431,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update.
@@ -251,6 +450,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/AllowNonMicrosoftSignedUpdate**
@@ -277,6 +477,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution.
@@ -291,6 +500,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/AllowUpdateService**
@@ -317,6 +527,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Windows Store.
@@ -334,6 +553,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/AutoRestartDeadlinePeriodInDays**
@@ -360,6 +580,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy defines the deadline in days after which a reboot for updates will become mandatory.
@@ -369,6 +598,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/AutoRestartNotificationSchedule**
@@ -395,6 +625,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications.
@@ -404,6 +643,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/AutoRestartRequiredNotificationDismissal**
@@ -430,6 +670,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto-restart required notification is dismissed.
@@ -440,6 +689,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/BranchReadinessLevel**
@@ -466,6 +716,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from.
@@ -477,9 +736,9 @@ This policy is accessible through the Update setting in the user interface or Gr
- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted).
- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel.
-
+
**Update/DeferFeatureUpdatesPeriodInDays**
@@ -506,6 +765,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -518,6 +786,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/DeferQualityUpdatesPeriodInDays**
@@ -544,6 +813,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days.
@@ -551,6 +829,7 @@ This policy is accessible through the Update setting in the user interface or Gr
+
**Update/DeferUpdatePeriod**
@@ -577,6 +856,15 @@ This policy is accessible through the Update setting in the user interface or Gr
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices.
@@ -675,6 +963,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/DeferUpgradePeriod**
@@ -701,6 +990,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -718,6 +1016,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/DetectionFrequency**
@@ -744,11 +1043,21 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours.
+
**Update/DisableDualScan**
@@ -775,6 +1084,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709, but was added to 1607 and 1703 service releases. Do not allow update deferral policies to cause scans against Windows Update. If this policy is not enabled, then configuring deferral policies will result in the client unexpectedly scanning Windows update. With the policy enabled, those scans are prevented, and users can configure deferral policies as much as they like.
@@ -789,6 +1107,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/EngagedRestartDeadline**
@@ -815,6 +1134,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (pending user scheduling).
@@ -824,6 +1152,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/EngagedRestartSnoozeSchedule**
@@ -850,6 +1179,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications.
@@ -859,6 +1197,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/EngagedRestartTransitionSchedule**
@@ -885,6 +1224,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
@@ -894,6 +1242,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ExcludeWUDriversInQualityUpdate**
@@ -920,6 +1269,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -933,6 +1291,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/FillEmptyContentUrls**
@@ -959,6 +1318,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in the April service release of Windows 10, version 1607. Allows Windows Update Agent to determine the download URL when it is missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL).
@@ -972,6 +1340,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/IgnoreMOAppDownloadLimit**
@@ -998,6 +1367,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
@@ -1021,6 +1399,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/IgnoreMOUpdateDownloadLimit**
@@ -1047,6 +1426,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
@@ -1068,6 +1456,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/PauseDeferrals**
@@ -1094,6 +1483,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices.
@@ -1112,6 +1510,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/PauseFeatureUpdates**
@@ -1138,6 +1537,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -1151,6 +1559,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/PauseFeatureUpdatesStartTime**
@@ -1177,6 +1586,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates.
@@ -1184,6 +1602,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/PauseQualityUpdates**
@@ -1210,6 +1629,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates.
@@ -1220,6 +1648,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/PauseQualityUpdatesStartTime**
@@ -1246,6 +1675,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates.
@@ -1253,6 +1691,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/RequireDeferUpgrade**
@@ -1279,6 +1718,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices.
@@ -1293,6 +1741,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/RequireUpdateApproval**
@@ -1319,6 +1768,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead.
@@ -1335,6 +1793,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduleImminentRestartWarning**
@@ -1361,6 +1820,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications.
@@ -1370,6 +1838,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduleRestartWarning**
@@ -1396,6 +1865,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -1409,6 +1887,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallDay**
@@ -1435,6 +1914,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Enables the IT admin to schedule the day of the update installation.
@@ -1455,6 +1943,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallEveryWeek**
@@ -1481,6 +1970,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values:
@@ -1490,6 +1988,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallFirstWeek**
@@ -1516,6 +2015,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. Supported values:
@@ -1525,6 +2033,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallFourthWeek**
@@ -1551,6 +2060,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. Supported values:
@@ -1560,6 +2078,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallSecondWeek**
@@ -1586,6 +2105,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. Supported values:
@@ -1595,6 +2123,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallThirdWeek**
@@ -1621,6 +2150,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. Supported values:
@@ -1630,6 +2168,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/ScheduledInstallTime**
@@ -1656,6 +2195,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -1673,6 +2221,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/SetAutoRestartNotificationDisable**
@@ -1699,6 +2248,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allows the IT Admin to disable auto-restart notifications for update installations.
@@ -1709,6 +2267,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/SetEDURestart**
@@ -1735,6 +2294,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. For devices in a cart, this policy skips the check for battery level to ensure that the reboot will happen at ScheduledInstallTime.
@@ -1745,6 +2313,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
**Update/UpdateServiceUrl**
@@ -1771,6 +2340,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
> [!Important]
> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Mobile.
@@ -1804,6 +2382,7 @@ Example
+
**Update/UpdateServiceUrlAlternate**
@@ -1830,6 +2409,15 @@ Example
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md
index 7d019f9c35..e035750dfa 100644
--- a/windows/client-management/mdm/policy-csp-wifi.md
+++ b/windows/client-management/mdm/policy-csp-wifi.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - Wifi
@@ -14,11 +14,36 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Wifi policies
+
+ -
+ WiFi/AllowWiFiHotSpotReporting
+
+ -
+ Wifi/AllowAutoConnectToWiFiSenseHotspots
+
+ -
+ Wifi/AllowInternetSharing
+
+ -
+ Wifi/AllowManualWiFiConfiguration
+
+ -
+ Wifi/AllowWiFi
+
+ -
+ Wifi/AllowWiFiDirect
+
+ -
+ Wifi/WLANScanMode
+
+
+
+
**WiFi/AllowWiFiHotSpotReporting**
@@ -27,6 +52,7 @@ ms.date: 08/30/2017
+
**Wifi/AllowAutoConnectToWiFiSenseHotspots**
@@ -53,6 +79,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allow or disallow the device to automatically connect to Wi-Fi hotspots.
@@ -65,6 +100,7 @@ ms.date: 08/30/2017
+
**Wifi/AllowInternetSharing**
@@ -91,6 +127,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allow or disallow internet sharing.
@@ -103,6 +148,7 @@ ms.date: 08/30/2017
+
**Wifi/AllowManualWiFiConfiguration**
@@ -129,6 +175,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks.
@@ -144,6 +199,7 @@ ms.date: 08/30/2017
+
**Wifi/AllowWiFi**
@@ -170,6 +226,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allow or disallow WiFi connection.
@@ -182,6 +247,7 @@ ms.date: 08/30/2017
+
**Wifi/AllowWiFiDirect**
@@ -208,6 +274,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. Allow WiFi Direct connection..
@@ -216,6 +291,7 @@ ms.date: 08/30/2017
+
**Wifi/WLANScanMode**
@@ -242,6 +318,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected.
diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
index ba85960f84..d47b897f44 100644
--- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
+++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - WindowsDefenderSecurityCenter
@@ -14,11 +14,57 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## WindowsDefenderSecurityCenter policies
+
+ -
+ WindowsDefenderSecurityCenter/CompanyName
+
+ -
+ WindowsDefenderSecurityCenter/DisableAppBrowserUI
+
+ -
+ WindowsDefenderSecurityCenter/DisableEnhancedNotifications
+
+ -
+ WindowsDefenderSecurityCenter/DisableFamilyUI
+
+ -
+ WindowsDefenderSecurityCenter/DisableHealthUI
+
+ -
+ WindowsDefenderSecurityCenter/DisableNetworkUI
+
+ -
+ WindowsDefenderSecurityCenter/DisableNotifications
+
+ -
+ WindowsDefenderSecurityCenter/DisableVirusUI
+
+ -
+ WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
+
+ -
+ WindowsDefenderSecurityCenter/Email
+
+ -
+ WindowsDefenderSecurityCenter/EnableCustomizedToasts
+
+ -
+ WindowsDefenderSecurityCenter/EnableInAppCustomization
+
+ -
+ WindowsDefenderSecurityCenter/Phone
+
+ -
+ WindowsDefenderSecurityCenter/URL
+
+
+
+
**WindowsDefenderSecurityCenter/CompanyName**
@@ -45,6 +91,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options.
@@ -52,6 +107,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableAppBrowserUI**
@@ -78,6 +134,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
@@ -88,6 +153,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableEnhancedNotifications**
@@ -114,6 +180,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy if you want Windows Defender Security Center to only display notifications which are considered critical. If you disable or do not configure this setting, Windows Defender Security Center will display critical and non-critical notifications to users.
@@ -127,6 +202,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableFamilyUI**
@@ -153,6 +229,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
@@ -163,6 +248,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableHealthUI**
@@ -189,6 +275,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
@@ -199,6 +294,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableNetworkUI**
@@ -225,6 +321,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
@@ -235,6 +340,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableNotifications**
@@ -261,6 +367,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. If you disable or do not configure this setting, Windows Defender Security Center notifications will display on devices.
@@ -271,6 +386,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisableVirusUI**
@@ -297,6 +413,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
@@ -307,6 +432,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride**
@@ -333,6 +459,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area.
@@ -343,6 +478,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/Email**
@@ -369,6 +505,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. The email address that is displayed to users. The default mail application is used to initiate email actions. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
@@ -376,6 +521,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/EnableCustomizedToasts**
@@ -402,6 +548,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. Enable this policy to display your company name and contact options in the notifications. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will display a default notification text.
@@ -412,6 +567,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/EnableInAppCustomization**
@@ -438,6 +594,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709.Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will not display the contact card fly out notification.
@@ -448,6 +613,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/Phone**
@@ -474,6 +640,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. The phone number or Skype ID that is displayed to users. Skype is used to initiate the call. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
@@ -481,6 +656,7 @@ ms.date: 08/30/2017
+
**WindowsDefenderSecurityCenter/URL**
@@ -507,6 +683,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1709. The help portal URL this is displayed to users. The default browser is used to initiate this action. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options.
diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
index 32d34d88ec..43176e2f15 100644
--- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
+++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - WindowsInkWorkspace
@@ -14,11 +14,21 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## WindowsInkWorkspace policies
+
+ -
+ WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
+
+ -
+ WindowsInkWorkspace/AllowWindowsInkWorkspace
+
+
+
+
**WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace**
@@ -45,6 +55,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Show recommended app suggestions in the ink workspace.
@@ -55,6 +74,7 @@ ms.date: 08/30/2017
+
**WindowsInkWorkspace/AllowWindowsInkWorkspace**
@@ -81,6 +101,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Specifies whether to allow the user to access the ink workspace.
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md
index 22b96181e5..71a5e7e63a 100644
--- a/windows/client-management/mdm/policy-csp-windowslogon.md
+++ b/windows/client-management/mdm/policy-csp-windowslogon.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - WindowsLogon
@@ -14,11 +14,24 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## WindowsLogon policies
+
+ -
+ WindowsLogon/DisableLockScreenAppNotifications
+
+ -
+ WindowsLogon/DontDisplayNetworkSelectionUI
+
+ -
+ WindowsLogon/HideFastUserSwitching
+
+
+
+
**WindowsLogon/DisableLockScreenAppNotifications**
@@ -45,6 +58,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to prevent app notifications from appearing on the lock screen.
@@ -69,6 +91,7 @@ ADMX Info:
+
**WindowsLogon/DontDisplayNetworkSelectionUI**
@@ -95,6 +118,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.
@@ -119,6 +151,7 @@ ADMX Info:
+
**WindowsLogon/HideFastUserSwitching**
@@ -145,6 +178,15 @@ ADMX Info:
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations.
diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md
index ea09c4b3c7..0d7ab2b543 100644
--- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md
+++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 08/30/2017
+ms.date: 09/29/2017
---
# Policy CSP - WirelessDisplay
@@ -14,11 +14,33 @@ ms.date: 08/30/2017
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## WirelessDisplay policies
+
+ -
+ WirelessDisplay/AllowProjectionFromPC
+
+ -
+ WirelessDisplay/AllowProjectionFromPCOverInfrastructure
+
+ -
+ WirelessDisplay/AllowProjectionToPC
+
+ -
+ WirelessDisplay/AllowProjectionToPCOverInfrastructure
+
+ -
+ WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
+
+ -
+ WirelessDisplay/RequirePinForPairing
+
+
+
+
**WirelessDisplay/AllowProjectionFromPC**
@@ -45,6 +67,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC.
@@ -53,6 +84,7 @@ ms.date: 08/30/2017
+
**WirelessDisplay/AllowProjectionFromPCOverInfrastructure**
@@ -79,6 +111,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC over infrastructure.
@@ -87,6 +128,7 @@ ms.date: 08/30/2017
+
**WirelessDisplay/AllowProjectionToPC**
@@ -113,6 +155,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allow or disallow turning off the projection to a PC.
@@ -125,6 +176,7 @@ ms.date: 08/30/2017
+
**WirelessDisplay/AllowProjectionToPCOverInfrastructure**
@@ -151,6 +203,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703. This policy setting allows you to turn off projection to a PC over infrastructure.
@@ -159,14 +220,25 @@ ms.date: 08/30/2017
+
**WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver**
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1703.
+
**WirelessDisplay/RequirePinForPairing**
@@ -193,6 +265,15 @@ ms.date: 08/30/2017
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
Added in Windows 10, version 1607. Allow or disallow requirement for a PIN for pairing.
diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md
index 2ae59c5ff4..0d86e0c76d 100644
--- a/windows/threat-protection/TOC.md
+++ b/windows/threat-protection/TOC.md
@@ -124,6 +124,7 @@
#### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md)
#### [Enable Threat intel API](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md)
#### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
+#### [Enable Security Analytics security controls](windows-defender-atp\enable-security-analytics-windows-defender-advanced-threat-protection.md)
### [Windows Defender ATP settings](windows-defender-atp\settings-windows-defender-advanced-threat-protection.md)
### [Windows Defender ATP service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md)
### [Troubleshoot Windows Defender ATP](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md)
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
index 77b79508b8..10b03b87a5 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
@@ -61,7 +61,7 @@ By default, Windows Defender AV is installed and functional on Windows Server 20
If the interface is not installed, you can add it in the **Add Roles and Features Wizard** at the **Features** step, under **Windows Defender Features** by selecting the **GUI for Windows Defender** option.
-
+
See the [Install or uninstall roles, role services, or features](https://docs.microsoft.com/en-us/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features) topic for information on using the wizard.
diff --git a/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..a95a52eb1d
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,49 @@
+---
+title: Enable Security Analytics in Windows Defender ATP
+description: Set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard.
+keywords: enable security analytics, baseline, calculation, analytics, score, security analytics dashboard, dashboard
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 09/05/2017
+---
+
+# Enable Security Analytics security controls
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
+
+ >[!NOTE]
+ >Changes might take up to a few hours to reflect on the dashboard.
+
+1. In the navigation pane, select **Preferences setup** > **Security Analytics**.
+
+ 
+
+2. Select the security control, then toggle the setting between **On** and **Off**.
+
+3. Click **Save preferences**.
+
+## Related topics
+- [View the Security Analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+- [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md)
+- [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
+- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
+- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
+- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
+- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png b/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png
new file mode 100644
index 0000000000..4005404aff
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png b/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png
new file mode 100644
index 0000000000..9d8ae5a5cd
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-improv-opps.png b/windows/threat-protection/windows-defender-atp/images/atp-improv-opps.png
new file mode 100644
index 0000000000..0f5ef13a77
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-improv-opps.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png b/windows/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png
new file mode 100644
index 0000000000..9cbf01f81a
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png differ
diff --git a/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
index fb13f00579..26057dc724 100644
--- a/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
title: View the Security Analytics dashboard in Windows Defender ATP
description: Use the Security Analytics dashboard to assess and improve the security state of your organization by analyzing various security control tiles.
-keywords: security analytics, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverate, security control, improvement opportunities, edr, antivirus, av, os security updates
+keywords: security analytics, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverage, security control, improvement opportunities, edr, antivirus, av, os security updates
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 09/05/2017
+ms.date: 10/02/2017
---
# View the Windows Defender Advanced Threat Protection Security analytics dashboard
@@ -33,37 +33,41 @@ The **Security analytics dashboard** displays a snapshot of:
- Organizational security score
- Security coverage
- Improvement opportunities
+- Security score over time
-
+
## Organizational security score
The organization security score is reflective of the average score of all the Windows Defender security controls that are configured according to the recommended baseline. You can improve this score by taking the steps in configuring each of the security controls in the optimal settings.
-
+
-Each Windows Defender security control from the **Security coverage** tile contributes 100 points to the organizational security score.
+Each Windows Defender security control from the **Security coverage** tile contributes 100 points to the organizational security score.
The denominator is reflective of the organizational score potential and calculated by multiplying the number of supported security controls (Security coverage pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar).
-In the example image, the total points from the **Improvement opportunities** tile add up to 279 points for the three pillars from the **Security coverage** tile.
+In the example image, the total points from the **Improvement opportunities** tile add up to 321 points for the six pillars from the **Security coverage** tile.
+
+You can set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard through the **Preferences settings**. For more information, see [Enable Security Analytics security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md).
## Security coverage
-The security coverage tile shows a bar graph where each bar represents a Windows Defender security control. Each bar contributes 100 points to the overall organizational security score. It also represents the various Windows 10 security components with an indicator of the total number of machines that are well configured and those that require attention. Hovering on top of the individual bars will show exact numbers for each category.
+The security coverage tile shows a bar graph where each bar represents a Windows Defender security control. Each bar reflects the number of machines that are well configured and those that require **any kind of attention** for each security control. Hovering on top of the individual bars will show exact numbers for each category. Machines that are green are well configured, while machines that are orange require some level of attention.
-
+
## Improvement opportunities
Improve your organizational security score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control.
Click on each control to see the recommended optimizations.
-
+
The numbers beside the green triangle icon on each recommended action represents the number of points you can gain by taking the action. When added together, the total number makes up the numerator in the fraction for each segment in the Improvement opportunities tile.
-Recommendations that do not display a green action are informational only and no action is required.
+>[!IMPORTANT]
+>Recommendations that do not display a green triangle icon are informational only and no action is required.
Clicking **View machines** in a specific recommendation opens up the **Machines list** with filters applied to show only the list of machines where the the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice.
@@ -71,9 +75,22 @@ The following image shows an example list of machines where the EDR sensor is no
-### Endpoint detection and response (EDR) optimization
-This tile provides a specific list of actions you can take on Windows Defender ATP to improve how endpoints provide sensor data to the Windows Defender ATP service.
+## Security score over time
+You can track the progression of your organizational security posture over time using this tile. It displays the overall and individual control scores in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture.
+
+
+You can click on specific date points to see the total score for that security control is on a particular date.
+
+### Endpoint detection and response (EDR) optimization
+For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for your Endpoint detection and response tool.
+
+#### Minimum baseline configuration setting for EDR:
+- Windows Defender ATP sensor is on
+- Data collection is working correctly
+- Communication to Windows Defender ATP service is not impaired
+
+#### Minimum baseline configuration setting for EDR:
You can take the following actions to increase the overall security score of your organization:
- Turn on sensor
- Fix sensor data collection
@@ -81,9 +98,19 @@ You can take the following actions to increase the overall security score of you
For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
-### Windows Defender Antivirus optimization
-This tile provides a list of specific list of actions you can implement on endpoints with Windows Defender Antivirus to improve the security in your organization. Each action shows the exact number of endpoints where you can apply the action on.
+### Windows Defender Antivirus (Windows Defender AV) optimization
+For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender AV is fulfilled.
+#### Minimum baseline configuration setting for Windows Defender AV:
+Endpoints are considered "well configured" for Windows Defender AV if the following requirements are met:
+
+- Windows Defender AV is reporting correctly
+- Windows Defender AV is turned on
+- Signature definitions are up to date
+- Real-time protection is on
+- Potentially Unwanted Application (PUA) protection is enabled
+
+##### Recommended actions:
You can take the following actions to increase the overall security score of your organization:
>[!NOTE]
@@ -93,7 +120,6 @@ You can take the following actions to increase the overall security score of you
- This recommendation is displayed when the Windows Defender Antivirus is not properly configured to report its health state. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md).
- Turn on antivirus
- Update antivirus definitions
-- Turn on cloud-based protection
- Turn on real-time protection
- Turn on PUA protection
@@ -105,14 +131,115 @@ This tile shows you the exact number of machines that require the latest securit
You can take the following actions to increase the overall security score of your organization:
- Install the latest security updates
+- Fix sensor data collection
+ - The Windows Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. Therefore, it's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
-For more information on, see [Windows Update Troubleshooter](https://support.microsoft.com/en-us/help/4027322/windows-windows-update-troubleshooter).
+For more information, see [Windows Update Troubleshooter](https://support.microsoft.com/en-us/help/4027322/windows-windows-update-troubleshooter).
+### Windows Defender Exploit Guard (Windows Defender EG) optimization
+For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender EG is fulfilled. When endpoints are configured according to the baseline you'll be able to see Windows Defender EG events on the Windows Defender ATP Machine timeline.
+
+#### Minimum baseline configuration setting for Windows Defender EG:
+Endpoints are considered "well configured" for Windows Defender EG if the following requirements are met:
+
+- System level protection settings are configured correctly
+- Attack Surface Reduction rules are configured correctly
+- Controlled Folder Access setting is configured correctly
+
+##### System level protection:
+The following system level configuration settings must be set to **On or Force On**:
+
+1. Control Flow Guard
+2. Data Execution Prevention (DEP)
+3. Randomize memory allocations (Bottom-up ASLR)
+4. Validate exception chains (SEHOP)
+5. Validate heap integrity
+
+>[!NOTE]
+>The setting **Force randomization for images (Mandatory ASLR)** is currently excluded from the baseline.
+>Consider configuring **Force randomization for images (Mandatory ASLR)** to **On or Force On** for better protection.
+
+##### Attack Surface Reduction (ASR) rules:
+The following ASR rules must be configured to **Block mode**:
+
+Rule description | GUIDs
+-|-
+Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
+Block Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
+Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899
+Impede JavaScript and VBScript to launch executables | D3E037E1-3EB8-44C8-A917-57927947596D
+Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
+Block Win32 imports from Macro code in Office | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
+
+
+>[!NOTE]
+>The setting **Block Office applications from injecting into other processes** with GUID 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 is excluded from the baseline.
+>Consider enabling this rule in **Audit** or **Block mode** for better protection.
+
+
+##### Controlled Folder Access
+The Controlled Folder Access setting must be configured to **Audit** or **Block mode**.
+
+>[!NOTE]
+> Audit mode, allows you to see audit events in the Windows Defender ATP Machine timeline however it does not block suspicious applications.
+>Consider enabling Controlled Folder Access for better protection.
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Turn on all system-level Exploit Protection settings
+- Set all ASR rules to enabled or audit mode
+- Turn on Controlled Folder Access
+- Turn on Windows Defender Antivirus on compatible machines
+
+For more information, see [Windows Defender Exploit Guard](../windows-defender-exploit-guard/windows-defender-exploit-guard.md).
+
+### Windows Defender Application Guard (Windows Defender AG) optimization
+For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender AG is fulfilled. When endpoints are configured according to the baseline you'll be able to see Windows Defender AG events on the Windows Defender ATP Machine timeline.
+
+#### Minimum baseline configuration setting for Windows Defender AG:
+Endpoints are considered "well configured" for Windows Defender AG if the following requirements are met:
+
+- Hardware and software prerequisites are met
+- Windows Defender AG is turned on compatible machines
+- Managed mode is turned on
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Ensure hardware and software prerequisites are met
+
+ >[!NOTE]
+ >This improvement item does not contribute to the security score in itself because it's not a prerequisite for Windows Defender AG. It gives an indication of a potential reason why Windows Defender AG is not turned on.
+
+- Turn on Windows Defender AG on compatible machines
+- Turn on managed mode
+
+
+For more information, see [Windows Defender Application Guard overview](../windows-defender-application-guard/wd-app-guard-overview.md).
+
+
+### Windows Defender SmartScreen optimization
+For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender SmartScreen is fulfilled.
+
+#### Minimum baseline configuration setting for Windows Defender SmartScreen:
+The following settings must be configured with the following settings:
+- Check apps and files: **Warn** or **Block**
+- SmartScreen for Microsoft Edge: **Warn** or **Block**
+- SmartScreen for Windows Store apps: **Warn** or **Off**
+
+
+You can take the following actions to increase the overall security score of your organization:
+- Set **Check app and files** to **Warn** or **Block**
+- Set **SmartScreen for Microsoft Edge** to **Warn** or **Block**
+- Set **SmartScreen for Windows Store apps** to **Warn** or **Off**
+
+For more information, see [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md).
+
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink)
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
+- [Enable Security Analytics security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md)
+- [View the Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
index ca4ced3a04..320ea854bf 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
@@ -144,7 +144,7 @@ You can review the Windows event log to see events that are created when an Atta
2. On the left panel, under **Actions**, click **Import custom view...**
- 
+ 
3. Navigate to the Exploit Guard Evaluation Package, and select the file *asr-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
index 9faffd8366..7f728d947a 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
@@ -75,7 +75,7 @@ You can review the Windows event log to see events that are created when Control
3. On the left panel, under **Actions**, click **Import custom view...**
- 
+ 
4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
index 03c00df6f6..47df6f39f0 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
@@ -75,7 +75,7 @@ You can use the Windows Defender Security Center app or Group Policy to add and
4. Click **Add a protected folder** and follow the prompts to add apps.
- 
+ 
### Use Group Policy to protect additional folders
@@ -107,7 +107,7 @@ You can use the Windows Defender Security Center app or Group Policy to add and
Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to add more folders to the list. Folders added using this cmdlet will appear in the Windows Defender Security Center app.
-
+
>[!IMPORTANT]
@@ -144,7 +144,7 @@ When you add an app, you have to specify the app's location. Only the app in tha
4. Click **Add an allowed app** and follow the prompts to add apps.
- 
+ 
### Use Group Policy to whitelist specific apps
@@ -178,7 +178,7 @@ When you add an app, you have to specify the app's location. Only the app in tha
Continue to use `Add-MpPreference -ControlledFolderAccessAllowedApplications` to add more apps to the list. Apps added using this cmdlet will appear in the Windows Defender Security Center app.
-
+
>[!IMPORTANT]
diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
index c837adc81b..1f4767560d 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
@@ -51,25 +51,25 @@ It also describes how to enable or configure the mitigations using Windows Defen
All mitigations can be configured for individual apps. Some mitigations can also be applied at the operating system level.
-You can set each of the mitigations to on, off, or to their default value as indicated in the table below. Some mitigations have additional options, these are indicated in the description in the table.
+You can set each of the mitigations to on, off, or to their default value. Some mitigations have additional options, these are indicated in the description in the table.
Default values are always specified in brackets at the **Use default** option for each mitigation. In the following example, the default for Data Execution Prevention is "On".
-
+
The **Use default** configuration for each of the mitigation settings indicates our recommendation for a base level of protection for everyday usage for home users. Enterprise deployments should consider the protection required for their individual needs and may need to modify configuration away from the defaults.
For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this topic.
-Mitigation | Description | Can be applied to, and default value for system mitigations | Audit mode available
+Mitigation | Description | Can be applied to | Audit mode available
- | - | - | -
-Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)]
-Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)]
-Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level (system default: **Off**) | [!include[Check mark no](images/svg/check-no.md)]
-Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)]
-Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)]
-Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level (system default: **Off**) | [!include[Check mark no](images/svg/check-no.md)]
+Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](images/svg/check-no.md)]
+Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](images/svg/check-no.md)]
+Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](images/svg/check-no.md)]
+Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](images/svg/check-no.md)]
+Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](images/svg/check-no.md)]
+Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](images/svg/check-no.md)]
Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](images/svg/check-yes.md)]
Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](images/svg/check-yes.md)]
Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark yes](images/svg/check-yes.md)]
@@ -127,7 +127,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then the **Exploit protection** label:
- 
+ 
3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here:
- **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
@@ -139,7 +139,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
Changing some settings may required a restart, which will be indicated in red text underneath the setting.
- 
+ 
4. Repeat this for all the system-level mitigations you want to configure.
@@ -154,7 +154,7 @@ Exporting the configuration as an XML file allows you to copy the configuration
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then the **Exploit protection settings** at the bottom of the screen:
- 
+ 
3. Go to the **Program settings** section and choose the app you want to apply mitigations to:
@@ -164,14 +164,14 @@ Exporting the configuration as an XML file allows you to copy the configuration
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
- 
+ 
4. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, click the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
- 
+ 
You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or return to configure system-level mitigations.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
index 7158a21778..c42e32c42f 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
@@ -79,7 +79,7 @@ See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) to
- Disabled = 0
- Audit mode = 2
-
+
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
index 6935d74d73..69153eefb4 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
@@ -60,7 +60,7 @@ For further details on how audit mode works, and when you might want to use it,
3. Set the switch for the feature to **On**
- 
+ 
### Use Group Policy to enable Controlled folder access
@@ -77,7 +77,7 @@ For further details on how audit mode works, and when you might want to use it,
- **Disable (Default)** - The Controlled folder access feature will not work. All apps can make changes to files in protected folders.
- **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization.
- 
+ 
>[!IMPORTANT]
>To fully enable the Controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
index 832df46955..bd2b01af18 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
@@ -57,7 +57,7 @@ This tool has a simple user interface that lets you choose a rule, configure it
When you run a scenario, you will see what the scenario entails, what the rule is set to, and what actions were taken.
-
+
Each scenario creates a fake or sample file or behavior that the rule would target and, if the rule was enabled, block from running.
@@ -99,7 +99,7 @@ Audit | The rule wil fire, but the suspicious behavior will **not** be blocked f
Block mode will cause a notification to appear on the user's desktop:
-
+
You can [modify the notification to display your company name and links](customize-attack-surface-reduction.md#customize-the-notification) for users to obtain more information or contact your IT help desk.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
index c2483edae7..f8829b944e 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
@@ -73,11 +73,11 @@ You can enable Controlled folder access, run the tool, and see what the experien
6. You'll be asked to specify a name and location for the file. You can choose anything you wish to test.
- 
+ 
7. A notification will appear, indicating that the tool was prevented from creating the file, as in the following example:
- 
+ 
## Review Controlled folder access events in Windows Event Viewer
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
index 1d47864477..af1f57f168 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
@@ -64,7 +64,7 @@ You can also carry out the processes described in this topic in audit or disable
You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked.
-
+
## Review Network protection events in Windows Event Viewer
diff --git a/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
index 97a86e7fa9..f3ad3cb57e 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
@@ -47,7 +47,7 @@ You can also manually navigate to the event area that corresponds to the Windows
### Import an existing XML custom view
-1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the appropraite file to an easily accessible location. The following filenames are each of the custom views:
+1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the appropriate file to an easily accessible location. The following filenames are each of the custom views:
- Controlled folder access events custom view: *cfa-events.xml*
- Exploit protection events custom view: *ep-events.xml*
- Attack surface reduction events custom view: *asr-events.xml*
@@ -57,7 +57,7 @@ You can also manually navigate to the event area that corresponds to the Windows
3. On the left panel, under **Actions**, click **Import Custom View...**
- 
+ 
4. Navigate to where you extracted XML file for the custom view you want and select it.
@@ -73,7 +73,7 @@ You can also manually navigate to the event area that corresponds to the Windows
3. On the left panel, under **Actions**, click **Create Custom View...**
- 
+ 
4. Go to the XML tab and click **Edit query manually**. You'll see a warning that you won't be able to edit the query using the **Filter** tab if you use the XML option. Click **Yes**.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
index f9095299df..8b5068a19b 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
@@ -76,7 +76,7 @@ You can review the Windows event log to see events that are created when Exploit
3. On the left panel, under **Actions**, click **Import custom view...**
- 
+ 
4. Navigate to where you extracted *ep-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
diff --git a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
index a4da86a4bc..5e93c9b04e 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
@@ -66,16 +66,15 @@ When you have configured Exploit protection to your desired state (including bot
### Use the Windows Defender Security Center app to export a configuration file
-1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
+1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection settings**:
- 
+ 
3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved.
-
- 
+
>[!NOTE]
>When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections - either section will export all settings.
@@ -151,7 +150,7 @@ You can use Group Policy to deploy the configuration you've created to multiple
5. Expand the tree to **Windows components > Windows Defender Exploit Guard > Exploit protection**.
- 
+ 
6. Double-click the **Use a common set of Exploit protection settings** setting and set the option to **Enabled**.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
index 57473681c2..3f78879c88 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
@@ -70,7 +70,7 @@ You can review the Windows event log to see events that are created when Network
2. On the left panel, under **Actions**, click **Import custom view...**
- 
+ 
3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
diff --git a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md
index 804c2d9152..259af8485e 100644
--- a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md
+++ b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md
@@ -125,11 +125,11 @@ See the following links for more information on the features in the Windows Defe
You can customize notifcations so they show information to users about how to get more help from your organization's help desk.
-
+
This information will also appear as a pop-out window on the Windows Defender Security Center app.
-
+
Users can click on the displayed information to get more help:
- Clicking **Call** or the phone number will open Skype to start a call to the displayed number