diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn index 2794193b88..3e58e829a1 100644 --- a/.acrolinx-config.edn +++ b/.acrolinx-config.edn @@ -39,7 +39,7 @@ For more information about the exception criteria and exception process, see [Mi Select the total score link to review all feedback on clarity, consistency, tone, brand, terms, spelling, grammar, readability, and inclusive language. _You should fix all spelling errors regardless of your total score_. Fixing spelling errors helps maintain customer trust in overall content quality. -| Article | Total score
(Required: 80) | Words + phrases
(Brand, terms) | Correctness
(Spelling, grammar) | Clarity
(Readability) | +| Article | Total score
(Required: 80) | Terminology | Spelling and Grammar| Clarity
(Readability) | |---------|:--------------:|:--------------------:|:------:|:---------:| " diff --git a/.github/workflows/BuildValidation.yml b/.github/workflows/BuildValidation.yml new file mode 100644 index 0000000000..e57844b453 --- /dev/null +++ b/.github/workflows/BuildValidation.yml @@ -0,0 +1,21 @@ +name: PR has no warnings or errors + +permissions: + pull-requests: write + statuses: write + +on: + issue_comment: + types: [created] + +jobs: + + build-status: + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-BuildValidation.yml@workflows-prod + with: + PayloadJson: ${{ toJSON(github) }} + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} + + + diff --git a/.github/workflows/Stale.yml b/.github/workflows/Stale.yml index 101ee8ba9c..82b6875e28 100644 --- a/.github/workflows/Stale.yml +++ b/.github/workflows/Stale.yml @@ -13,7 +13,7 @@ jobs: stale: uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-Stale.yml@workflows-prod with: - RunDebug: true + RunDebug: false RepoVisibility: ${{ github.repository_visibility }} secrets: AccessToken: ${{ secrets.GITHUB_TOKEN }} diff --git a/.openpublishing.build.ps1 b/.openpublishing.build.ps1 deleted file mode 100644 index dd60c684ef..0000000000 --- a/.openpublishing.build.ps1 +++ /dev/null @@ -1,18 +0,0 @@ -param( - [string]$buildCorePowershellUrl = "https://opbuildstoragesandbox2.blob.core.windows.net/opps1container/.openpublishing.buildcore.ps1", - [string]$parameters -) -# Main -$errorActionPreference = 'Stop' - -# Step-1 Download buildcore script to local -echo "download build core script to local with source url: $buildCorePowershellUrl" -$repositoryRoot = Split-Path -Parent $MyInvocation.MyCommand.Definition -$buildCorePowershellDestination = "$repositoryRoot\.openpublishing.buildcore.ps1" -Invoke-WebRequest $buildCorePowershellUrl -OutFile $buildCorePowershellDestination - -# Step-2: Run build core -echo "run build core script with parameters: $parameters" -$arguments = "-parameters:'$parameters'" -Invoke-Expression "$buildCorePowershellDestination $arguments" -exit $LASTEXITCODE \ No newline at end of file diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 0015a87b88..ca6ed75b69 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -251,7 +251,6 @@ ".openpublishing.redirection.browsers.json", ".openpublishing.redirection.education.json", ".openpublishing.redirection.json", - ".openpublishing.redirection.store-for-business.json", ".openpublishing.redirection.windows-application-management.json", ".openpublishing.redirection.windows-client-management.json", ".openpublishing.redirection.windows-configuration.json", diff --git a/.openpublishing.redirection.store-for-business.json b/.openpublishing.redirection.store-for-business.json deleted file mode 100644 index f825112907..0000000000 --- a/.openpublishing.redirection.store-for-business.json +++ /dev/null @@ -1,299 +0,0 @@ -{ - "redirections": [ - { - "source_path": "store-for-business/acquire-apps-windows-store-for-business.md", - "redirect_url": "/microsoft-store/acquire-apps-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/add-unsigned-app-to-code-integrity-policy.md", - "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", - "redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", - "redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/apps-in-windows-store-for-business.md", - "redirect_url": "/microsoft-store/apps-in-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", - "redirect_url": "/microsoft-store/configure-mdm-provider-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/device-guard-signing-portal.md", - "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", - "redirect_url": "/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", - "redirect_url": "/microsoft-store/manage-apps-microsoft-store-for-business-overview", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-mpsa-software-microsoft-store-for-business.md", - "redirect_url": "/microsoft-store/index", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-orders-windows-store-for-business.md", - "redirect_url": "/microsoft-store/manage-orders-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-settings-windows-store-for-business.md", - "redirect_url": "/microsoft-store/manage-settings-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", - "redirect_url": "/microsoft-store/manage-users-and-groups-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/prerequisites-windows-store-for-business.md", - "redirect_url": "/microsoft-store/prerequisites-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", - "redirect_url": "/microsoft-store/roles-and-permissions-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/settings-reference-windows-store-for-business.md", - "redirect_url": "/microsoft-store/settings-reference-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/sign-code-integrity-policy-with-device-guard-signing.md", - "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/sign-up-microsoft-store-for-business.md", - "redirect_url": "/microsoft-store", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", - "redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business-overview", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/sign-up-windows-store-for-business.md", - "redirect_url": "/microsoft-store/index", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/troubleshoot-windows-store-for-business.md", - "redirect_url": "/microsoft-store/troubleshoot-microsoft-store-for-business", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/update-windows-store-for-business-account-settings.md", - "redirect_url": "/microsoft-store/update-microsoft-store-for-business-account-settings", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/windows-store-for-business-overview.md", - "redirect_url": "/microsoft-store/microsoft-store-for-business-overview", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/work-with-partner-microsoft-store-business.md", - "redirect_url": "/microsoft-365/commerce/manage-partners", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/acquire-apps-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/add-profile-to-devices.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/app-inventory-management-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/apps-in-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/assign-apps-to-employees.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/billing-payments-overview.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/billing-profile.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/billing-understand-your-invoice-msfb.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/configure-mdm-provider-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/distribute-apps-from-your-private-store.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/distribute-apps-with-management-tool.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/distribute-offline-apps.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/find-and-acquire-apps-overview.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/index.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-access-to-private-store.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-apps-microsoft-store-for-business-overview.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-orders-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-private-store-settings.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-settings-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/manage-users-and-groups-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/microsoft-store-for-business-education-powershell-module.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/microsoft-store-for-business-overview.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/notifications-microsoft-store-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/payment-methods.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/prerequisites-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/release-history-microsoft-store-business-education.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/roles-and-permissions-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/settings-reference-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/sfb-change-history.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/sign-up-microsoft-store-for-business-overview.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/troubleshoot-microsoft-store-for-business.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/update-microsoft-store-for-business-account-settings.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/whats-new-microsoft-store-business-education.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - }, - { - "source_path": "store-for-business/working-with-line-of-business-apps.md", - "redirect_url": "/microsoft-365/admin/", - "redirect_document_id": false - } - ] -} diff --git a/.openpublishing.redirection.windows-deployment.json b/.openpublishing.redirection.windows-deployment.json index 09479f4eca..7efdfec5ae 100644 --- a/.openpublishing.redirection.windows-deployment.json +++ b/.openpublishing.redirection.windows-deployment.json @@ -1660,10 +1660,35 @@ "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/planning/windows-10-enterprise-faq-itpro", "redirect_document_id": false }, + { + "source_path": "windows/deployment/do/mcc-enterprise-appendix.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/do/mcc-enterprise-deploy.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/do/mcc-enterprise-prerequisites.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/do/mcc-enterprise-update-uninstall.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, { "source_path": "windows/deployment/planning/windows-10-deployment-considerations.md", "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/planning/windows-10-deployment-considerations", "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/monitor/windows-autopatch-reliability-report.md", + "redirect_url": "/windows/deployment/windows-autopatch/monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 94caccffcb..52233f5ad0 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -5,6 +5,11 @@ "redirect_url": "/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md", + "redirect_url": "/windows/security/application-security/application-isolation/windows-sandbox/index", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md", "redirect_url": "/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity", @@ -1427,12 +1432,12 @@ }, { "source_path": "windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md", - "redirect_url": "https:/support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", + "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/password-support-policy.md", - "redirect_url": "https:/support.microsoft.com/help/4490115", + "redirect_url": "https://support.microsoft.com/help/4490115", "redirect_document_id": false }, { @@ -3202,7 +3207,7 @@ }, { "source_path": "windows/security/threat-protection/device-guard/memory-integrity.md", - "redirect_url": "https:/support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78", + "redirect_url": "https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78", "redirect_document_id": false }, { @@ -5857,7 +5862,7 @@ }, { "source_path": "windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md", - "redirect_url": "https:/feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", + "redirect_url": "https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", "redirect_document_id": false }, { @@ -6762,12 +6767,12 @@ }, { "source_path": "windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", - "redirect_url": "https:/www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/", + "redirect_url": "https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-10-mobile-security-guide.md", - "redirect_url": "https:/support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", + "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", "redirect_document_id": false }, { @@ -7802,7 +7807,7 @@ }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md", - "redirect_url": "https:/aka.ms/AzureCodeSigning", + "redirect_url": "https://aka.ms/AzureCodeSigning", "redirect_document_id": false }, { @@ -9322,7 +9327,7 @@ }, { "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", - "redirect_url": "https:/feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", + "redirect_url": "https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx", "redirect_document_id": false }, { @@ -9937,27 +9942,27 @@ }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md", - "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md", - "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md", - "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-4-enterprise-devops-security.md", - "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-5-enterprise-administrator-security.md", - "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", "redirect_document_id": false }, { @@ -9967,7 +9972,7 @@ }, { "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md", - "redirect_url": "https:/github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", "redirect_document_id": false }, { @@ -9982,7 +9987,47 @@ }, { "source_path": "windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", - "redirect_url": "/windows/security/application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol.md", + "redirect_url": "/windows/security/application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/index.md", + "redirect_url": "/windows/security/book/application-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/hardware-security/index.md", + "redirect_url": "/windows/security/book/hardware-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/cloud-services/index.md", + "redirect_url": "/windows/security/book/cloud-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/index.md", + "redirect_url": "/windows/security/book/identity-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/index.md", + "redirect_url": "/windows/security/book/operating-system-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/security-foundations/index.md", + "redirect_url": "/windows/security/book/security-foundation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/introduction.md", + "redirect_url": "/windows/security/book", + "redirect_document_id": false + }, + { + "source_path": "windows/security/security-foundations/zero-trust-windows-device-health.md", + "redirect_url": "/windows/security/book/security-foundation", "redirect_document_id": false } ] diff --git a/README.md b/README.md index 98c771d56d..97874f3f91 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ Anyone who is interested can contribute to the topics. When you contribute, your ### Quickly update an article using GitHub.com -Contributors who only make infrequent or small updates can edit the file directly on GitHub.com without having to install any additional software. This article shows you how. [This two-minute video](https://www.microsoft.com/videoplayer/embed/RE1XQTG) also covers how to contribute. +Contributors who only make infrequent or small updates can edit the file directly on GitHub.com without having to install any additional software. This article shows you how. [This two-minute video](https://learn-video.azurefd.net/vod/player?id=b5167c5a-9c69-499b-99ac-e5467882bc92) also covers how to contribute. 1. Make sure you're signed in to GitHub.com with your GitHub account. 2. Browse to the page you want to edit on Microsoft Learn. diff --git a/education/docfx.json b/education/docfx.json index cc2b912248..8a348ff39f 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -52,15 +52,18 @@ "titleSuffix": "Windows Education", "contributors_to_exclude": [ "dstrome2", - "rjagiewich", - "American-Dipper", - "claydetels19", + "rjagiewich", + "American-Dipper", + "claydetels19", "jborsecnik", "v-stchambers", "shdyas", - "Stacyrch140", + "Stacyrch140", "garycentric", - "dstrome" + "dstrome", + "padmagit77", + "aditisrivastava07", + "Ruchika-mittal01" ] }, "fileMetadata": { @@ -77,4 +80,4 @@ "dest": "education", "markdownEngineName": "markdig" } -} \ No newline at end of file +} diff --git a/education/index.yml b/education/index.yml index 1da8d77fdb..d70de3747c 100644 --- a/education/index.yml +++ b/education/index.yml @@ -8,7 +8,7 @@ metadata: title: Microsoft 365 Education Documentation description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. ms.topic: hub-page - ms.date: 07/22/2024 + ms.date: 12/05/2024 productDirectory: title: For IT admins diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md index 54bf350d77..4f9ce1a8ed 100644 --- a/education/windows/configure-aad-google-trust.md +++ b/education/windows/configure-aad-google-trust.md @@ -1,7 +1,7 @@ --- -title: Configure federation between Google Workspace and Microsoft Entra ID +title: Configure Federation Between Google Workspace And Microsoft Entra Id description: Configuration of a federated trust between Google Workspace and Microsoft Entra ID, with Google Workspace acting as an identity provider (IdP) for Microsoft Entra ID. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: how-to appliesto: --- @@ -43,10 +43,10 @@ To test federation, the following prerequisites must be met: 1. In the search results page, hover over the *Microsoft Office 365 - Web (SAML)* app and select **Select** :::image type="content" source="images/google/google-admin-search-app.png" alt-text="Screenshot showing Google Workspace and the search button for Microsoft Office 365 SAML app."::: 1. On the **Google Identity Provider details** page, select **Download Metadata** and take note of the location where the **IdP metadata** - *GoogleIDPMetadata.xml* - file is saved, as it's used to set up Microsoft Entra ID later -1. On the **Service provider detail's** page +1. On the **Service provider detail's** page: - Select the option **Signed response** - Verify that the Name ID format is set to **PERSISTENT** - - Depending on how the Microsoft Entra users have been provisioned in Microsoft Entra ID, you might need to adjust the **Name ID** mapping.\ + - Depending on how the Microsoft Entra users have been provisioned in Microsoft Entra ID, you might need to adjust the **Name ID** mapping\ If using Google autoprovisioning, select **Basic Information > Primary email** - Select **Continue** 1. On the **Attribute mapping** page, map the Google attributes to the Microsoft Entra attributes @@ -139,4 +139,4 @@ From a private browser session, navigate to https://portal.azure.com and sign in 1. The user is redirected to Google Workspace to sign in 1. After Google Workspace authentication, the user is redirected back to Microsoft Entra ID and signed in -:::image type="content" source="images/google/google-sso.gif" alt-text="A GIF that shows the user authenticating the Azure portal using a Google Workspace federated identity."::: + :::image type="content" source="images/google/google-sso.gif" alt-text="A GIF that shows the user authenticating the Azure portal using a Google Workspace federated identity."::: diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 889b10b393..bdd5d2761c 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -1,7 +1,7 @@ --- -title: Configure Stickers for Windows 11 SE +title: Configure Stickers For Windows 11 SE description: Learn about the Stickers feature and how to configure it via Intune and provisioning package. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: how-to appliesto: - ✅ Windows 11 SE diff --git a/education/windows/edu-themes.md b/education/windows/edu-themes.md index b0d6efa639..727c1a26bd 100644 --- a/education/windows/edu-themes.md +++ b/education/windows/edu-themes.md @@ -1,7 +1,7 @@ --- -title: Configure education themes for Windows 11 +title: Configure Education Themes For Windows 11 description: Learn about education themes for Windows 11 and how to configure them via Intune and provisioning package. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: how-to appliesto: - ✅ Windows 11 diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md index aca908bb45..9a73ef453c 100644 --- a/education/windows/federated-sign-in.md +++ b/education/windows/federated-sign-in.md @@ -1,7 +1,7 @@ --- title: Configure federated sign-in for Windows devices description: Learn how federated sign-in in Windows works and how to configure it. -ms.date: 06/03/2024 +ms.date: 01/27/2025 ms.topic: how-to appliesto: - ✅ Windows 11 diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index d5a0cb61fa..8d3050097f 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -1,8 +1,8 @@ --- -title: Get and deploy Minecraft Education +title: Deploy Minecraft Education To Windows Devices description: Learn how to obtain and distribute Minecraft Education to Windows devices. ms.topic: how-to -ms.date: 04/10/2024 +ms.date: 12/5/2024 ms.collection: - education - tier2 @@ -48,7 +48,7 @@ To purchase direct licenses: 1. Select the quantity of licenses you'd like to purchase and select **Place Order** 1. After you've purchased licenses, you'll need to [assign Minecraft Education licenses to your users](#assign-minecraft-education-licenses) -If you need more licenses for Minecraft Education, see [Buy or remove subscription licenses](/microsoft-365/commerce/licenses/buy-licenses). + If you need more licenses for Minecraft Education, see [Buy or remove subscription licenses](/microsoft-365/commerce/licenses/buy-licenses) ### Volume licensing @@ -88,14 +88,14 @@ You must be a *Global*, *License*, or *User admin* to assign licenses. For more 1. Go to [https://admin.microsoft.com](https://admin.microsoft.com) and sign in with an account that can assign licenses in your organization 1. From the left-hand menu in Microsoft Admin Center, select *Users* 1. From the Users list, select the users you want to add or remove for Minecraft Education access -1. Add the relevant Minecraft Education, A1 for device or A3/A5 license if it not assigned already +1. Add the relevant Minecraft Education, A1 for device or A3/A5 license if it is not assigned already > [!Note] - > If you add a faculty license, the user will be assigned a *teacher* role in the application and will have elevated permissions. + > If you add a faculty license, the user will be assigned a *teacher* role in the application and will have elevated permissions 1. If you've assigned a Microsoft 365 A3 or A5 license, after selecting the product license, ensure to toggle *Minecraft Education* on > [!Note] > If you turn off this setting after students have been using Minecraft Education, they will have up to 30 more days to use Minecraft Education before they don't have access -:::image type="content" source="images/minecraft/admin-center-minecraft-license.png" alt-text="Screenshot of the Microsoft 365 admin center - assignment of a Minecraft Education license to a user." lightbox="images/minecraft/admin-center-minecraft-license.png"::: + :::image type="content" source="images/minecraft/admin-center-minecraft-license.png" alt-text="Screenshot of the Microsoft 365 admin center - assignment of a Minecraft Education license to a user." lightbox="images/minecraft/admin-center-minecraft-license.png"::: For more information about license assignment, see [Manage Licenses in the Admin Center][EDU-5]. @@ -118,31 +118,31 @@ If you're using Microsoft Intune to manage your devices, follow these steps to d 1. Select **Next** 1. On the *Review + Create* screen, select **Create** -Intune will install Minecraft Education at the next device check-in, or will make it available in Company Portal for on-demand installs. + Intune will install Minecraft Education at the next device check-in, or will make it available in Company Portal for on-demand installs. -:::image type="content" source="images/minecraft/win11-minecraft-education.png" alt-text="Screenshot of Minecraft Education executing on a Windows 11 device."::: + :::image type="content" source="images/minecraft/win11-minecraft-education.png" alt-text="Screenshot of Minecraft Education executing on a Windows 11 device."::: -For more information how to deploy Minecraft Education, see: + For more information how to deploy Minecraft Education, see: -- [Windows installation guide][EDU-6] -- [Chromebook installation guide][EDU-7] -- [iOS installation guide][EDU-8] -- [macOS installation guide][EDU-9] + - [Windows installation guide][EDU-6] + - [Chromebook installation guide][EDU-7] + - [iOS installation guide][EDU-8] + - [macOS installation guide][EDU-9] -If you're having trouble installing the app, you can get more help on the [Minecraft Education support page][AKA-1]. + If you're having trouble installing the app, you can get more help on the [Minecraft Education support page][AKA-1]. - -[EDU-1]: https://educommunity.minecraft.net/hc/articles/360047116432 -[EDU-2]: https://educommunity.minecraft.net/hc/articles/360061371532 -[EDU-3]: https://www.microsoft.com/education/products/office -[EDU-4]: https://educommunity.minecraft.net/hc/articles/360061369812 -[EDU-6]: https://educommunity.minecraft.net/hc/articles/13106858087956 -[EDU-5]: https://educommunity.minecraft.net/hc/articles/360047118672 -[EDU-7]: https://educommunity.minecraft.net/hc/articles/4404625978516 -[EDU-8]: https://educommunity.minecraft.net/hc/articles/360047556351 -[EDU-9]: https://educommunity.minecraft.net/hc/articles/360047118792 + + [EDU-1]: https://educommunity.minecraft.net/hc/articles/360047116432 + [EDU-2]: https://educommunity.minecraft.net/hc/articles/360061371532 + [EDU-3]: https://www.microsoft.com/education/products/office + [EDU-4]: https://educommunity.minecraft.net/hc/articles/360061369812 + [EDU-6]: https://educommunity.minecraft.net/hc/articles/13106858087956 + [EDU-5]: https://educommunity.minecraft.net/hc/articles/360047118672 + [EDU-7]: https://educommunity.minecraft.net/hc/articles/4404625978516 + [EDU-8]: https://educommunity.minecraft.net/hc/articles/360047556351 + [EDU-9]: https://educommunity.minecraft.net/hc/articles/360047118792 -[M365-1]: /microsoft-365/commerce/billing-and-payments/pay-for-your-subscription -[M365-2]: /microsoft-365/admin/add-users/about-admin-roles + [M365-1]: /microsoft-365/commerce/billing-and-payments/pay-for-your-subscription + [M365-2]: /microsoft-365/admin/add-users/about-admin-roles -[AKA-1]: https://aka.ms/minecraftedusupport + [AKA-1]: https://aka.ms/minecraftedusupport diff --git a/education/windows/index.yml b/education/windows/index.yml index 4bc8fe8393..981e1d8466 100644 --- a/education/windows/index.yml +++ b/education/windows/index.yml @@ -12,22 +12,16 @@ metadata: author: paolomatarazzo ms.author: paoloma manager: aaroncz - ms.date: 07/22/2024 + ms.date: 10/10/2024 highlightedContent: items: - - title: Get started with Windows 11 SE - itemType: get-started - url: windows-11-se-overview.md - - title: Windows 11, version 23H2 + - title: Windows 11, version 24H2 itemType: whats-new - url: /windows/whats-new/whats-new-windows-11-version-23h2 + url: /windows/whats-new/whats-new-windows-11-version-24h2 - title: Explore all Windows trainings and learning paths for IT pros itemType: learn url: https://learn.microsoft.com/en-us/training/browse/?products=windows&roles=administrator - - title: Deploy applications to Windows 11 SE with Intune - itemType: how-to-guide - url: /education/windows/tutorial-deploy-apps-winse productDirectory: title: Get started diff --git a/education/windows/suspcs/index.md b/education/windows/suspcs/index.md index 3e41143df7..34ae3b990a 100644 --- a/education/windows/suspcs/index.md +++ b/education/windows/suspcs/index.md @@ -2,7 +2,7 @@ title: Use Set up School PCs app description: Learn how to use the Set up School PCs app and apply the provisioning package. ms.topic: how-to -ms.date: 07/09/2024 +ms.date: 02/25/2025 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/education/windows/suspcs/provisioning-package.md b/education/windows/suspcs/provisioning-package.md index 677b9b7b6f..bde1800fa4 100644 --- a/education/windows/suspcs/provisioning-package.md +++ b/education/windows/suspcs/provisioning-package.md @@ -1,7 +1,7 @@ --- -title: What's in Set up School PCs provisioning package +title: What's In Set up School PCs Provisioning Package description: Learn about the settings that are configured in the provisioning package created with the Set up School PCs app. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: reference appliesto: - ✅ Windows 11 diff --git a/education/windows/suspcs/reference.md b/education/windows/suspcs/reference.md index 278344c047..3cec502ea5 100644 --- a/education/windows/suspcs/reference.md +++ b/education/windows/suspcs/reference.md @@ -1,8 +1,8 @@ --- title: Set up School PCs app technical reference overview -description: Describes the purpose of the Set up School PCs app for Windows 10 devices. +description: Describes the purpose of the Set up School PCs app for Windows devices. ms.topic: overview -ms.date: 01/16/2024 +ms.date: 10/29/2024 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -12,12 +12,12 @@ appliesto: The **Set up School PCs** app helps you configure new Windows 10 PCs for school use. The app, which is available for Windows 10 version 1703 and later, configures and saves school-optimized settings, apps, and policies into a single provisioning package. You can then save the package to a USB drive and distribute it to your school PCs. -If your school uses Microsoft Entra ID or Office 365, the Set up +If your school uses Microsoft Entra ID or Microsoft 365, the Set up School PCs app will create a setup file. This file joins the PC to your Microsoft Entra tenant. The app also helps set up PCs for use with or without Internet connectivity. ## Join devices to Microsoft Entra ID -If your school uses Microsoft Entra ID or Office 365, the Set up School PCs app creates a setup file that joins your PC to your Microsoft Entra ID tenant. +If your school uses Microsoft Entra ID or Microsoft 365, the Set up School PCs app creates a setup file that joins your PC to your Microsoft Entra ID tenant. The app also helps set up PCs for use with or without Internet connectivity. diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md index 8c46ac4b93..b43345436f 100644 --- a/education/windows/take-tests-in-windows.md +++ b/education/windows/take-tests-in-windows.md @@ -1,7 +1,7 @@ --- title: Take tests and assessments in Windows description: Learn about the built-in Take a Test app for Windows and how to use it. -ms.date: 02/29/2024 +ms.date: 11/11/2024 ms.topic: how-to --- @@ -9,11 +9,11 @@ ms.topic: how-to Many schools use online testing for formative and summation assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. To help schools with testing, Windows provides an application called **Take a Test**. The application is a secure browser that provides different features to help with testing, and can be configured to only allow access a specific URL or a list of URLs. When using Take a Test, students can't: -- print, use screen capture, or text suggestions (unless enabled by the teacher or administrator) -- access other applications -- change system settings, such as display extension, notifications, updates -- access Cortana -- access content copied to the clipboard +- Print, use screen capture, or text suggestions (unless enabled by the teacher or administrator) +- Access other applications +- Change system settings, such as display extension, notifications, updates +- Access Cortana +- Access content copied to the clipboard ## How to use Take a Test @@ -22,7 +22,7 @@ There are different ways to use Take a Test, depending on the use case: - For lower stakes assessments, such a quick quiz in a class, a teacher can generate a *secure assessment URL* and share it with the students. Students can then open the URL to access the assessment through Take a Test. To learn more, see the next section: [Create a secure assessment link](#create-a-secure-assessment-link) - For higher stakes assessments, you can configure Windows devices to use a dedicated account for testing and execute Take a Test in a locked-down mode, called **kiosk mode**. Once signed in with the dedicated account, Windows will execute Take a Test in a lock-down mode, preventing the execution of any applications other than Take a Test. For more information, see [Configure Take a Test in kiosk mode](edu-take-a-test-kiosk-mode.md) -:::image type="content" source="./images/takeatest/flow-chart.png" alt-text="Set up and user flow for the Take a Test app." border="false"::: + :::image type="content" source="./images/takeatest/flow-chart.png" alt-text="Set up and user flow for the Take a Test app." border="false"::: ## Create a secure assessment link @@ -37,9 +37,9 @@ To create a secure assessment link to the test, there are two options: For this option, copy the assessment URL and open the web application Customize your assessment URL, where you can: -- Paste the link to the assessment URL -- Select the options you want to allow during the test -- Generate the link by selecting the button Create link +- Paste the link to the assessment URL. +- Select the options you want to allow during the test. +- Generate the link by selecting the button Create link. This is an ideal option for teachers who want to create a link to a specific assessment and share it with students using OneNote, for example. @@ -67,7 +67,7 @@ To enable permissive mode, don't include `enforceLockdown` in the schema paramet ## Distribute the secure assessment link -Once the link is created, it can be distributed through the web, email, OneNote, or any other method of your choosing. +Once the link is created, it can be distributed through the web, email, OneNote, or any other method of your choice. For example, you can create and copy the shortcut to the assessment URL to the students' desktop. @@ -85,4 +85,4 @@ To take the test, have the students open the link. Teachers can use **Microsoft Forms** to create tests. For more information, see [Create tests using Microsoft Forms](https://support.microsoft.com/en-us/office/create-a-quiz-with-microsoft-forms-a082a018-24a1-48c1-b176-4b3616cdc83d). -To learn more about the policies and settings set by the Take a Test app, see [Take a Test app technical reference](take-a-test-app-technical.md). \ No newline at end of file +To learn more about the policies and settings set by the Take a Test app, see [Take a Test app technical reference](take-a-test-app-technical.md). diff --git a/education/windows/tutorial-deploy-apps-winse/considerations.md b/education/windows/tutorial-deploy-apps-winse/considerations.md index 7f2a9f9207..54cb82322a 100644 --- a/education/windows/tutorial-deploy-apps-winse/considerations.md +++ b/education/windows/tutorial-deploy-apps-winse/considerations.md @@ -1,7 +1,7 @@ --- -title: Important considerations before deploying apps with managed installer +title: Important Considerations Before Deploying Apps With Managed Installer For Windows 11 SE description: Learn about important aspects to consider before deploying apps with managed installer. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/create-policies.md b/education/windows/tutorial-deploy-apps-winse/create-policies.md index 26e022bbbf..e7fdd29782 100644 --- a/education/windows/tutorial-deploy-apps-winse/create-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/create-policies.md @@ -1,7 +1,7 @@ --- -title: Create policies to enable applications +title: Create Policies To Enable Applications In Windows 11 SE description: Learn how to create policies to enable the installation and execution of apps on Windows SE. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later @@ -54,7 +54,7 @@ To create supplemental policies, download and install the [WDAC Policy Wizard][E The following video provides an overview and explains how to create supplemental policies for apps blocked by the Windows 11 SE base policy. -> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RWWReO] +> [!VIDEO https://learn-video.azurefd.net/vod/player?id=1eedb284-5592-43e7-9446-ce178953502d] ### Create a supplemental policy for Win32 apps diff --git a/education/windows/tutorial-deploy-apps-winse/deploy-apps.md b/education/windows/tutorial-deploy-apps-winse/deploy-apps.md index 62442e2058..4ab613f7f0 100644 --- a/education/windows/tutorial-deploy-apps-winse/deploy-apps.md +++ b/education/windows/tutorial-deploy-apps-winse/deploy-apps.md @@ -1,7 +1,7 @@ --- -title: Applications deployment considerations +title: Applications Deployment Considerations In Windows 11 SE description: Learn how to deploy different types of applications to Windows 11 SE and some considerations before deploying them. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/deploy-policies.md b/education/windows/tutorial-deploy-apps-winse/deploy-policies.md index 63f6143853..990f4c894b 100644 --- a/education/windows/tutorial-deploy-apps-winse/deploy-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/deploy-policies.md @@ -1,7 +1,7 @@ --- -title: Deploy policies to enable applications +title: Deploy Policies To Enable Applications In Windows 11 SE description: Learn how to deploy AppLocker policies to enable apps execution on Windows SE devices. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/index.md b/education/windows/tutorial-deploy-apps-winse/index.md index 1c09685eed..c96283ec0c 100644 --- a/education/windows/tutorial-deploy-apps-winse/index.md +++ b/education/windows/tutorial-deploy-apps-winse/index.md @@ -1,7 +1,7 @@ --- -title: Deploy applications to Windows 11 SE with Intune +title: Deploy Applications To Windows 11 SE With Intune description: Learn how to deploy applications to Windows 11 SE with Intune and how to validate the apps. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md index 38a3ee9d4c..f23a6c4034 100644 --- a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md +++ b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md @@ -1,7 +1,7 @@ --- -title: Troubleshoot app deployment issues in Windows SE +title: Troubleshoot App Deployment Issues In Windows Se description: Troubleshoot common issues when deploying apps to Windows SE devices. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/validate-apps.md b/education/windows/tutorial-deploy-apps-winse/validate-apps.md index 211638de72..4cfa11748b 100644 --- a/education/windows/tutorial-deploy-apps-winse/validate-apps.md +++ b/education/windows/tutorial-deploy-apps-winse/validate-apps.md @@ -1,7 +1,7 @@ --- -title: Validate the applications deployed to Windows SE devices +title: Validate The Applications Deployed To Windows Se Devices description: Learn how to validate the applications deployed to Windows SE devices via Intune. -ms.date: 04/10/2024 +ms.date: 12/02/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/windows-11-se-faq.yml b/education/windows/windows-11-se-faq.yml index 4a9b022c07..c33dec8686 100644 --- a/education/windows/windows-11-se-faq.yml +++ b/education/windows/windows-11-se-faq.yml @@ -1,9 +1,9 @@ ### YamlMime:FAQ metadata: title: Windows 11 SE Frequently Asked Questions (FAQ) - description: Use these frequently asked questions (FAQ) to learn important details about Windows 11 SE. + description: Use these frequently asked questions (FAQ) to learn important details about Windows 11 SE. ms.topic: faq - ms.date: 01/16/2024 + ms.date: 10/10/2024 appliesto: - ✅ Windows 11 SE @@ -30,7 +30,7 @@ sections: - Express yourself and celebrate accomplishments with the *emoji and GIF panel* and *Stickers* - name: Deployment questions: - - question: Can I load Windows 11 SE on any hardware? + - question: Can I load Windows 11 SE on any hardware? answer: | Windows 11 SE is only available on devices that are built for education. To learn more, see [Windows 11 SE Overview](/education/windows/windows-11-se-overview). - question: Can I PXE boot a Windows SE device? diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index e5fd11df2b..3c0a5f8d93 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -2,7 +2,7 @@ title: Windows 11 SE Overview description: Learn about Windows 11 SE, and the apps that are included with the operating system. ms.topic: overview -ms.date: 01/09/2024 +ms.date: 10/10/2024 appliesto: - ✅ Windows 11 SE ms.collection: @@ -96,9 +96,9 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `CKAuthenticator` | 3.6+ | `Win32` | `ContentKeeper` | | `Class Policy` | 116.0.0 | `Win32` | `Class Policy` | | `Classroom.cloud` | 1.40.0004 | `Win32` | `NetSupport` | -| `Clipchamp` | 2.5.2. | `Store` | `Microsoft` | +| `Clipchamp` | 2.5.2. | `Store` | `Microsoft` | | `CoGat Secure Browser` | 11.0.0.19 | `Win32` | `Riverside Insights` | -| `ColorVeil` | 4.0.0.175 | `Win32` | `East-Tec` | +| `ColorVeil` | 4.0.0.175 | `Win32` | `East-Tec` | | `ContentKeeper Cloud` | 9.01.45 | `Win32` | `ContentKeeper Technologies` | | `DigiExam` | 14.1.0 | `Win32` | `Digiexam` | | `Digital Secure testing browser` | 15.0.0 | `Win32` | `Digiexam` | diff --git a/education/windows/windows-11-se-settings-list.md b/education/windows/windows-11-se-settings-list.md index 1c973e2035..5e09c2f2d1 100644 --- a/education/windows/windows-11-se-settings-list.md +++ b/education/windows/windows-11-se-settings-list.md @@ -2,7 +2,7 @@ title: Windows 11 SE settings list description: Windows 11 SE automatically configures settings in the operating system. Learn more about the settings you can control and manage, and the settings you can't change. ms.topic: reference -ms.date: 05/06/2024 +ms.date: 10/10/2024 appliesto: - ✅ Windows 11 SE ms.collection: diff --git a/includes/iot/supported-os-enterprise-plus.md b/includes/iot/supported-os-enterprise-plus.md new file mode 100644 index 0000000000..b6c086d649 --- /dev/null +++ b/includes/iot/supported-os-enterprise-plus.md @@ -0,0 +1,8 @@ +--- +author: TerryWarwick +ms.author: twarwick +ms-topic: include +ms.date: 09/30/2024 +--- + +**Supported Editions**
✅ IoT Enterprise LTSC
✅ IoT Enterprise
✅ Enterprise LTSC
✅ Enterprise
✅ Education diff --git a/includes/licensing/_edition-requirements.md b/includes/licensing/_edition-requirements.md index 9810ebe8bf..19e8e7499f 100644 --- a/includes/licensing/_edition-requirements.md +++ b/includes/licensing/_edition-requirements.md @@ -1,11 +1,11 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 09/18/2023 +ms.date: 11/06/2024 ms.topic: include --- -| Feature name | Windows Pro | Windows Enterprise | Windows Pro Education/SE | Windows Education | +| Feature name | Windows Pro | Windows Enterprise/IoT Enterprise | Windows Pro Education | Windows Education | |:---|:---:|:---:|:---:|:---:| |**[Access Control (ACL/SACL)](/windows/security/identity-protection/access-control/access-control)**|Yes|Yes|Yes|Yes| |**[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)**|Yes|Yes|Yes|Yes| @@ -13,7 +13,7 @@ ms.topic: include |**[Always On VPN (device tunnel)](/Windows-server/remote/remote-access/overview-always-on-vpn)**|❌|Yes|❌|Yes| |**[App containers](/virtualization/windowscontainers/about/)**|Yes|Yes|Yes|Yes| |**[AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview)**|Yes|Yes|Yes|Yes| -|**[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)**|Yes|Yes|Yes|Yes| +|**[Assigned Access (kiosk mode)](/windows/configuration/assigned-access)**|Yes|Yes|Yes|Yes| |**[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)**|Yes|Yes|Yes|Yes| |**[Azure Code Signing](/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection)**|Yes|Yes|Yes|Yes| |**[BitLocker enablement](/windows/security/operating-system-security/data-protection/bitlocker/)**|Yes|Yes|Yes|Yes| @@ -32,7 +32,7 @@ ms.topic: include |**[Federal Information Processing Standard (FIPS) 140 validation](/windows/security/security-foundations/certification/fips-140-validation)**|Yes|Yes|Yes|Yes| |**[Federated sign-in](/education/windows/federated-sign-in)**|❌|❌|Yes|Yes| |**[FIDO2 security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)**|Yes|Yes|Yes|Yes| -|**[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)**|Yes|Yes|Yes|Yes| +|**[Hardware-enforced stack protection](https://techcommunity.microsoft.com/blog/windowsosplatform/understanding-hardware-enforced-stack-protection/1247815)**|Yes|Yes|Yes|Yes| |**[Hypervisor-protected Code Integrity (HVCI)](/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity)**|Yes|Yes|Yes|Yes| |**[Kernel Direct Memory Access (DMA) protection](/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt)**|Yes|Yes|Yes|Yes| |**[Local Security Authority (LSA) Protection](/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)**|Yes|Yes|Yes|Yes| @@ -53,7 +53,7 @@ ms.topic: include |**[OneFuzz service](https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/)**|Yes|Yes|Yes|Yes| |**Opportunistic Wireless Encryption (OWE)**|Yes|Yes|Yes|Yes| |**[Passkeys](/windows/security/identity-protection/passkeys)**|Yes|Yes|Yes|Yes| -|**[Personal data encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|❌|Yes| +|**[Personal Data Encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|❌|Yes| |**Privacy Resource Usage**|Yes|Yes|Yes|Yes| |**Privacy Transparency and Controls**|Yes|Yes|Yes|Yes| |**[Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)**|Yes|Yes|Yes|Yes| @@ -84,6 +84,7 @@ ms.topic: include |**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)**|Yes|Yes|Yes|Yes| |**[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)**|Yes|Yes|Yes|Yes| |**[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)**|Yes|Yes|Yes|Yes| +|**Windows Hotpatch**|❌|Yes|❌|❌| |**[Windows LAPS](/windows-server/identity/laps/laps-overview)**|Yes|Yes|Yes|Yes| |**[Windows passwordless experience](/windows/security/identity-protection/passwordless-experience)**|Yes|Yes|Yes|Yes| |**[Windows presence sensing](https://support.microsoft.com/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb)**|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/_licensing-requirements.md b/includes/licensing/_licensing-requirements.md index 022cbf278b..0ba2e7193a 100644 --- a/includes/licensing/_licensing-requirements.md +++ b/includes/licensing/_licensing-requirements.md @@ -5,7 +5,7 @@ ms.date: 11/02/2023 ms.topic: include --- -|Feature name|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|Feature name|Windows Pro/Pro Education|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| |:---|:---:|:---:|:---:|:---:|:---:| |**[Access Control (ACL/SACL)](/windows/security/identity-protection/access-control/access-control)**|Yes|Yes|Yes|Yes|Yes| |**[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)**|Yes|Yes|Yes|Yes|Yes| @@ -13,7 +13,7 @@ ms.topic: include |**[Always On VPN (device tunnel)](/Windows-server/remote/remote-access/overview-always-on-vpn)**|❌|Yes|Yes|Yes|Yes| |**[App containers](/virtualization/windowscontainers/about/)**|Yes|Yes|Yes|Yes|Yes| |**[AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview)**|❌|Yes|Yes|Yes|Yes| -|**[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)**|Yes|Yes|Yes|Yes|Yes| +|**[Assigned Access (kiosk mode)](/windows/configuration/assigned-access)**|Yes|Yes|Yes|Yes|Yes| |**[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)**|Yes|Yes|Yes|Yes|Yes| |**[Azure Code Signing](/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection)**|Yes|Yes|Yes|Yes|Yes| |**[BitLocker enablement](/windows/security/operating-system-security/data-protection/bitlocker/)**|Yes|Yes|Yes|Yes|Yes| @@ -53,7 +53,7 @@ ms.topic: include |**[OneFuzz service](https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/)**|Yes|Yes|Yes|Yes|Yes| |**Opportunistic Wireless Encryption (OWE)**|Yes|Yes|Yes|Yes|Yes| |**[Passkeys](/windows/security/identity-protection/passkeys)**|Yes|Yes|Yes|Yes|Yes| -|**[Personal data encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|Yes|Yes|Yes| +|**[Personal Data Encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|Yes|Yes|Yes| |**Privacy Resource Usage**|Yes|Yes|Yes|Yes|Yes| |**Privacy Transparency and Controls**|Yes|Yes|Yes|Yes|Yes| |**[Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)**|Yes|Yes|Yes|Yes|Yes| @@ -84,6 +84,7 @@ ms.topic: include |**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)**|Yes|Yes|Yes|Yes|Yes| +|**Windows Hotpatch**|❌|Yes|Yes|❌|❌| |**[Windows LAPS](/windows-server/identity/laps/laps-overview)**|Yes|Yes|Yes|Yes|Yes| |**[Windows passwordless experience](/windows/security/identity-protection/passwordless-experience)**|Yes|Yes|Yes|Yes|Yes| |**[Windows presence sensing](https://support.microsoft.com/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb)**|Yes|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/assigned-access.md b/includes/licensing/assigned-access.md index 3a980896b0..30348f5e9d 100644 --- a/includes/licensing/assigned-access.md +++ b/includes/licensing/assigned-access.md @@ -20,13 +20,3 @@ The following table lists the Windows editions that support Assigned Access: |IoT Enterprise LTSC|✅| |Pro Education|✅| |Pro|✅| - - \ No newline at end of file diff --git a/includes/licensing/shell-launcher.md b/includes/licensing/shell-launcher.md index b44ad3f92b..07418aeb82 100644 --- a/includes/licensing/shell-launcher.md +++ b/includes/licensing/shell-launcher.md @@ -20,14 +20,4 @@ The following table lists the Windows editions that support Shell Launcher: |IoT Enterprise LTSC|✅| |Pro Education|❌| |Pro|❌| - - \ No newline at end of file +|Home|❌| diff --git a/store-for-business/breadcrumb/toc.yml b/store-for-business/breadcrumb/toc.yml deleted file mode 100644 index 4b1853471b..0000000000 --- a/store-for-business/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Microsoft Store for Business - tocHref: /microsoft-store - topicHref: /microsoft-store/index \ No newline at end of file diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json deleted file mode 100644 index e29e3bfdae..0000000000 --- a/store-for-business/docfx.json +++ /dev/null @@ -1,81 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/**.yml" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "README.md", - "LICENSE", - "LICENSE-CODE", - "ThirdPartyNotices" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "**/includes/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": { - "recommendations": true, - "adobe-target": true, - "ms.collection": [ - "tier2" - ], - "breadcrumb_path": "/microsoft-store/breadcrumb/toc.json", - "uhfHeaderId": "MSDocsHeader-Archive", - "is_archived": true, - "is_retired": true, - "ROBOTS": "NOINDEX,NOFOLLOW", - "ms.author": "trudyha", - "audience": "ITPro", - "ms.service": "store-for-business", - "ms.topic": "article", - "ms.date": "05/09/2017", - "searchScope": [ - "Store" - ], - "feedback_system": "None", - "hideEdit": true, - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "MSDN.store-for-business", - "folder_relative_path_in_docset": "./" - } - }, - "contributors_to_exclude": [ - "dstrome2", - "rjagiewich", - "American-Dipper", - "claydetels19", - "jborsecnik", - "v-stchambers", - "shdyas", - "Stacyrch140", - "garycentric", - "dstrome", - "alekyaj", - "aditisrivastava07", - "padmagit77" - ] - }, - "fileMetadata": {}, - "template": [], - "dest": "store-for-business", - "markdownEngineName": "markdig" - } -} diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index 73dbb919ae..2a00963aef 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -5,7 +5,7 @@ author: aczechowski ms.author: aaroncz manager: aaroncz ms.date: 10/03/2017 -ms.topic: conceptual +ms.topic: article ms.service: windows-client ms.subservice: itpro-apps ms.localizationpriority: medium diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index ae406114d7..2fe6bc1844 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -9,7 +9,7 @@ metadata: author: aczechowski ms.author: aaroncz manager: aaroncz - ms.date: 06/28/2024 + ms.date: 09/27/2024 ms.topic: landing-page ms.service: windows-client ms.subservice: itpro-apps diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 9e6cefb8ae..f1cf07572c 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -4,7 +4,7 @@ description: Learn about per-user services, how to change the template service s author: aczechowski ms.author: aaroncz manager: aaroncz -ms.date: 12/22/2023 +ms.date: 10/01/2024 ms.topic: how-to ms.service: windows-client ms.subservice: itpro-apps @@ -99,7 +99,7 @@ $services = Get-Service foreach ( $service in $services ) { # For each specific service, check if the service type property includes the 64 bit using the bitwise AND operator (-band). # If the result equals the flag value, then the service is a per-user service. - if ( ( $service.ServiceType -band $flag ) -eq $flag ) { + if ( ( $service.ServiceType -band $flag ) -eq $flag ) { # When a per-user service is found, then add that service object to the results array. $serviceList += $service } @@ -229,14 +229,14 @@ If you can't use group policy preferences to manage the per-user services, you c 1. The following example includes multiple commands that disable the specified Windows services by changing their **Start** value in the Windows Registry to `4`: -```cmd -REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f -REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f -REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f -REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f -REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f -REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f -``` + ```cmd + REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f + REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f + REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f + REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f + REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f + REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f + ``` #### Example 2: Use the Registry Editor user interface to edit the registry @@ -248,7 +248,7 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t RE 1. Change the **Value data** to `4`. -:::image type="content" source="media/regedit-change-service-startup-type.png" alt-text="Screenshot of the Registry Editor open to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDPSvc and highlighting the Start value set to 4."::: + :::image type="content" source="media/regedit-change-service-startup-type.png" alt-text="Screenshot of the Registry Editor open to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDPSvc and highlighting the Start value set to 4."::: #### Example 3: Prevent the creation of per-user services diff --git a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md index 65f0231016..c7c06cff12 100644 --- a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md +++ b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md @@ -5,7 +5,7 @@ author: aczechowski ms.author: aaroncz manager: aaroncz ms.date: 09/03/2023 -ms.topic: conceptual +ms.topic: article ms.service: windows-client ms.subservice: itpro-apps ms.localizationpriority: medium diff --git a/windows/application-management/sideload-apps-in-windows.md b/windows/application-management/sideload-apps-in-windows.md index 3779938afc..8daf6b4e76 100644 --- a/windows/application-management/sideload-apps-in-windows.md +++ b/windows/application-management/sideload-apps-in-windows.md @@ -4,7 +4,7 @@ description: Learn how to sideload line-of-business (LOB) apps in Windows client author: aczechowski ms.author: aaroncz manager: aaroncz -ms.date: 12/22/2023 +ms.date: 09/27/2024 ms.topic: how-to ms.service: windows-client ms.subservice: itpro-apps diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index eefc2151ab..7b70ff0a60 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -1,7 +1,7 @@ --- title: Microsoft Entra integration with MDM description: Microsoft Entra ID is the world's largest enterprise cloud identity management service. -ms.topic: conceptual +ms.topic: integration ms.collection: - highpri - tier2 diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index aca40777f6..2b977fd6b9 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,7 +1,7 @@ --- title: Automatic MDM enrollment in the Intune admin center description: Automatic MDM enrollment in the Intune admin center -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index c248120cff..6ddf688ccc 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,7 +1,7 @@ --- title: Bulk enrollment description: Bulk enrollment is an efficient way to set up an MDM server to manage a large number of devices without the need to reimage the devices. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 --- diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index 2cea712e44..fb2030f3b1 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Certificate authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using certificate authentication policy. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 --- diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index 66d42a4d90..8123971c28 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Certificate Renewal description: Learn how to find all the resources that you need to provide continuous access to client certificates. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 --- diff --git a/windows/client-management/client-tools/administrative-tools-in-windows.md b/windows/client-management/client-tools/administrative-tools-in-windows.md index 785eb740cc..7e095632aa 100644 --- a/windows/client-management/client-tools/administrative-tools-in-windows.md +++ b/windows/client-management/client-tools/administrative-tools-in-windows.md @@ -2,7 +2,7 @@ title: Windows Tools description: The folders for Windows Tools and Administrative Tools are folders in the Control Panel that contain tools for system administrators and advanced users. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: article zone_pivot_groups: windows-versions-11-10 ms.collection: - essentials-manage diff --git a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md index 725c23927a..dcc696bef2 100644 --- a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md @@ -2,7 +2,7 @@ title: Windows default media removal policy description: Manage default media removal policy in Windows. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to --- # Manage default media removal policy diff --git a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md index c08492c201..ec535d0f88 100644 --- a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md +++ b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md @@ -3,7 +3,7 @@ title: Connect to remote Microsoft Entra joined device description: Learn how to use Remote Desktop Connection to connect to a Microsoft Entra joined device. ms.localizationpriority: medium ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to ms.collection: - highpri - tier2 diff --git a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md index 052dc9e72a..8c545751a6 100644 --- a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md +++ b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md @@ -2,7 +2,7 @@ title: Manage Device Installation with Group Policy description: Find out how to manage Device Installation Restrictions with Group Policy. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to --- # Manage Device Installation with Group Policy diff --git a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md index fb091f005b..b96a1bb4ac 100644 --- a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md +++ b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md @@ -2,7 +2,7 @@ title: Manage the Settings app with Group Policy description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to --- # Manage the Settings app with Group Policy diff --git a/windows/client-management/client-tools/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md index 5e64dd2f66..6313cbca68 100644 --- a/windows/client-management/client-tools/mandatory-user-profile.md +++ b/windows/client-management/client-tools/mandatory-user-profile.md @@ -2,7 +2,7 @@ title: Create mandatory user profiles description: A mandatory user profile is a special type of preconfigured roaming user profile that administrators can use to specify settings for users. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to --- # Create mandatory user profiles diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index 91ab1b998a..2123212ab0 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -2,7 +2,7 @@ title: Use Quick Assist to help users description: Learn how IT Pros can use Quick Assist to help users. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to ms.collection: - highpri - tier1 diff --git a/windows/client-management/client-tools/windows-libraries.md b/windows/client-management/client-tools/windows-libraries.md index 65a263719f..9efea447c0 100644 --- a/windows/client-management/client-tools/windows-libraries.md +++ b/windows/client-management/client-tools/windows-libraries.md @@ -1,7 +1,7 @@ --- title: Windows Libraries description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. -ms.topic: conceptual +ms.topic: concept-article ms.date: 07/01/2024 --- diff --git a/windows/client-management/client-tools/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md index 2c34266131..579d7155d0 100644 --- a/windows/client-management/client-tools/windows-version-search.md +++ b/windows/client-management/client-tools/windows-version-search.md @@ -2,7 +2,7 @@ title: What version of Windows am I running? description: Discover which version of Windows you're running to determine whether or not your device is enrolled in the Long-Term Servicing Channel or General Availability Channel. ms.date: 07/01/2024 -ms.topic: conceptual +ms.topic: how-to --- # What version of Windows am I running? diff --git a/windows/client-management/config-lock.md b/windows/client-management/config-lock.md index f497c86712..bdf2eb1540 100644 --- a/windows/client-management/config-lock.md +++ b/windows/client-management/config-lock.md @@ -1,7 +1,7 @@ --- title: Secured-core configuration lock description: A secured-core PC (SCPC) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 appliesto: - ✅ Windows 11 diff --git a/windows/client-management/declared-configuration.md b/windows/client-management/declared-configuration.md index a0a28f91ae..ec20778da6 100644 --- a/windows/client-management/declared-configuration.md +++ b/windows/client-management/declared-configuration.md @@ -121,7 +121,7 @@ If the processing of declared configuration document fails, the errors are logge - If the Document ID doesn't match between the `` and inside DeclaredConfiguration document, Admin event log shows an error message similar to: - `MDM Declared Configuration: End document parsing from CSP: Document Id: (DCA000B5-397D-40A1-AABF-40B25078A7F91), Scenario: (MSFTVPN), Version: (A0), Enrollment Id: (DAD70CC2-365B-450D-A8AB-2EB23F4300CC), Current User: (S-1-5-21-3436249567-4017981746-3373817415-1001), Schema: (1.0), Download URL: (), Scope: (0x1), Enroll Type: (0x1A), File size: (0xDE2), CSP Count: (0x1), URI Count: (0xF), Action Requested: (0x0), Model: (0x1), Result:(0x8000FFFF) Catastrophic failure.` + `MDM Declared Configuration: End document parsing from CSP: Document Id: (DCA000B5-397D-40A1-AABF-40B25078A7F91), Scenario: (MSFTVPN), Version: (A0), Enrollment Id: (DAD70CC2-365B-450D-A8AB-2EB23F4300CC), Current User: (S-1-5-21-1004336348-1177238915-682003330-1234), Schema: (1.0), Download URL: (), Scope: (0x1), Enroll Type: (0x1A), File size: (0xDE2), CSP Count: (0x1), URI Count: (0xF), Action Requested: (0x0), Model: (0x1), Result:(0x8000FFFF) Catastrophic failure.` - Any typo in the OMA-URI results in a failure. In this example, `TrafficFilterList` is specified instead of `TrafficFilterLists`, and Admin event log shows an error message similar to: @@ -129,4 +129,4 @@ If the processing of declared configuration document fails, the errors are logge There's also another warning message in operational channel: - `MDM Declared Configuration: Function (DeclaredConfigurationExtension_PolicyCSPConfigureGivenCurrentDoc) operation (ErrorAtDocLevel: one or more CSPs failed) failed with (Unknown Win32 Error code: 0x82d00007)` \ No newline at end of file + `MDM Declared Configuration: Function (DeclaredConfigurationExtension_PolicyCSPConfigureGivenCurrentDoc) operation (ErrorAtDocLevel: one or more CSPs failed) failed with (Unknown Win32 Error code: 0x82d00007).` diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index 5f61783f99..4a33972765 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -1,7 +1,7 @@ --- title: Mobile device management MDM for device updates description: Windows provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 ms.collection: - highpri diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index cfc52d7c69..39ad4a5693 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -1,7 +1,7 @@ --- title: Disconnecting from the management infrastructure (unenrollment) description: Disconnecting is initiated either locally by the user using a phone or remotely by the IT admin using management server. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index db0f36a085..39777e659b 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -1,7 +1,7 @@ --- title: Enable ADMX policies in MDM description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM). -ms.topic: conceptual +ms.topic: how-to ms.localizationpriority: medium ms.date: 07/08/2024 --- diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 409c283821..ea24cc6e80 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,7 +1,7 @@ --- title: Enroll a Windows device automatically using Group Policy description: Learn how to use a Group Policy to trigger autoenrollment to MDM for Active Directory (AD) domain-joined devices. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 ms.collection: - highpri diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index 71b7fe55b9..589b1b90c1 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -1,7 +1,7 @@ --- title: Enterprise app management description: This article covers one of the key mobile device management (MDM) features for managing the lifecycle of apps across Windows devices. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/esim-enterprise-management.md b/windows/client-management/esim-enterprise-management.md index 2a28981591..db582151c3 100644 --- a/windows/client-management/esim-enterprise-management.md +++ b/windows/client-management/esim-enterprise-management.md @@ -2,7 +2,7 @@ title: eSIM Enterprise Management description: Learn how Mobile Device Management (MDM) Providers support the eSIM Profile Management Solution on Windows. ms.localizationpriority: medium -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/federated-authentication-device-enrollment.md b/windows/client-management/federated-authentication-device-enrollment.md index 32b2fef7ef..6ae40cab14 100644 --- a/windows/client-management/federated-authentication-device-enrollment.md +++ b/windows/client-management/federated-authentication-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Federated authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using federated authentication policy. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/images/8908044-recall-search.png b/windows/client-management/images/8908044-recall-search.png new file mode 100644 index 0000000000..16ec5fda8b Binary files /dev/null and b/windows/client-management/images/8908044-recall-search.png differ diff --git a/windows/client-management/images/8908044-recall.png b/windows/client-management/images/8908044-recall.png deleted file mode 100644 index 92c93c46cb..0000000000 Binary files a/windows/client-management/images/8908044-recall.png and /dev/null differ diff --git a/windows/client-management/images/9598546-copilot-key-settings.png b/windows/client-management/images/9598546-copilot-key-settings.png new file mode 100644 index 0000000000..e4c6e3ed8d Binary files /dev/null and b/windows/client-management/images/9598546-copilot-key-settings.png differ diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index f5969415ed..1e0c5d005e 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -1,7 +1,7 @@ --- title: Support for Windows Information Protection (WIP) on Windows description: Learn about implementing the Windows version of Windows Information Protection (WIP), which is a lightweight solution for managing company data access and security on personal devices. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 --- diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md index 82a405289c..f8a052962b 100644 --- a/windows/client-management/manage-recall.md +++ b/windows/client-management/manage-recall.md @@ -1,9 +1,9 @@ --- title: Manage Recall for Windows clients -description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features. +description: Learn how to manage Recall for commercial environments and about Recall features. ms.topic: how-to ms.subservice: windows-copilot -ms.date: 06/13/2024 +ms.date: 11/22/2024 ms.author: mstewart author: mestew ms.collection: @@ -18,72 +18,161 @@ appliesto: >**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c). -Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Recall takes snapshots of your screen and stores them in a timeline. Snapshots are taken every five seconds while content on the screen is different from the previous snapshot. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language. +Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is disabled and removed on managed devices. IT admins can choose if they want to allow Recall to be used in their organizations and users, on their own, won't be able to enable it on their managed device if the Allow Recall policy is disabled. IT admins, on their own, can't start saving snapshots for end users. Recall is an opt-in experience that requires end user consent to save snapshots. Users can choose to enable or disable saving snapshots for themselves anytime. IT admins can only set policies that give users the option to enable saving snapshots and configure certain policies for Recall. + +This article provides information about Recall and how to manage it in a commercial environment. > [!NOTE] -> Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs). +> - Recall is now available in preview to Copilot+ PCs through the Windows Insider Program. For more information, see [Previewing Recall with Click to Do on Copilot+ PCs with Windows Insiders in the Dev Channel](https://blogs.windows.com/windows-insider/2024/11/22/previewing-recall-with-click-to-do-on-copilot-pcs-with-windows-insiders-in-the-dev-channel/). +> - In-market commercial devices are defined as devices with an Enterprise (ENT) or Education (EDU) SKU or any premium SKU device that is managed by an IT administrator (whether via Microsoft Endpoint Manager or other endpoint management solution), has a volume license key, or is joined to a domain. Commercial devices during Out of Box Experience (OOBE) are defined as those with ENT or EDU SKU or any premium SKU device that has a volume license key or is Microsoft Entra joined. +> - Recall is optimized for select languages English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see [https://aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs). -When Recall opens the snapshot a user selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows users to interact with individual elements in the snapshot. For instance, users can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files. +## What is Recall? -:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png"::: +Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language. + +When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files. + +:::image type="content" border="true" source="images/8908044-recall-search.png" alt-text="Screenshot of Recall with search results displayed for a query for a presentation with a red barn." lightbox="images/8908044-recall-search.png"::: + +### Recall security and privacy architecture + +Privacy and security are built into Recall's design. With Copilot+ PCs, you get powerful AI that runs locally on the device. No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and snapshots are securely stored on the local device only. + +Recall doesn't share snapshots with other users that are signed into Windows on the same device and IT admins can't access or view the snapshots on end-user devices. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved to the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096). + +When using Recall, the **Sensitive information filtering** setting is enabled by default to help ensure your data's confidentiality. This feature operates directly on your device, utilizing the NPU and the Microsoft Classification Engine (MCE) - the same technology leveraged by [Microsoft Purview](/purview/purview) for detecting and labeling sensitive information. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the **Sensitive information filtering** setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md). + +In keeping with Microsoft's commitment to data privacy and security, all saved images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content. + +Click to Do allows users to choose to get more information about their selected content online. When users choose one of the following Click to Do actions, the selected content is sent to the online provider from the local device to complete the request: + +- **Search the web**: Sends the selected content to the default search engine of the default browser +- **Open website**: Opens the selected website in the default browser +- **Visual search with Bing**: Sends the selected content to Bing visual search using the default browser. + +When you choose to send info from Click to Do to an app, like Paint, Click to Do will temporarily save this info in order to complete the transfer. Click to Do creates a temporary file in the following location: + +- `C:\Users\[username]\AppData\Local\Temp` + +Temporary files may also be saved when you choose send feedback. These temporary files aren't saved long term. Click to Do doesn't keep any content from your screen after completing the requested action, but some basic telemetry is gathered to keep Click to Do secure, up to date, and working. ## System requirements -Recall has the following minimum system requirements: -- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs) +Recall has the following minimum requirements: + +- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs) that meets the [Secured-core standard](/windows-hardware/design/device-experiences/oem-highly-secure-11) +- 40 TOPs NPU ([neural processing unit](https://support.microsoft.com/windows/all-about-neural-processing-units-npus-e77a5637-7705-4915-96c8-0c6a975f9db4)) - 16 GB RAM - 8 logical processors - 256 GB storage capacity - To enable Recall, you need at least 50 GB of space free - - Snapshot capture automatically pauses once the device has less than 25 GB of disk space + - Saving snapshots automatically pauses once the device has less than 25 GB of storage space +- Users need to enable Device Encryption or BitLocker +- Users need to enroll into [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) with at least one biometric sign-in option enabled in order to authenticate. ## Supported browsers -Users need a supported browser for Recall to [filter websites](#user-controlled-settings-for-recall) and to automatically filter private browsing activity. Supported browsers, and their capabilities include: +Users need a supported browser for Recall to [filter websites](#app-and-website-filtering-policies) and to automatically filter private browsing activity. Supported browsers, and their capabilities include: -- **Microsoft Edge**: blocks websites and filters private browsing activity -- **Firefox**: blocks websites and filters private browsing activity -- **Opera**: blocks websites and filters private browsing activity -- **Google Chrome**: blocks websites and filters private browsing activity -- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed above, filters private browsing activity only, doesn't block specific websites +- **Microsoft Edge**: filters specified websites and filters private browsing activity +- **Firefox**: filters specified websites and filters private browsing activity +- **Opera**: filtered specified websites and filters private browsing activity +- **Google Chrome**: filters specified websites and filters private browsing activity +- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed, filters private browsing activity only, doesn't filter specific websites ## Configure policies for Recall -Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. The following policy allows you to disable analysis of user content: +By default, Recall is removed on commercially managed devices. If you want to allow Recall to be available for users in your organization and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies. Policies for Recall fall into the following general areas: + +- [Allow Recall and snapshots policies](#allow-recall-and-snapshots-policies) +- [Storage policies](#storage-policies) +- [App and website filtering policies](#app-and-website-filtering-policies) + + +### Allow Recall and snapshots policies + +The **Allow Recall to be enabled** policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled and removed for managed devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own. If you disable this policy, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they'll be deleted when this policy is disabled. Removing Recall requires a device restart. If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DisableAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users will be able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device. |   | Setting | |---|---| -| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) | -| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** | - -## Limitations - -In two specific scenarios, Recall captures snapshots that include InPrivate windows, blocked apps, and blocked websites. If Recall gets launched, or the **Now** option is selected in Recall, then a snapshot is taken even when InPrivate windows, blocked apps, and blocked websites are displayed. However, Recall doesn't save these snapshots. If you choose to send the information from this snapshot to another app, a temp file is created in `C:\Users\[username]\AppData\Local\Temp` to share the content. The temporary file is deleted once the content is transferred over the app you selected to use. - -## User controlled settings for Recall - -The following options are user controlled in Recall from the **Settings** > **Privacy & Security** > **Recall & Snapshots** page: - -- Website filtering -- App filtering -- Storage allocation - - When the storage limit is reached, the oldest snapshots are deleted first. -- Deleting snapshots - - Delete all snapshots - - Delete snapshots within a specific time frame +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[AllowRecallEnablement](mdm/policy-csp-windowsai.md#allowrecallenablement) | +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Allow Recall to be enabled** | -### Storage allocation +The **Turn off saving snapshots for Windows** policy allows you to give the users the choice to save snapshots of their screen for use with Recall. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent. By default, snapshots won't be saved for use with Recall. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device. -The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall: - -| Device storage capacity | Storage allocation options for Recall | +|   | Setting | |---|---| -| 256 GB | 25 GB (default), 10 GB | -| 512 GB | 75 GB (default), 50 GB, 25 GB | -| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB | +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** | +### Storage policies + +You can define how much disk space Recall can use by using the **Set maximum storage for snapshots used by Recall** policy. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When the storage limit is reached, the oldest snapshots are deleted first. When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** | + +You can define how long snapshots can be retained on the device by using the **Set maximum duration for storing snapshots used by Recall** policy. You can configure the maximum storage duration to be 30, 60, 90, or 180 days. If the policy isn't configured, snapshots aren't deleted until the maximum storage allocation is reached, and then the oldest snapshots are deleted first. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageDurationForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageDurationForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum duration for storing snapshots used by Recall** | + + +### App and website filtering policies + +You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some remote desktop connection clients are filtered by default from snapshots. For more information, see the [Remote desktop connection clients filtered from snapshots](#remote-desktop-connection-clients-filtered-from-snapshots) section. + +To filter websites from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default. For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com` + +> [!NOTE] +> - Private browsing activity is filtered by default when using [supported web browsers](#supported-browsers). +> - Be aware that websites are filtered when they are in the foreground or are in the currently opened tab of a supported browser. Parts of filtered websites can still appear in snapshots such as embedded content, the browser's history, or an opened tab that isn't in the foreground. +> - Filtering doesn't prevent browsers, internet service providers (ISPs), websites, organizations, or others from knowing that the website was accessed and building a history. +> - Changes to this policy take effect after device restart. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyUriListForRecall](mdm/policy-csp-windowsai.md#setdenyurilistforrecall)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyUriListForRecall](mdm/policy-csp-windowsai.md#setdenyurilistforrecall)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall** | + + +**Set a list of apps to be filtered from snapshots for Recall** policy allows you to filter apps from being saved in snapshots. Define the list using a semicolon to separate apps. The list can include Application User Model IDs (AUMID) or the name of the executable file. For example: `code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe` + +> [!Note] +> - Like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content. +> - Changes to this policy take effect after device restart. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyAppListForRecall](mdm/policy-csp-windowsai.md#setdenyapplistforrecall)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyAppListForRecall](mdm/policy-csp-windowsai.md#setdenyapplistforrecall)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall**| + + +#### Remote desktop connection clients filtered from snapshots + +Snapshots won't be saved when remote desktop connection clients are used. The following remote desktop connection clients are filtered from snapshots: + + - [Remote Desktop Connection (mstsc.exe)](/windows-server/administration/windows-commands/mstsc) + - [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect) + - [Microsoft Remote Desktop from the Microsoft Store](/windows-server/remote/remote-desktop-services/clients/windows) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list. + - [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows) + - [Azure Virtual Desktop apps from the Microsoft Store](/azure/virtual-desktop/users/connect-remote-desktop-client) are saved in snapshots. To prevent these apps from being saved in snapshots, add them to the app filtering list. + - [Remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows + - [Windows App from the Microsoft Store](/windows-app/get-started-connect-devices-desktops-apps) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list. + + + + +## Information for developers + +If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this URI, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation. ## Microsoft's commitment to responsible AI @@ -91,6 +180,10 @@ Microsoft has been on a responsible AI journey since 2017, when we defined our p Recall uses optical character recognition (OCR), local to the PC, to analyze snapshots and facilitate search. For more information about OCR, see [Transparency note and use cases for OCR](/legal/cognitive-services/computer-vision/ocr-transparency-note). For more information about privacy and security, see [Privacy and control over your Recall experience](https://support.microsoft.com/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15). -## Information for developers - -If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation. +## Related links +- [Policy CSP - WindowsAI](/windows/client-management/mdm/policy-csp-windowsai) +- [Update on Recall security and privacy architecture](https://blogs.windows.com/windowsexperience/2024/09/27/update-on-recall-security-and-privacy-architecture/) +- [Retrace your steps with Recall](https://support.microsoft.com/windows/aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c) +- [Privacy and control over your Recall experience](https://support.microsoft.com/windows/d404f672-7647-41e5-886c-a3c59680af15) +- [Click to Do in Recall](https://support.microsoft.com/topic/967304a8-32d1-4812-a904-fad59b5e6abf) +- [Previewing Recall with Click to Do on Copilot+ PCs with Windows Insiders in the Dev Channel](https://blogs.windows.com/windows-insider/2024/11/22/previewing-recall-with-click-to-do-on-copilot-pcs-with-windows-insiders-in-the-dev-channel/) diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index a43167be49..475dfb0985 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -3,7 +3,7 @@ title: Manage Windows devices in your organization - transitioning to modern man description: This article offers strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. ms.localizationpriority: medium ms.date: 07/08/2024 -ms.topic: conceptual +ms.topic: article --- # Manage Windows devices in your organization - transitioning to modern management diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index d48ca50d9a..655fdb09e4 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -1,9 +1,9 @@ --- -title: Updated Windows and Microsoft Copilot experience +title: Updated Windows and Microsoft 365 Copilot Chat experience description: Learn about changes to the Copilot in Windows experience for commercial environments and how to configure it for your organization. ms.topic: overview ms.subservice: windows-copilot -ms.date: 09/18/2024 +ms.date: 01/28/2025 ms.author: mstewart author: mestew ms.collection: @@ -13,62 +13,62 @@ appliesto: - ✅ Windows 11, version 22H2 or later --- -# Updated Windows and Microsoft Copilot experience +# Updated Windows and Microsoft 365 Copilot Chat experience ->**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/topic/675708af-8c16-4675-afeb-85a5a476ccb0). +>**Looking for consumer information?** See [Welcome to Copilot on Windows](https://support.microsoft.com/topic/675708af-8c16-4675-afeb-85a5a476ccb0). **Looking for more information on Microsoft 365 Copilot Chat experiences?** See [Understanding the different Microsoft 365 Copilot Chat experiences](https://support.microsoft.com/topic/cfff4791-694a-4d90-9c9c-1eb3fb28e842). ## Enhanced data protection with enterprise data protection -The Copilot experience on Windows is changing to enhance data security, privacy, compliance, and simplify the user experience, for users signed in with a Microsoft Entra work or school account. [Microsoft Copilot will offer enterprise data protection](https://techcommunity.microsoft.com/t5/copilot-for-microsoft-365/updates-to-microsoft-copilot-to-bring-enterprise-data-protection/ba-p/4217152) at no additional cost and redirect users to a new simplified interface designed for work and education. [Enterprise data protection (EDP)](/copilot/microsoft-365/enterprise-data-protection) refers to controls and commitments, under the Data Protection Addendum and Product Terms, that apply to customer data for users of Copilot for Microsoft 365 and Microsoft Copilot. This means that security, privacy, compliance controls and commitments available for Copilot for Microsoft 365 will extend to Microsoft Copilot prompts and responses. Prompts and responses are protected by the same terms and commitments that are widely trusted by our customers - not only for Copilot for Microsoft 365, but also for emails in Exchange and files in SharePoint. This is an improvement on top of the previous commercial data protection (CDP) promise. This update is rolling out now. For more information, see the [Microsoft Copilot updates and enterprise data protection FAQ](/copilot/edpfaq). +The Copilot experience on Windows is changing to enhance data security, privacy, compliance, and simplify the user experience, for users signed in with a Microsoft Entra work or school account. [Microsoft 365 Copilot Chat](https://techcommunity.microsoft.com/t5/copilot-for-microsoft-365/updates-to-microsoft-copilot-to-bring-enterprise-data-protection/ba-p/4217152) is available at no additional cost and it redirects users to a new simplified interface designed for work and education. [Enterprise data protection (EDP)](/copilot/microsoft-365/enterprise-data-protection) refers to controls and commitments, under the Data Protection Addendum and Product Terms, that apply to customer data for users of Microsoft 365 Copilot and Microsoft 365 Copilot Chat. This means that security, privacy, compliance controls and commitments available for Microsoft 365 Copilot will extend to Microsoft 365 Copilot Chat prompts and responses. Prompts and responses are protected by the same terms and commitments that are widely trusted by our customers. This is an improvement on top of the previous commercial data protection (CDP) promise. This update is rolling out now. For more information, see the [Microsoft 365 Copilot Chat updates and enterprise data protection FAQ](/copilot/edpfaq). > [!IMPORTANT] > To streamline the user experience, updates to the Copilot entry points in Windows are being made for users. **Copilot in Windows (preview) will be removed from Windows**. The experience will slightly vary depending on whether your organization has already opted into using Copilot in Windows (preview) or not. ## Copilot in Windows (preview) isn't enabled -If your organization hasn't enabled Copilot in Windows (preview), your existing preferences are respected. Neither the Microsoft Copilot app nor the Microsoft 365 app are pinned to the taskbar. To prepare for the eventual removal of the [Copilot in Windows policy](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot), admins should [set Microsoft Copilot pinning options](/copilot/microsoft-365/pin-copilot) in the Microsoft 365 admin center. +If your organization hasn't enabled Copilot in Windows (preview), your existing preferences are respected. Neither Microsoft 365 Copilot Chat or the Microsoft 365 Copilot app (formerly the Microsoft 365 app) are pinned to the taskbar. To prepare for the eventual removal of the [Copilot in Windows policy](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot), admins should [set pinning options](/copilot/microsoft-365/pin-copilot) in the Microsoft 365 admin center. > [!NOTE] > Although we won't be pinning any app to the taskbar by default, IT has the capability to use policies to enforce their preferred app pinning. ## Copilot in Windows (preview) is enabled -If you had previously activated Copilot in Windows (in preview) for your workforce, we want to thank you for your enthusiasm. To provide the best Copilot experience for your employees moving forward, and support greater efficiency and productivity, we won't automatically pin the Microsoft 365 app to the taskbar in Windows. Rather, we'll ensure that you have control over how you enable the Copilot experience within your organization. Our focus remains on empowering IT to seamlessly manage AI experiences and adopt those experiences at a pace that suits your organizational needs. +If you had previously activated Copilot in Windows (in preview) for your workforce, we want to thank you for your enthusiasm. To provide the best Copilot experience for your users moving forward, and support greater efficiency and productivity, we won't automatically pin the Microsoft 365 Copilot app to the taskbar in Windows. Rather, we ensure that you have control over how you enable the Copilot experience within your organization. Our focus remains on empowering IT to seamlessly manage AI experiences and adopt those experiences at a pace that suits your organizational needs. -If you have already activated Copilot in Windows (preview) - and want your users to have uninterrupted access to Copilot on the taskbar after the update - use the [configuration options](/windows/configuration/taskbar/?pivots=windows-11) to pin the Microsoft 365 app to the taskbar as Copilot in Windows (preview) icon will be removed from the taskbar. +If you have already activated Copilot in Windows (preview) - and want your users to have uninterrupted access to Copilot on the taskbar after the update - use the [configuration options](/windows/configuration/taskbar/?pivots=windows-11) to pin the Microsoft 365 Copilot app to the taskbar as Copilot in Windows (preview) icon will be removed from the taskbar. ## Users signing in to new PCs with Microsoft Entra accounts For users signing in to new PCs with work or school accounts, the following experience occurs: -- The Microsoft 365 app is pinned to the taskbar - this is the app comes preinstalled with Windows and includes convenient access to Office apps such as Word, PowerPoint, etc. -- Users that have the Microsoft 365 Copilot license will have Microsoft Copilot pinned by default inside the Microsoft 365 app. -- Within the Microsoft 365 app, the Microsoft Copilot icon is situated next to the home button. - - Microsoft Copilot (`web` grounding chat) isn't the same as Microsoft 365 Copilot (`web` and `work` scope), which is a separate add-on license. - - Microsoft Copilot is available at no additional cost to customers with a Microsoft Entra account. Microsoft Copilot is the entry point for Copilot at work. While the Copilot chat experience helps users ground their conversations in web data, Microsoft 365 Copilot allows users to incorporate both web and work data they have access to into their conversations by switching between work and web modes in Business Chat. - - For users with the Microsoft 365 Copilot license, they can toggle between the web grounding-based chat capabilities of Microsoft Copilot and the work scoped chat capabilities of Microsoft 365 Copilot. -- Customers that don't have a license for Microsoft 365 Copilot are asked if they want to pin Microsoft Copilot to ensure they have easy access to Copilot. To set the default behavior, admins should [set Microsoft Copilot pinning options](/copilot/microsoft-365/pin-copilot) in the Microsoft 365 admin center. -- If admins elect not to pin Copilot and indicate that users may be asked, users will be asked to pin it themselves in the Microsoft 365 app, Outlook, and Teams. -- If admins elect not to pin Microsoft Copilot and indicate that users may not be asked, Microsoft Copilot won't be available via the Microsoft 365 app, Outlook, or Teams. Users will have access to Microsoft Copilot from unless that URL is blocked by the IT admin. -- If the admins make no selection, users will be asked to pin Microsoft Copilot by themselves for easy access. +- The Microsoft 365 Copilot app is pinned to the taskbar - this is the app comes preinstalled with Windows and includes convenient access to Office apps such as Word, PowerPoint, etc. +- Users that have the Microsoft 365 Copilot license have Microsoft 365 Copilot Chat pinned by default inside the Microsoft 365 Copilot app. +- Within the Microsoft 365 Copilot app, the Microsoft 365 Copilot Chat icon is situated next to the home button. + - Microsoft 365 Copilot Chat (`web` grounding chat) isn't the same as Microsoft 365 Copilot (`web` and `work` scope), which is a separate add-on license. + - Microsoft 365 Copilot Chat is available at no additional cost to customers with a Microsoft Entra account. Microsoft 365 Copilot Chat is the entry point for Copilot at work. While the Copilot chat experience helps users ground their conversations in web data, Microsoft 365 Copilot allows users to incorporate both web and work data they have access to into their conversations by switching between work and web modes in Business Chat. + - For users with the Microsoft 365 Copilot license, they can toggle between the web grounding-based chat capabilities of Microsoft 365 Copilot Chat and the work scoped chat capabilities of Microsoft 365 Copilot. +- Customers that don't have a license for Microsoft 365 Copilot are asked if they want to pin Microsoft 365 Copilot Chat to ensure they have easy access to Copilot. To set the default behavior, admins should [set taskbar pinning options](/copilot/microsoft-365/pin-copilot) in the Microsoft 365 admin center. +- If admins elect not to pin Copilot and indicate that users can be asked, users will be asked to pin it themselves in the Microsoft 365 Copilot app, Outlook, and Teams. +- If admins elect not to pin Microsoft 365 Copilot Chat and indicate that users can't be asked, Microsoft 365 Copilot Chat won't be available via the Microsoft 365 Copilot app, Outlook, or Teams. Users have access to Microsoft 365 Copilot Chat from unless that URL is blocked by the IT admin. +- If the admins make no selection, users will be asked to pin Microsoft 365 Copilot Chat by themselves for easy access. ## When will this happen? -The update to Microsoft Copilot to offer enterprise data protection is rolling out now. - -The shift to the Microsoft 365 app as the entry point for Microsoft Copilot is coming soon. Changes will be rolled out to managed PCs starting with the optional nonsecurity preview release on September 24, 2024, and following with the monthly security update release on October 8 for all supported versions of Windows 11. These changes will be applied to Windows 10 PCs the month after. This update is replacing the current Copilot in Windows experience. - -> [!IMPORTANT] -> Want to get started? You can enable the Microsoft Copilot experience for your users now by using the [TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) policy and pin the Microsoft 365 app using the existing policies for taskbar pinning. +The update to Microsoft 365 Copilot Chat to offer enterprise data protection is rolling out now. +The shift to Microsoft 365 Copilot Chat is coming soon. Changes will be rolled out to managed PCs starting with the September 2024 optional nonsecurity preview release, and following with the October 2024 monthly security update for all supported versions of Windows 11. These changes will be applied to Windows 10 PCs the month after. This update is replacing the current Copilot in Windows experience. + +The Copilot app will be automatically enabled after you install the Windows updates listed above if you haven't previously enabled a group policy to prevent the installation of Copilot. The [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) is available to control this Copilot experience before installing these Windows updates mentioned above or any subsequent Windows updates. + +Note that the Copilot app, which is a consumer experience, doesn't support Microsoft Entra authentication and users trying to sign in to the app using a Microsoft Entra account will be redirected to https://copilot.cloud.microsoft/ in their default browser. For users authenticating with a Microsoft Entra account, they should access Copilot through the Microsoft 365 Copilot app as the entry point. We recommend you pin Copilot to the navigation bar of the Microsoft 365 Copilot app to enable easy access. -## Policy information +## Policy information for previous Copilot in Windows (preview) experience -Admins should configure the [pinning options](/copilot/microsoft-365/pin-copilot) to enable access to Microsoft Copilot within the Microsoft 365 app in the Microsoft 365 admin center. +Admins should configure the [pinning options](/copilot/microsoft-365/pin-copilot) to enable access to Microsoft 365 Copilot Chat within the Microsoft 365 Copilot app in the Microsoft 365 admin center. -The following policy to manage Copilot in Windows (preview) will be removed in the future: +The following policy to manage Copilot in Windows (preview) will be removed in the future and is considered a legacy policy: |   | Setting | @@ -76,3 +76,83 @@ The following policy to manage Copilot in Windows (preview) will be removed in t | **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | | **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | +## Remove or prevent installation of the Copilot app + +You can remove or uninstall the Copilot app from your device by using one of the following methods: + +1. Enterprise users can uninstall the [Copilot app](https://apps.microsoft.com/detail/9NHT9RB2F4HD), which is a consumer experience, by going to **Settings** > **Apps** >**Installed Apps**. Select the three dots appearing on the right side of the app and select **Uninstall** from the dropdown list. + +1. If you are an IT administrator, you can prevent installation of the app or remove the Copilot app using one of the following methods: + 1. Prevent installation of the Copilot app: + - Configure [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) before installing Windows update. AppLocker helps you control which apps and files users can run. Note: AppLocker policy should be used instead of the [Turn Off Windows Copilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) legacy policy setting and its MDM equivalent, [TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot). The policy is subject to near-term deprecation. + - The Applocker policy can be configured by following one of the methods listed in [Edit an AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/edit-an-applocker-policy) and adding the below text to the policy: +
**Publisher**: CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US +
**Package name**: MICROSOFT.COPILOT +
**Package version**: * (and above) + + 1. Remove the Copilot app using PowerShell script: + 1. Open a Windows PowerShell window. You can do this by opening the Start menu, typing `PowerShell`, and selecting **Windows PowerShell** from the results. + 1. Once the PowerShell window is open, enter the following commands: + ```powershell + # Get the package full name of the Copilot app + $packageFullName = Get-AppxPackage -Name "Microsoft.Copilot" | Select-Object -ExpandProperty PackageFullName + # Remove the Copilot app + Remove-AppxPackage -Package $packageFullName + ``` + + +## Implications for the Copilot hardware key + +The Microsoft 365 Copilot app is now available only to consumer users authenticating with a Microsoft account and won't work for commercial users authenticating with a Microsoft Entra account. With this change, IT admins need to take steps to ensure users authenticating with a Microsoft Entra account can still access Copilot with the Copilot key. Users attempting to sign in to the Copilot app with their Microsoft Entra account will be redirected to the browser version of Microsoft 365 Copilot Chat for work (https://copilot.cloud.microsoft). + +For the optimal experience, enterprise customers should go to Windows client policies, such as Group Policy or Configuration Service Provider (CSP) policies to update the target of the key to the Microsoft 365 Copilot app so that users can access Copilot within the Microsoft 365 Copilot app. End users can also configure this from the **Settings** page. + +The Microsoft 365 Copilot app comes preinstalled on all Windows 11 PCs. If your organization uninstalled the Microsoft 365 Copilot app, we suggest you reinstall it from the Microsoft Store or your preferred application management solution so that the Copilot key can be remapped to the Microsoft 365 Copilot app. We also suggest you [Pin Microsoft 365 Copilot Chat](/copilot/microsoft-365/pin-copilot) to the navigation bar of the Microsoft 365 Copilot app. + +To avoid confusion for users as to which entry point for Microsoft 365 Copilot Chat to use, we recommend you uninstall the Copilot app. + +Use the table below to help determine the experience for your managed organization: + +| Configuration | Copilot experience | Copilot key invokes | +| ---| --- | --- | +| Copilot **not enabled** in environment | Neither Copilot in Windows (preview) nor the Microsoft 365 Copilot app are present. | Windows Search | +| Copilot **enabled** + **do not authenticate** with Microsoft Entra | Copilot in Windows (preview) is removed and replaced by the Microsoft 365 Copilot app, which is not pinned to the taskbar unless you elect to do so. | Microsoft 365 Copilot app | +| Copilot **enabled** + **authenticate** with Microsoft Entra + **new device** | Copilot in Windows (preview) is not present. Microsoft 365 Copilot Chat is accessed through the Microsoft 365 Copilot app (after post-setup update). | Microsoft 365 Copilot Chat within the Microsoft 365 Copilot app (after post-setup update). | +| Copilot **enabled** + **authenticate** with Microsoft Entra + **existing device** | Copilot in Windows (preview) is removed. Existing users with Copilot enabled on their devices will still see the Microsoft 365 Copilot app. | IT admins should use policy to remap the Copilot key to the Microsoft 365 Copilot app, or prompt users to choose. | + + +## Policies to manage the Copilot key + +Policies are available to configure the target app of the Copilot hardware key. For more information, see [WindowsAI Policy CSP](mdm/policy-csp-windowsai.md). + +To configure the Copilot key, use the following policy: + +|   | Setting | +|---|---| +| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetCopilotHardwareKey](mdm/policy-csp-windowsai.md#setcopilothardwarekey) | +| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Set Copilot Hardware Key** | + + +## End user settings for the Copilot key + +If you choose to provide users in your organization with the choice to manage their own experience, a protocol to launch the **Settings** app remap the Copilot key is available. The following can be used by apps and scripts to bring the user to the setting so they can modify it to meet their needs: + +`ms-settings:personalization-textinput-copilot-hardwarekey` + +:::image type="content" border="true" source="./images/9598546-copilot-key-settings.png" alt-text="Screenshot of the text input page in Settings." lightbox="./images/9598546-copilot-key-settings.png"::: + + + +If a user signed in with their Microsoft Entra account doesn't already have the key mapped to the Microsoft 365 Copilot app, they can select the app by going to **Settings** > **Personalization** > **Text input**, then selecting from the dropdown menu in the setting called **Customize Copilot key on keyboard**. This dropdown has options for: **Search**, **Custom**, or a currently mapped app if one is selected. + +To map the key to the Microsoft 365 Copilot app, the user should select **Custom** and then choose the Microsoft 365 Copilot app from the app picker. If this app picker is empty or doesn't include the Microsoft 365 Copilot app, they should reinstall it from the Microsoft Store. + +Users can also choose to have the Copilot key launch an app that is MSIX packaged and signed, ensuring the app options the Copilot key can remap to meet security and privacy requirements. + + +## Copilot installation with Windows updates and controls + +If you're an IT administrator and have enabled group policies to prevent the installation of Copilot, the Copilot app won't be installed on the configured devices. If you haven't enabled a group policy, you can remove the Copilot app by following one of the steps in the [Remove or prevent installation of the Copilot app](#remove-or-prevent-installation-of-the-copilot-app) section or configure the [AppLocker policy](/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) before installing Windows updates. When the AppLocker policy for Copilot is enabled, it will: + +- Prevent the app from being installed if it isn't already on the device. +- Block the app from being launched if it's already installed. \ No newline at end of file diff --git a/windows/client-management/mdm-collect-logs.md b/windows/client-management/mdm-collect-logs.md index 0a3b883dcd..1a1d05ff3c 100644 --- a/windows/client-management/mdm-collect-logs.md +++ b/windows/client-management/mdm-collect-logs.md @@ -1,7 +1,7 @@ --- title: Collect MDM logs description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows devices managed by an MDM server. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 ms.collection: - highpri diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index 5610d29c34..1b62250e8e 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -1,7 +1,7 @@ --- title: Diagnose MDM enrollment failures description: Learn how to diagnose enrollment failures for Windows devices -ms.topic: conceptual +ms.topic: troubleshooting-general ms.date: 07/08/2024 --- diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index f57170b82c..b8023a8c8f 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -1,7 +1,7 @@ --- title: MDM enrollment of Windows devices description: Learn about mobile device management (MDM) enrollment of Windows devices to simplify access to your organization's resources. -ms.topic: conceptual +ms.topic: how-to ms.collection: - highpri - tier2 diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 43e571ecb6..6534f06502 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -1,7 +1,7 @@ --- title: Known issues in MDM description: Learn about known issues for Windows devices in MDM -ms.topic: conceptual +ms.topic: troubleshooting-known-issue ms.date: 07/08/2024 --- diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 1db4cb2fee..0bac6e35c0 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -2,7 +2,7 @@ title: Mobile Device Management overview description: Windows provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. ms.date: 07/08/2024 -ms.topic: conceptual +ms.topic: article ms.localizationpriority: medium ms.collection: - highpri diff --git a/windows/client-management/mdm/Language-pack-management-csp.md b/windows/client-management/mdm/Language-pack-management-csp.md index 3fd4c9a6d5..9824f9f4bb 100644 --- a/windows/client-management/mdm/Language-pack-management-csp.md +++ b/windows/client-management/mdm/Language-pack-management-csp.md @@ -1,7 +1,8 @@ --- title: LanguagePackManagement CSP description: Learn more about the LanguagePackManagement CSP. -ms.date: 05/20/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 55180da611..5dbbb32e91 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -1,7 +1,8 @@ --- title: AccountManagement CSP description: Learn more about the AccountManagement CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -134,7 +135,7 @@ Configures when profiles will be deleted. Allowed values: 0 (delete immediately -Enable profile lifetime mangement for shared or communal device scenarios. +Enable profile lifetime management for shared or communal device scenarios. diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index 06093b49ae..9fbf72a271 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -1,7 +1,8 @@ --- title: AccountManagement DDF file description: View the XML file containing the device description framework (DDF) for the AccountManagement configuration service provider. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index e32ee78e33..2774e66244 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -54,7 +54,7 @@ Available naming macros: Supported operation is Add. > [!Note] -> For desktop PCs on Windows 10, version 2004 or later, use the **Ext/Microsoft/DNSComputerName** node in [DevDetail CSP](devdetail-csp.md). +> For desktop PCs on supported versions of Windows 10 or later, use the **Ext/Microsoft/DNSComputerName** node in [DevDetail CSP](devdetail-csp.md). **Users** Interior node for the user account information. @@ -62,12 +62,26 @@ Interior node for the user account information. **Users/_UserName_** This node specifies the username for a new local user account. This setting can be managed remotely. +> [!IMPORTANT] +> The username is limited to 20 characters. + **Users/_UserName_/Password** This node specifies the password for a new local user account. This setting can be managed remotely. Supported operation is Add. GET operation isn't supported. This setting will report as failed when deployed from Intune. +> [!IMPORTANT] +> This string needs to meet the current password policy requirements. +> +> Escape any special characters in the string. For example, +> +> | Character | Escape sequence | +> |:---|:---| +> | `<` | `<` | +> | `>` | `>` | +> | `&` | `&` | + **Users/_UserName_/LocalUserGroup** This optional node specifies the local user group that a local user account should be joined to. If the node isn't set, the new local user account is joined just to the Standard Users group. Set the value to 2 for Administrators group. This setting can be managed remotely. diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index 8d862c057a..08d97f311c 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -1,7 +1,8 @@ --- title: ActiveSync CSP description: Learn more about the ActiveSync CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 99038f75e0..7948682484 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,7 +1,8 @@ --- title: ActiveSync DDF file description: View the XML file containing the device description framework (DDF) for the ActiveSync configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md index 8b27862509..9a4927ab7f 100644 --- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md +++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md @@ -1,7 +1,8 @@ --- title: ApplicationControl DDF file description: View the XML file containing the device description framework (DDF) for the ApplicationControl configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 7d20bc1c4c..8a598bacc1 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -1,7 +1,8 @@ --- title: ApplicationControl CSP description: Learn more about the ApplicationControl CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index b7c198fd13..668e1f1cc4 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -1,7 +1,8 @@ --- title: AppLocker CSP description: Learn more about the AppLocker CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index 9d1ededd2a..17e7c8517b 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,7 +1,8 @@ --- title: AppLocker DDF file description: View the XML file containing the device description framework (DDF) for the AppLocker configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index cc69b6bb5a..226d30cd6d 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1,7 +1,8 @@ --- title: AssignedAccess CSP description: Learn more about the AssignedAccess CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -126,7 +127,7 @@ To learn how to configure xml file, see [Create an Assigned Access configuration This node can accept and return json string which comprises of account name, and AUMID for Kiosk mode app. -Example: `{"User":"domain\\user", "AUMID":"Microsoft. WindowsCalculator_8wekyb3d8bbwe!App"}`. +Example: `{"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}`. When configuring kiosk mode app, account name will be used to find the target user. Account name includes domain name and user name. Domain name can be optional if user name is unique across the system. For a local account, domain name should be machine name. When "Get" is executed on this node, domain name is always returned in the output. diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 81d21dbfab..5e6d4bba56 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,7 +1,8 @@ --- title: AssignedAccess DDF file description: View the XML file containing the device description framework (DDF) for the AssignedAccess configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index f4d06f4ce7..00bdf3ecff 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,7 +1,8 @@ --- title: BitLocker CSP description: Learn more about the BitLocker CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -551,6 +552,10 @@ The possible values for 'zz' are: - 1 = Store recovery passwords and key packages - 2 = Store recovery passwords only + +For Microsoft Entra hybrid joined devices, the BitLocker recovery password is backed up to both Active Directory and Entra ID. + +For Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID. @@ -2092,6 +2097,10 @@ The possible values for 'zz' are: - 1 = Store recovery passwords and key packages. - 2 = Store recovery passwords only. + +For Microsoft Entra hybrid joined devices, the BitLocker recovery password is backed up to both Active Directory and Entra ID. + +For Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID. diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 1680ecfd3d..c8dd0ba91c 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,7 +1,8 @@ --- title: BitLocker DDF file description: View the XML file containing the device description framework (DDF) for the BitLocker configuration service provider. -ms.date: 08/07/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index fc94239b02..0f807dd26f 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -1,7 +1,8 @@ --- title: CertificateStore CSP description: Learn more about the CertificateStore CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/certificatestore-ddf-file.md b/windows/client-management/mdm/certificatestore-ddf-file.md index b552ae24ad..4bafa3afe1 100644 --- a/windows/client-management/mdm/certificatestore-ddf-file.md +++ b/windows/client-management/mdm/certificatestore-ddf-file.md @@ -1,7 +1,8 @@ --- title: CertificateStore DDF file description: View the XML file containing the device description framework (DDF) for the CertificateStore configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index 89b0a33e28..5e07bc1dce 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -1,7 +1,8 @@ --- title: ClientCertificateInstall CSP description: Learn more about the ClientCertificateInstall CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index 20bf836b45..0939486314 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -1,7 +1,8 @@ --- title: ClientCertificateInstall DDF file description: View the XML file containing the device description framework (DDF) for the ClientCertificateInstall configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/clouddesktop-csp.md b/windows/client-management/mdm/clouddesktop-csp.md index 253efc7e95..ad088e970b 100644 --- a/windows/client-management/mdm/clouddesktop-csp.md +++ b/windows/client-management/mdm/clouddesktop-csp.md @@ -1,7 +1,8 @@ --- title: CloudDesktop CSP description: Learn more about the CloudDesktop CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md index 07c68d9f04..d793b28c1c 100644 --- a/windows/client-management/mdm/clouddesktop-ddf-file.md +++ b/windows/client-management/mdm/clouddesktop-ddf-file.md @@ -1,7 +1,8 @@ --- title: CloudDesktop DDF file description: View the XML file containing the device description framework (DDF) for the CloudDesktop configuration service provider. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -40,7 +41,7 @@ The following XML file contains the device description framework (DDF) for the C 99.9.99999 2.0 - 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF; + 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD; @@ -139,7 +140,7 @@ The following XML file contains the device description framework (DDF) for the C 10.0.22621.3374 1.0 - 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF; + 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD; diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index 99b94df749..bcb544c636 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -13,7 +13,7 @@ This article lists the OMA DM device description framework (DDF) files for vario As of December 2022, DDF XML schema was updated to include additional information such as OS build applicability. DDF v2 XML files for Windows 10 and Windows 11 are combined, and provided in a single download: -- [DDF v2 Files, May 2024](https://download.microsoft.com/download/f/6/1/f61445f7-1d38-45f7-bc8c-609b86e4aabc/DDFv2May24.zip) +- [DDF v2 Files, September 2024](https://download.microsoft.com/download/a/a/a/aaadc008-67d4-4dcd-b864-70c479baf7d6/DDFv2September24.zip) ## DDF v2 schema @@ -574,7 +574,7 @@ DDF v2 XML schema definition is listed below along with the schema definition fo ## Older DDF files You can download the older DDF files for various CSPs from the links below: - +- [Download all the DDF files for Windows 10 and 11 May 2024](https://download.microsoft.com/download/f/6/1/f61445f7-1d38-45f7-bc8c-609b86e4aabc/DDFv2May24.zip) - [Download all the DDF files for Windows 10 and 11 September 2023](https://download.microsoft.com/download/0/e/c/0ec027e5-8971-49a2-9230-ec9352bc3ead/DDFv2September2023.zip) - [Download all the DDF files for Windows 10 and 11 December 2022](https://download.microsoft.com/download/7/4/c/74c6daca-983e-4f16-964a-eef65b553a37/DDFv2December2022.zip) - [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) diff --git a/windows/client-management/mdm/declaredconfiguration-csp.md b/windows/client-management/mdm/declaredconfiguration-csp.md index 4251c9ab44..27ff417b8f 100644 --- a/windows/client-management/mdm/declaredconfiguration-csp.md +++ b/windows/client-management/mdm/declaredconfiguration-csp.md @@ -1,7 +1,8 @@ --- title: DeclaredConfiguration CSP description: Learn more about the DeclaredConfiguration CSP. -ms.date: 09/12/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -45,6 +46,8 @@ The following list shows the DeclaredConfiguration configuration service provide - [Results](#hostinventoryresults) - [{DocID}](#hostinventoryresultsdocid) - [Document](#hostinventoryresultsdociddocument) + - [ManagementServiceConfiguration](#managementserviceconfiguration) + - [ConflictResolution](#managementserviceconfigurationconflictresolution) @@ -223,7 +226,7 @@ Uniquely identifies the configuration document. No other document can have this -The Document node's value is an XML based document containing a collection of settings and values to configure the specified scenario. The Declared Configuration stack verifies the syntax of the document, the stack marks the document to be processed asynchronously by the client. The stack then returns control back to the OMA-DM service. The stack, in turn, asynchronously processes the request. Below is an example of a specified desired state configuration using the Declared Configuration URI ./Device/Vendor/MSFT/DeclaredConfiguration/Host/Complete/Documents/27FEA311-68. B9-4320-9. FC4-296. F6FDFAFE2/Document. +The Document node's value is an XML based document containing a collection of settings and values to configure the specified scenario. The Declared Configuration stack verifies the syntax of the document, the stack marks the document to be processed asynchronously by the client. The stack then returns control back to the OMA-DM service. The stack, in turn, asynchronously processes the request. Below is an example of a specified desired state configuration using the Declared Configuration URI ./Device/Vendor/MSFT/DeclaredConfiguration/Host/Complete/Documents/27FEA311-68B9-4320-9FC4-296F6FDFAFE2/Document. @@ -588,7 +591,7 @@ Uniquely identifies the inventory document. No other document can have this id. -The Document node's value is an XML based document containing a collection of settings that will be used to retrieve their values. The Declared Configuration stack verifies the syntax of the document, the stack marks the document to be processed asynchronously by the client. The stack then returns control back to the OMA-DM service. The stack, in turn, asynchronously processes the request. Below is an example of a specified desired state configuration using the Declared Configuration URI ./Device/Vendor/MSFT/DeclaredConfiguration/Host/Inventory/Documents/27FEA311-68. B9-4320-9. FC4-296. F6FDFAFE2/Document. +The Document node's value is an XML based document containing a collection of settings that will be used to retrieve their values. The Declared Configuration stack verifies the syntax of the document, the stack marks the document to be processed asynchronously by the client. The stack then returns control back to the OMA-DM service. The stack, in turn, asynchronously processes the request. Below is an example of a specified desired state configuration using the Declared Configuration URI ./Device/Vendor/MSFT/DeclaredConfiguration/Host/Inventory/Documents/27FEA311-68B9-4320-9FC4-296F6FDFAFE2/Document. @@ -728,6 +731,93 @@ The Document node's value is an XML based document containing a collection of se + +## ManagementServiceConfiguration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DeclaredConfiguration/ManagementServiceConfiguration +``` + + + + +The ManagementServiceConfiguration node that's used to control certain Windows Declared Configuration behavior. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### ManagementServiceConfiguration/ConflictResolution + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DeclaredConfiguration/ManagementServiceConfiguration/ConflictResolution +``` + + + + +This node controls to turn on conflict resolution on and off. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | The conflict resolution is OFF. | +| 1 | The conflict resolution is ON. | + + + + + + + + ## DeclaredConfiguration OMA URI diff --git a/windows/client-management/mdm/declaredconfiguration-ddf-file.md b/windows/client-management/mdm/declaredconfiguration-ddf-file.md index 07e2e406e6..bd5711d552 100644 --- a/windows/client-management/mdm/declaredconfiguration-ddf-file.md +++ b/windows/client-management/mdm/declaredconfiguration-ddf-file.md @@ -1,7 +1,8 @@ --- title: DeclaredConfiguration DDF file description: View the XML file containing the device description framework (DDF) for the DeclaredConfiguration configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -466,6 +467,61 @@ The following XML file contains the device description framework (DDF) for the D + + ManagementServiceConfiguration + + + + + The ManagementServiceConfiguration node that is used to control certain Windows Declared Configuration behavior + + + + + + + + + + + + + + + ConflictResolution + + + + + + + + This node controls to turn on conflict resolution on and off. + + + + + + + + + + + + + + + 0 + The conflict resolution is OFF. + + + 1 + The conflict resolution is ON. + + + + + ``` diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 198570987e..b3beaf7ff2 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,7 +1,8 @@ --- title: Defender CSP description: Learn more about the Defender CSP. -ms.date: 06/21/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1289,7 +1290,7 @@ Define data duplication remote location for Device Control. When configuring thi -Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 25 days when enabled. +Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 30 days when enabled. @@ -1304,7 +1305,7 @@ Configure how many days can pass before an aggressive quick scan is triggered. T | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[7-60]` | -| Default Value | 25 | +| Default Value | 30 | @@ -3775,9 +3776,9 @@ Enable this policy to specify when devices receive Microsoft Defender security i | Value | Description | |:--|:--| -| 0 (Default) | Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. | -| 4 | Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). | -| 5 | Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). | +| 0 (Default) | Not configured (Default). Microsoft will either assign the device to Current Channel (Broad) or a beta channel early in the gradual release cycle. The channel selected by Microsoft might be one that receives updates early during the gradual release cycle, which may not be suitable for devices in a production or critical environment. | +| 4 | Current Channel (Staged): Same as Current Channel (Broad). | +| 5 | Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in all populations, including production. | diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index f286ba947c..000fc9209d 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,7 +1,8 @@ --- title: Defender DDF file description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1627,15 +1628,15 @@ The following XML file contains the device description framework (DDF) for the D 0 - Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. + Not configured (Default). Microsoft will either assign the device to Current Channel (Broad) or a beta channel early in the gradual release cycle. The channel selected by Microsoft might be one that receives updates early during the gradual release cycle, which may not be suitable for devices in a production or critical environment 4 - Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). + Current Channel (Staged): Same as Current Channel (Broad). 5 - Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in all populations, including production. @@ -2373,8 +2374,8 @@ The following XML file contains the device description framework (DDF) for the D - 25 - Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 25 days when enabled. + 30 + Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 30 days when enabled. diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index ef825d0541..98224519ff 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,7 +1,8 @@ --- title: DevDetail CSP description: Learn more about the DevDetail CSP. -ms.date: 08/06/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -399,7 +400,7 @@ Total free storage in MB from first internal drive on the device. -Returns the client local time in ISO 8601 format. Example: 2003-06-16. T18:37:44Z. +Returns the client local time in ISO 8601 format. Example: 2003-06-16T18:37:44Z. @@ -1259,7 +1260,7 @@ Returns the name of the Original Equipment Manufacturer (OEM) as a string, as de -Returns the Windows 10 OS software version in the format MajorVersion. MinorVersion. BuildNumber. QFEnumber. Currently the BuildNumber returns the build number on the desktop and mobile build number on the phone. In the future, the build numbers may converge. +Returns the Windows 10 OS software version in the format `MajorVersion.MinorVersion.BuildNumber.QFEnumber`. Currently the BuildNumber returns the build number on the desktop and mobile build number on the phone. In the future, the build numbers may converge. diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index c7b1a08470..c95e76c1f5 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,7 +1,8 @@ --- title: DevDetail DDF file description: View the XML file containing the device description framework (DDF) for the DevDetail configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 7ca0975068..6512893f20 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -1,7 +1,8 @@ --- title: DeviceManageability CSP description: Learn more about the DeviceManageability CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index 4769870f2a..108d6f2baa 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -1,7 +1,8 @@ --- title: DeviceManageability DDF file description: View the XML file containing the device description framework (DDF) for the DeviceManageability configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md index b93cdfd164..d466c262e7 100644 --- a/windows/client-management/mdm/devicepreparation-csp.md +++ b/windows/client-management/mdm/devicepreparation-csp.md @@ -1,7 +1,8 @@ --- title: DevicePreparation CSP description: Learn more about the DevicePreparation CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md index 903c08866d..c0c37e1261 100644 --- a/windows/client-management/mdm/devicepreparation-ddf-file.md +++ b/windows/client-management/mdm/devicepreparation-ddf-file.md @@ -1,7 +1,8 @@ --- title: DevicePreparation DDF file description: View the XML file containing the device description framework (DDF) for the DevicePreparation configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index c119bdbf72..9c6ace8133 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -1,7 +1,8 @@ --- title: DeviceStatus CSP description: Learn more about the DeviceStatus CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index d1977f5eaa..19018f4905 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -1,7 +1,8 @@ --- title: DeviceStatus DDF file description: View the XML file containing the device description framework (DDF) for the DeviceStatus configuration service provider. -ms.date: 08/07/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index 348fd292dc..66333fd3ba 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -1,7 +1,8 @@ --- title: DevInfo CSP description: Learn more about the DevInfo CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index a57636514a..39841d704f 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,7 +1,8 @@ --- title: DevInfo DDF file description: View the XML file containing the device description framework (DDF) for the DevInfo configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 01c937ef35..971e077470 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,7 +1,8 @@ --- title: DiagnosticLog CSP description: Learn more about the DiagnosticLog CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 03887d47c3..47b12ad46b 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,7 +1,8 @@ --- title: DiagnosticLog DDF file description: View the XML file containing the device description framework (DDF) for the DiagnosticLog configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index 271a68b16e..fa5cbb05be 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,7 +1,8 @@ --- title: DMAcc CSP description: Learn more about the DMAcc CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 15fc5f3231..2d3fb556aa 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,7 +1,8 @@ --- title: DMAcc DDF file description: View the XML file containing the device description framework (DDF) for the DMAcc configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 10c971f332..dafa7bc0bb 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -1,7 +1,8 @@ --- title: DMClient CSP description: Learn more about the DMClient CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1654,7 +1655,7 @@ This node allows the MDM to set custom error text, detailing what the user needs -This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseModernAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. E. G. ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName/Name;4"\xF000" ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName2/Name;2 Which will represent that App Package PackageFullName contains 4 apps, whereas PackageFullName2 contains 2 apps. +This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseModernAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. For example, `./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName/Name;4"\xF000" ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName2/Name;2` Which will represent that App Package PackageFullName contains 4 apps, whereas PackageFullName2 contains 2 apps. @@ -1694,7 +1695,7 @@ This node contains a list of LocURIs that refer to App Packages the ISV expects -This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. E. G. ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2 Which will represent that App Package ProductID1 contains 4 apps, whereas ProductID2 contains 2 apps. +This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. For example, `./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2` Which will represent that App Package ProductID1 contains 4 apps, whereas ProductID2 contains 2 apps. @@ -4311,7 +4312,7 @@ This node allows the MDM to set custom error text, detailing what the user needs -This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseModernAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. E. G. ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName/Name;4"\xF000" ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName2/Name;2 Which will represent that App Package PackageFullName contains 4 apps, whereas PackageFullName2 contains 2 apps. This is per user. +This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseModernAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. For example, `./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName/Name;4"\xF000" ./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/PackageFullName2/Name;2` Which will represent that App Package PackageFullName contains 4 apps, whereas PackageFullName2 contains 2 apps. This is per user. @@ -4351,7 +4352,7 @@ This node contains a list of LocURIs that refer to App Packages the ISV expects -This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. E. G. ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2 Which will represent that App Package ProductID1 contains 4 apps, whereas ProductID2 contains 2 apps. This is per user. +This node contains a list of LocURIs that refer to App Packages the ISV expects to provision via EnterpriseDesktopAppManagement CSP, delimited by the character L"\xF000". The LocURI will be followed by a semicolon and a number, representing the number of apps included in the App Package. We won't verify that number. For example, `./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID1/Status;4"\xF000" ./User/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/ProductID2/Status;2` Which will represent that App Package ProductID1 contains 4 apps, whereas ProductID2 contains 2 apps. This is per user. diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index b82d0fe21b..e56f464486 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,7 +1,8 @@ --- title: DMClient DDF file description: View the XML file containing the device description framework (DDF) for the DMClient configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index cb09b51a30..2e9994efd2 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -1,7 +1,8 @@ --- title: EMAIL2 CSP description: Learn more about the EMAIL2 CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index 144f69b17d..853b0143c9 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,7 +1,8 @@ --- title: EMAIL2 DDF file description: View the XML file containing the device description framework (DDF) for the EMAIL2 configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index e0331f74f7..1e7b4ce38f 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -1,7 +1,8 @@ --- title: EnterpriseDesktopAppManagement CSP description: Learn more about the EnterpriseDesktopAppManagement CSP. -ms.date: 05/20/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md index ba537d72e7..898fd84ff0 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md @@ -1,7 +1,8 @@ --- title: EnterpriseDesktopAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseDesktopAppManagement configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 6357958bf3..878a0a1212 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,7 +1,8 @@ --- title: EnterpriseModernAppManagement CSP description: Learn more about the EnterpriseModernAppManagement CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -6951,7 +6952,7 @@ Interior node for all managed app setting values. -The SettingValue and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the Managed. App. Settings container. +The SettingValue and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the `Managed.App.Settings` container. @@ -8193,7 +8194,7 @@ This node is only supported in the user context. -The SettingValue and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the Managed. App. Settings container. +The SettingValue and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the `Managed.App.Settings` container. @@ -9495,7 +9496,7 @@ This node is only supported in the user context. -The SettingValue and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the Managed. App. Settings container. +The SettingValue and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the `Managed.App.Settings` container. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 5b95cba183..785c3ec2de 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,7 +1,8 @@ --- title: EnterpriseModernAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index a4af4d0697..d0c56c5e8c 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,7 +1,8 @@ --- title: eUICCs CSP description: Learn more about the eUICCs CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 6a148a8d22..3b2b23d68b 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,7 +1,8 @@ --- title: eUICCs DDF file description: View the XML file containing the device description framework (DDF) for the eUICCs configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index e269946643..e782cfc9c3 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -1,7 +1,8 @@ --- title: Firewall CSP description: Learn more about the Firewall CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -2221,7 +2222,7 @@ Specifies the friendly name of the firewall rule. -Specifies one WDAC tag. This is a string that can contain any alphanumeric character and any of the characters ":", "/", ""., and "_". A PolicyAppId and ServiceName can't be specified in the same rule. +Specifies one App Control tag. This is a string that can contain any alphanumeric character and any of the characters ":", "/", ""., and "_". A PolicyAppId and ServiceName can't be specified in the same rule. diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index e48568b2b5..d0cc7b9d7c 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,7 +1,8 @@ --- title: Firewall DDF file description: View the XML file containing the device description framework (DDF) for the Firewall configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 4367d3cb2f..99029bde87 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,7 +1,8 @@ --- title: HealthAttestation CSP description: Learn more about the HealthAttestation CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -51,7 +52,7 @@ The following list shows the HealthAttestation configuration service provider no | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5046732](https://support.microsoft.com/help/5046732) [10.0.22621.4541] and later
✅ Windows 11, version 24H2 with [KB5046617](https://support.microsoft.com/help/5046617) [10.0.26100.2314] and later
✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 0c9d382872..3acbfc05ad 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,7 +1,8 @@ --- title: HealthAttestation DDF file description: View the XML file containing the device description framework (DDF) for the HealthAttestation configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -436,7 +437,7 @@ The following XML file contains the device description framework (DDF) for the H - 99.9.99999 + 99.9.99999, 10.0.26100.2314, 10.0.22621.4541 1.4 diff --git a/windows/client-management/mdm/index.yml b/windows/client-management/mdm/index.yml index f1b84cf506..632aec5fb8 100644 --- a/windows/client-management/mdm/index.yml +++ b/windows/client-management/mdm/index.yml @@ -9,7 +9,7 @@ metadata: ms.topic: landing-page ms.collection: - tier1 - ms.date: 10/25/2023 + ms.date: 10/07/2024 ms.localizationpriority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -27,8 +27,8 @@ landingContent: url: configuration-service-provider-support.md - text: Device description framework (DDF) files url: configuration-service-provider-ddf.md - - text: BitLocker CSP - url: bitlocker-csp.md + - text: Contribute to CSP reference + url: contribute-csp-reference.md - text: Declared Configuration protocol url: ../declared-configuration.md @@ -42,8 +42,8 @@ landingContent: url: policy-configuration-service-provider.md - text: Policy DDF file url: configuration-service-provider-ddf.md - - text: Policy CSP - Start - url: policy-csp-start.md + - text: Policy CSP - Defender + url: policy-csp-defender.md - text: Policy CSP - Update url: policy-csp-update.md diff --git a/windows/client-management/mdm/language-pack-management-ddf-file.md b/windows/client-management/mdm/language-pack-management-ddf-file.md index 3739f4f142..1cbe49e886 100644 --- a/windows/client-management/mdm/language-pack-management-ddf-file.md +++ b/windows/client-management/mdm/language-pack-management-ddf-file.md @@ -1,7 +1,8 @@ --- title: LanguagePackManagement DDF file description: View the XML file containing the device description framework (DDF) for the LanguagePackManagement configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md index 0e5e7d5b2d..0f5b037f09 100644 --- a/windows/client-management/mdm/laps-csp.md +++ b/windows/client-management/mdm/laps-csp.md @@ -1,7 +1,8 @@ --- title: LAPS CSP description: Learn more about the LAPS CSP. -ms.date: 06/21/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 06/21/2024 # LAPS CSP -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - The Local Administrator Password Solution (LAPS) configuration service provider (CSP) is used by the enterprise to manage back up of local administrator account passwords. Windows supports a LAPS Group Policy Object that is entirely separate from the LAPS CSP. Many of the various settings are common across both the LAPS GPO and CSP (GPO does not support any of the Action-related settings). As long as at least one LAPS setting is configured via CSP, any GPO-configured settings will be ignored. Also see [Configure policy settings for Windows LAPS](/windows-server/identity/laps/laps-management-policy-settings). @@ -327,7 +326,7 @@ Note if a custom managed local administrator account name is specified in this s Use this setting to configure whether the password is encrypted before being stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. This setting is only honored when the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. @@ -389,7 +388,7 @@ If not specified, this setting defaults to True. Use this setting to configure the name or SID of a user or group that can decrypt the password stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. If not specified, the password will be decryptable by the Domain Admins group in the device's domain. @@ -432,7 +431,7 @@ If the specified user or group account is invalid the device will fallback to us | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -488,7 +487,7 @@ If not specified, this setting defaults to False. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -543,7 +542,7 @@ If not specified, this setting defaults to False. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -587,7 +586,7 @@ If not specified, this setting will default to "WLapsAdmin". | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -643,7 +642,7 @@ If not specified, this setting defaults to False. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -759,7 +758,7 @@ If not specified, this setting will default to 0. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/laps-ddf-file.md b/windows/client-management/mdm/laps-ddf-file.md index 5d06e470a6..f8f906fd5d 100644 --- a/windows/client-management/mdm/laps-ddf-file.md +++ b/windows/client-management/mdm/laps-ddf-file.md @@ -1,7 +1,8 @@ --- title: LAPS DDF file description: View the XML file containing the device description framework (DDF) for the LAPS configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -80,7 +81,7 @@ The following XML file contains the device description framework (DDF) for the L The allowable settings are: 0=Disabled (password will not be backed up) -1=Backup the password to Azure AD only +1=Backup the password to Microsoft Entra ID only 2=Backup the password to Active Directory only If not specified, this setting will default to 0. @@ -103,7 +104,7 @@ If not specified, this setting will default to 0. 1 - Backup the password to Azure AD only + Backup the password to Microsoft Entra ID only 2 @@ -126,7 +127,7 @@ If not specified, this setting will default to 0. If not specified, this setting will default to 30 days -This setting has a minimum allowed value of 1 day when backing the password to onpremises Active Directory, and 7 days when backing the password to Azure AD. +This setting has a minimum allowed value of 1 day when backing the password to onpremises Active Directory, and 7 days when backing the password to Microsoft Entra ID. This setting has a maximum allowed value of 365 days. @@ -154,7 +155,7 @@ This setting has a maximum allowed value of 365 days. 1 - BackupDirectory configured to Azure AD + BackupDirectory configured to Microsoft Entra ID @@ -327,7 +328,7 @@ This setting has a maximum allowed value of 10 words. - 99.9.9999 + 10.0.26100 1.1 @@ -442,7 +443,7 @@ If not specified, this setting defaults to True. True Use this setting to configure whether the password is encrypted before being stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. This setting is only honored when the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. @@ -499,7 +500,7 @@ If not specified, this setting defaults to True. Use this setting to configure the name or SID of a user or group that can decrypt the password stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. If not specified, the password will be decryptable by the Domain Admins group in the device's domain. @@ -690,7 +691,7 @@ If not specified, this setting defaults to False. - 99.9.9999 + 10.0.26100 1.1 @@ -736,7 +737,7 @@ If not specified, this setting will default to 1. - 99.9.9999 + 10.0.26100 1.1 @@ -791,7 +792,7 @@ If not specified, this setting will default to "WLapsAdmin". - 99.9.9999 + 10.0.26100 1.1 @@ -839,7 +840,7 @@ If not specified, this setting defaults to False. - 99.9.9999 + 10.0.26100 1.1 @@ -897,7 +898,7 @@ If not specified, this setting defaults to False. - 99.9.9999 + 10.0.26100 1.1 diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 8eba61aa61..f8e643ccae 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,7 +1,8 @@ --- title: NetworkProxy CSP description: Learn more about the NetworkProxy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index 4448901798..99756c2d7c 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -1,7 +1,8 @@ --- title: NetworkProxy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkProxy configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index 87c98019ce..3320f36adc 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -1,7 +1,8 @@ --- title: NetworkQoSPolicy CSP description: Learn more about the NetworkQoSPolicy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 04b4528ac6..52080f9687 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,7 +1,8 @@ --- title: NetworkQoSPolicy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkQoSPolicy configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index 53c5f2e391..91fb84f680 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -1,7 +1,8 @@ --- title: NodeCache CSP description: Learn more about the NodeCache CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 4d442904e4..a635dca24e 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,7 +1,8 @@ --- title: NodeCache DDF file description: View the XML file containing the device description framework (DDF) for the NodeCache configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index 70692efc8b..0fe23966a6 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -1,7 +1,8 @@ --- title: Office CSP description: Learn more about the Office CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -11,7 +12,7 @@ ms.date: 01/18/2024 -The Office configuration service provider (CSP) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool (ODT). For more information, see [Configuration options for the Office Deployment Tool](/deployoffice/office-deployment-tool-configuration-options) and [How to assign Office 365 apps to Windows 10 devices with Microsoft Intune](/intune/apps-add-office365). +The Office configuration service provider (CSP) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool (ODT). For more information, see [Configuration options for the Office Deployment Tool](/deployoffice/office-deployment-tool-configuration-options) and [Add Microsoft 365 Apps to Windows devices with Microsoft Intune](/mem/intune/apps/apps-add-office365). @@ -587,7 +588,7 @@ To get the current status of Office 365 on the device. | 17001 | ERROR_QUEUE_SCENARIO
Failed to queue installation scenario in C2RClient | Failure | | 17002 | ERROR_COMPLETING_SCENARIO
Failed to complete the process. Possible reasons:
  • Installation canceled by user
  • Installation canceled by another installation
  • Out of disk space during installation
  • Unknown language ID | Failure | | 17003 | ERROR_ANOTHER_RUNNING_SCENARIO
    Another scenario is running | Failure | -| 17004 | ERROR_COMPLETING_SCENARIO_NEED_CLEAN_UP
    Possible reasons:
  • Unknown SKUs
  • Content does't exist on CDN
    • Such as trying to install an unsupported LAP, like zh-sg
    • CDN issue that content is not available
  • Signature check issue, such as failed the signature check for Office content
  • User canceled | Failure | +| 17004 | ERROR_COMPLETING_SCENARIO_NEED_CLEAN_UP
    Possible reasons:
  • Unknown SKUs
  • Content doesn't exist on CDN
    • Such as trying to install an unsupported LAP, like zh-sg
    • CDN issue that content is not available
  • Signature check issue, such as failed the signature check for Office content
  • User canceled | Failure | | 17005 | ERROR_SCENARIO_CANCELLED_AS_PLANNED | Failure | | 17006 | ERROR_SCENARIO_CANCELLED
    Blocked update by running apps | Failure | | 17007 | ERROR_REMOVE_INSTALLATION_NEEDED
    The client is requesting client clean-up in a "Remove Installation" scenario | Failure | diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index e36405ce71..15d49860a7 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -1,7 +1,8 @@ --- title: Office DDF file description: View the XML file containing the device description framework (DDF) for the Office configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 2b322e0891..1151ff64a9 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -1,7 +1,8 @@ --- title: PassportForWork CSP description: Learn more about the PassportForWork CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -265,7 +266,7 @@ If the user forgets their PIN, it can be changed to a new PIN using the Windows | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index c94b22aed5..a40108a1d3 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,7 +1,8 @@ --- title: PassportForWork DDF file description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -831,7 +832,7 @@ If you disable or do not configure this policy setting, the PIN recovery secret - 99.9.99999 + 10.0.22621 1.6 diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index 2a4648393a..68a0344e14 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -1,25 +1,32 @@ --- -title: PDE CSP -description: Learn more about the PDE CSP. -ms.date: 01/18/2024 +title: Personal Data Encryption CSP +description: Learn more about the Personal Data Encryption CSP. +ms.date: 02/13/2025 +ms.topic: generated-reference --- -# PDE CSP +# Personal Data Encryption CSP -The Personal Data Encryption (PDE) configuration service provider (CSP) is used by the enterprise to protect data confidentiality of PCs and devices. This CSP was added in Windows 11, version 22H2. +The Personal Data Encryption configuration service provider (CSP) is used by the enterprise to protect data confidentiality of PCs and devices. This CSP was added in Windows 11, version 22H2. -The following list shows the PDE configuration service provider nodes: +The following list shows the Personal Data Encryption configuration service provider nodes: - ./User/Vendor/MSFT/PDE - [EnablePersonalDataEncryption](#enablepersonaldataencryption) + - [ProtectFolders](#protectfolders) + - [ProtectDesktop](#protectfoldersprotectdesktop) + - [ProtectDocuments](#protectfoldersprotectdocuments) + - [ProtectPictures](#protectfoldersprotectpictures) - [Status](#status) + - [FolderProtectionStatus](#statusfolderprotectionstatus) + - [FoldersProtected](#statusfoldersprotected) - [PersonalDataEncryptionStatus](#statuspersonaldataencryptionstatus) @@ -45,7 +52,7 @@ Allows the Admin to enable Personal Data Encryption. Set to '1' to set this poli -The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) public API allows the applications running as the user to encrypt data as soon as this policy is enabled. However, prerequisites must be met for PDE to be enabled. +The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) public API allows the applications running as the user to encrypt data as soon as this policy is enabled. However, prerequisites must be met for Personal Data Encryption to be enabled. @@ -72,6 +79,191 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u + +## ProtectFolders + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### ProtectFolders/ProtectDesktop + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDesktop +``` + + + + +Allows the Admin to enable Personal Data Encryption on Desktop folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Dependency [EnablePersonalDataEncryptionDependency] | Dependency Type: `DependsOn`
    Dependency URI: `User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`
    Dependency Allowed Value: `1`
    Dependency Allowed Value Type: `ENUM`
    | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable Personal Data Encryption on the folder. If the folder is currently protected by Personal Data Encryption, this will result in unprotecting the folder. | +| 1 | Enable Personal Data Encryption on the folder. | + + + + + + + + + +### ProtectFolders/ProtectDocuments + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDocuments +``` + + + + +Allows the Admin to enable Personal Data Encryption on Documents folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Dependency [EnablePersonalDataEncryptionDependency] | Dependency Type: `DependsOn`
    Dependency URI: `User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`
    Dependency Allowed Value: `1`
    Dependency Allowed Value Type: `ENUM`
    | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable Personal Data Encryption on the folder. If the folder is currently protected by Personal Data Encryption, this will result in unprotecting the folder. | +| 1 | Enable Personal Data Encryption on the folder. | + + + + + + + + + +### ProtectFolders/ProtectPictures + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectPictures +``` + + + + +Allows the Admin to enable Personal Data Encryption on Pictures folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Dependency [EnablePersonalDataEncryptionDependency] | Dependency Type: `DependsOn`
    Dependency URI: `User/Vendor/MSFT/PDE/EnablePersonalDataEncryption`
    Dependency Allowed Value: `1`
    Dependency Allowed Value Type: `ENUM`
    | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable Personal Data Encryption on the folder. If the folder is currently protected by Personal Data Encryption, this will result in unprotecting the folder. | +| 1 | Enable Personal Data Encryption on the folder. | + + + + + + + + ## Status @@ -93,10 +285,10 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u -Reports the current status of Personal Data Encryption (PDE) for the user. +Reports the current status of Personal Data Encryption for the user. -- If prerequisites of PDE aren't met, then the status will be 0. -- If all prerequisites are met for PDE, then PDE will be enabled and status will be 1. +- If prerequisites of Personal Data Encryption aren't met, then the status will be 0. +- If all prerequisites are met for Personal Data Encryption, then Personal Data Encryption will be enabled and status will be 1. @@ -114,6 +306,95 @@ Reports the current status of Personal Data Encryption (PDE) for the user. + +### Status/FolderProtectionStatus + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/PDE/Status/FolderProtectionStatus +``` + + + + +This node reports folder protection status for a user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Protection not started. | +| 1 | Protection is completed with no failures. | +| 2 | Protection in progress. | +| 3 | Protection failed. | + + + + + + + + + +### Status/FoldersProtected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/PDE/Status/FoldersProtected +``` + + + + +This node reports all folders (full path to each folder) that have been protected. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + ### Status/PersonalDataEncryptionStatus diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md index 165f97507c..9d837a739c 100644 --- a/windows/client-management/mdm/personaldataencryption-ddf-file.md +++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md @@ -1,14 +1,15 @@ --- -title: PDE DDF file -description: View the XML file containing the device description framework (DDF) for the PDE configuration service provider. -ms.date: 06/28/2024 +title: Personal Data Encryption DDF file +description: View the XML file containing the device description framework (DDF) for the Personal Data Encryption configuration service provider. +ms.date: 02/13/2025 +ms.topic: generated-reference --- -# PDE DDF file +# Personal Data Encryption DDF file -The following XML file contains the device description framework (DDF) for the PDE configuration service provider. +The following XML file contains the device description framework (DDF) for the Personal Data Encryption configuration service provider. ```xml @@ -76,6 +77,171 @@ The following XML file contains the device description framework (DDF) for the P     + + ProtectFolders + + + + + + + + + + + + + + + + + + 10.0.26100 + 1.0 + + + + ProtectDocuments + + + + + + + + Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + User/Vendor/MSFT/PDE/EnablePersonalDataEncryption + + + 1 + Requires EnablePersonalDataEncryption to be set to 1. + + + + + + + + + ProtectDesktop + + + + + + + + Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + User/Vendor/MSFT/PDE/EnablePersonalDataEncryption + + + 1 + Requires EnablePersonalDataEncryption to be set to 1. + + + + + + + + + ProtectPictures + + + + + + + + Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + User/Vendor/MSFT/PDE/EnablePersonalDataEncryption + + + 1 + Requires EnablePersonalDataEncryption to be set to 1. + + + + + + + + Status @@ -116,6 +282,74 @@ The following XML file contains the device description framework (DDF) for the P + + FolderProtectionStatus + + + + + This node reports folder protection status for a user. + + + + + + + + + + + + + + 10.0.26100 + 1.0 + + + + 0 + Protection not started. + + + 1 + Protection is completed with no failures. + + + 2 + Protection in progress. + + + 3 + Protection failed. + + + + + + FoldersProtected + + + + + This node reports all folders (full path to each folder) that have been protected. + + + + + + + + + + + + + + 10.0.26100 + 1.0 + + + @@ -123,4 +357,4 @@ The following XML file contains the device description framework (DDF) for the P ## Related articles -[PDE configuration service provider reference](personaldataencryption-csp.md) +[Personal Data Encryption configuration service provider reference](personaldataencryption-csp.md) diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 56a05d8beb..b08ee9521e 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,7 +1,8 @@ --- title: Personalization CSP description: Learn more about the Personalization CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index 052f60bfcd..66928db977 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,7 +1,8 @@ --- title: Personalization DDF file description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -42,7 +43,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index c0c0fd2588..826ef1ac3b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -137,7 +137,6 @@ ms.date: 02/03/2023 - [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#configuredeadlineforfeatureupdates) 11 - [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#configuredeadlineforqualityupdates) 11 - [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#configuredeadlinegraceperiod) 11 -- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#configuredeadlinenoautoreboot) 11 - [Update/DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays) - [Update/DeferQualityUpdatesPeriodInDays](policy-csp-update.md#deferqualityupdatesperiodindays) - [Update/ManagePreviewBuilds](policy-csp-update.md#managepreviewbuilds) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index ebfe368e86..efe09a55c0 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,7 +1,8 @@ --- title: Policies supported by Windows 10 Team description: Learn about the policies supported by Windows 10 Team. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -382,8 +383,10 @@ This article lists the policies that are applicable for the Surface Hub operatin ## Start +- [AlwaysShowNotificationIcon](policy-csp-start.md#alwaysshownotificationicon) - [HideRecommendedPersonalizedSites](policy-csp-start.md#hiderecommendedpersonalizedsites) - [StartLayout](policy-csp-start.md#startlayout) +- [TurnOffAbbreviatedDateTimeFormat](policy-csp-start.md#turnoffabbreviateddatetimeformat) ## System @@ -417,6 +420,7 @@ This article lists the policies that are applicable for the Surface Hub operatin - [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc) - [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis) - [ForceTouchKeyboardDockedState](policy-csp-textinput.md#forcetouchkeyboarddockedstate) +- [TouchKeyboardControllerModeAvailability](policy-csp-textinput.md#touchkeyboardcontrollermodeavailability) - [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md#touchkeyboarddictationbuttonavailability) - [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md#touchkeyboardemojibuttonavailability) - [TouchKeyboardFullModeAvailability](policy-csp-textinput.md#touchkeyboardfullmodeavailability) diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md index 0ad7b632c3..b3ead6b748 100644 --- a/windows/client-management/mdm/policies-in-preview.md +++ b/windows/client-management/mdm/policies-in-preview.md @@ -1,7 +1,8 @@ --- title: Configuration service provider preview policies description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -17,6 +18,11 @@ This article lists the policies that are applicable for Windows Insider Preview - [TurnOffInstallTracing](policy-csp-appdeviceinventory.md#turnoffinstalltracing) - [TurnOffAPISamping](policy-csp-appdeviceinventory.md#turnoffapisamping) - [TurnOffApplicationFootprint](policy-csp-appdeviceinventory.md#turnoffapplicationfootprint) +- [TurnOffWin32AppBackup](policy-csp-appdeviceinventory.md#turnoffwin32appbackup) + +## ApplicationManagement + +- [AllowedNonAdminPackageFamilyNameRules](policy-csp-applicationmanagement.md#allowednonadminpackagefamilynamerules) ## ClientCertificateInstall CSP @@ -28,41 +34,27 @@ This article lists the policies that are applicable for Windows Insider Preview - [EnablePhysicalDeviceAccessOnErrorScreens](clouddesktop-csp.md#userenablephysicaldeviceaccessonerrorscreens) - [EnableBootToCloudSharedPCMode](clouddesktop-csp.md#deviceenableboottocloudsharedpcmode) -## Cryptography +## Connectivity -- [ConfigureEllipticCurveCryptography](policy-csp-cryptography.md#configureellipticcurvecryptography) -- [ConfigureSystemCryptographyForceStrongKeyProtection](policy-csp-cryptography.md#configuresystemcryptographyforcestrongkeyprotection) -- [OverrideMinimumEnabledTLSVersionClient](policy-csp-cryptography.md#overrideminimumenabledtlsversionclient) -- [OverrideMinimumEnabledTLSVersionServer](policy-csp-cryptography.md#overrideminimumenabledtlsversionserver) -- [OverrideMinimumEnabledDTLSVersionClient](policy-csp-cryptography.md#overrideminimumenableddtlsversionclient) -- [OverrideMinimumEnabledDTLSVersionServer](policy-csp-cryptography.md#overrideminimumenableddtlsversionserver) +- [DisableCrossDeviceResume](policy-csp-connectivity.md#disablecrossdeviceresume) +- [UseCellularWhenWiFiPoor](policy-csp-connectivity.md#usecellularwhenwifipoor) +- [DisableCellularSettingsPage](policy-csp-connectivity.md#disablecellularsettingspage) +- [DisableCellularOperatorSettingsPage](policy-csp-connectivity.md#disablecellularoperatorsettingspage) ## DeclaredConfiguration CSP - [Document](declaredconfiguration-csp.md#hostcompletedocumentsdociddocument) - [Abandoned](declaredconfiguration-csp.md#hostcompletedocumentsdocidpropertiesabandoned) +- [ConflictResolution](declaredconfiguration-csp.md#managementserviceconfigurationconflictresolution) ## DeliveryOptimization - [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md#dodisallowcacheserverdownloadsonvpn) - [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords) -## DesktopAppInstaller +## DeviceGuard -- [EnableWindowsPackageManagerCommandLineInterfaces](policy-csp-desktopappinstaller.md#enablewindowspackagemanagercommandlineinterfaces) -- [EnableWindowsPackageManagerConfiguration](policy-csp-desktopappinstaller.md#enablewindowspackagemanagerconfiguration) - -## DeviceLock - -- [MaximumPasswordAge](policy-csp-devicelock.md#maximumpasswordage) -- [ClearTextPassword](policy-csp-devicelock.md#cleartextpassword) -- [PasswordComplexity](policy-csp-devicelock.md#passwordcomplexity) -- [PasswordHistorySize](policy-csp-devicelock.md#passwordhistorysize) -- [AccountLockoutPolicy](policy-csp-devicelock.md#accountlockoutpolicy) -- [AllowAdministratorLockout](policy-csp-devicelock.md#allowadministratorlockout) -- [MinimumPasswordLength](policy-csp-devicelock.md#minimumpasswordlength) -- [MinimumPasswordLengthAudit](policy-csp-devicelock.md#minimumpasswordlengthaudit) -- [RelaxMinimumPasswordLengthLimits](policy-csp-devicelock.md#relaxminimumpasswordlengthlimits) +- [MachineIdentityIsolation](policy-csp-deviceguard.md#machineidentityisolation) ## DevicePreparation CSP @@ -77,6 +69,11 @@ This article lists the policies that are applicable for Windows Insider Preview - [MdmAgentInstalled](devicepreparation-csp.md#mdmprovidermdmagentinstalled) - [RebootRequired](devicepreparation-csp.md#mdmproviderrebootrequired) +## Display + +- [ConfigureMultipleDisplayMode](policy-csp-display.md#configuremultipledisplaymode) +- [SetClonePreferredResolutionSource](policy-csp-display.md#setclonepreferredresolutionsource) + ## DMClient CSP - [DiscoveryEndpoint](dmclient-csp.md#deviceproviderprovideridlinkedenrollmentdiscoveryendpoint) @@ -84,12 +81,6 @@ This article lists the policies that are applicable for Windows Insider Preview - [Cadence](dmclient-csp.md#deviceproviderprovideridconfigrefreshcadence) - [PausePeriod](dmclient-csp.md#deviceproviderprovideridconfigrefreshpauseperiod) -## Experience - -- [AllowScreenRecorder](policy-csp-experience.md#allowscreenrecorder) -- [EnableOrganizationalMessages](policy-csp-experience.md#enableorganizationalmessages) -- [DisableTextTranslation](policy-csp-experience.md#disabletexttranslation) - ## FileSystem - [EnableDevDrive](policy-csp-filesystem.md#enabledevdrive) @@ -101,10 +92,9 @@ This article lists the policies that are applicable for Windows Insider Preview ## HumanPresence -- [ForceDisableWakeWhenBatterySaverOn](policy-csp-humanpresence.md#forcedisablewakewhenbatterysaveron) -- [ForceAllowWakeWhenExternalDisplayConnected](policy-csp-humanpresence.md#forceallowwakewhenexternaldisplayconnected) -- [ForceAllowLockWhenExternalDisplayConnected](policy-csp-humanpresence.md#forceallowlockwhenexternaldisplayconnected) -- [ForceAllowDimWhenExternalDisplayConnected](policy-csp-humanpresence.md#forceallowdimwhenexternaldisplayconnected) +- [ForcePrivacyScreen](policy-csp-humanpresence.md#forceprivacyscreen) +- [ForcePrivacyScreenDim](policy-csp-humanpresence.md#forceprivacyscreendim) +- [ForcePrivacyScreenNotification](policy-csp-humanpresence.md#forceprivacyscreennotification) ## InternetExplorer @@ -121,49 +111,9 @@ This article lists the policies that are applicable for Windows Insider Preview - [StartInstallation](language-pack-management-csp.md#installlanguage-idstartinstallation) - [SystemPreferredUILanguages](language-pack-management-csp.md#languagesettingssystempreferreduilanguages) -## LAPS CSP - -- [PassphraseLength](laps-csp.md#policiespassphraselength) -- [AutomaticAccountManagementEnabled](laps-csp.md#policiesautomaticaccountmanagementenabled) -- [AutomaticAccountManagementTarget](laps-csp.md#policiesautomaticaccountmanagementtarget) -- [AutomaticAccountManagementNameOrPrefix](laps-csp.md#policiesautomaticaccountmanagementnameorprefix) -- [AutomaticAccountManagementEnableAccount](laps-csp.md#policiesautomaticaccountmanagementenableaccount) -- [AutomaticAccountManagementRandomizeName](laps-csp.md#policiesautomaticaccountmanagementrandomizename) - ## LocalPoliciesSecurityOptions -- [Audit_AuditTheUseOfBackupAndRestoreprivilege](policy-csp-localpoliciessecurityoptions.md#audit_audittheuseofbackupandrestoreprivilege) -- [Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings](policy-csp-localpoliciessecurityoptions.md#audit_forceauditpolicysubcategorysettingstooverrideauditpolicycategorysettings) -- [Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits](policy-csp-localpoliciessecurityoptions.md#audit_shutdownsystemimmediatelyifunabletologsecurityaudits) -- [Devices_RestrictFloppyAccessToLocallyLoggedOnUserOnly](policy-csp-localpoliciessecurityoptions.md#devices_restrictfloppyaccesstolocallyloggedonuseronly) -- [DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](policy-csp-localpoliciessecurityoptions.md#domainmember_digitallyencryptorsignsecurechanneldataalways) -- [DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](policy-csp-localpoliciessecurityoptions.md#domainmember_digitallyencryptsecurechanneldatawhenpossible) -- [DomainMember_DigitallySignSecureChannelDataWhenPossible](policy-csp-localpoliciessecurityoptions.md#domainmember_digitallysignsecurechanneldatawhenpossible) -- [DomainMember_DisableMachineAccountPasswordChanges](policy-csp-localpoliciessecurityoptions.md#domainmember_disablemachineaccountpasswordchanges) -- [DomainMember_MaximumMachineAccountPasswordAge](policy-csp-localpoliciessecurityoptions.md#domainmember_maximummachineaccountpasswordage) -- [DomainMember_RequireStrongSessionKey](policy-csp-localpoliciessecurityoptions.md#domainmember_requirestrongsessionkey) -- [InteractiveLogon_MachineAccountLockoutThreshold](policy-csp-localpoliciessecurityoptions.md#interactivelogon_machineaccountlockoutthreshold) - [InteractiveLogon_NumberOfPreviousLogonsToCache](policy-csp-localpoliciessecurityoptions.md#interactivelogon_numberofpreviouslogonstocache) -- [InteractiveLogon_PromptUserToChangePasswordBeforeExpiration](policy-csp-localpoliciessecurityoptions.md#interactivelogon_promptusertochangepasswordbeforeexpiration) -- [MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](policy-csp-localpoliciessecurityoptions.md#microsoftnetworkserver_amountofidletimerequiredbeforesuspendingsession) -- [MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire](policy-csp-localpoliciessecurityoptions.md#microsoftnetworkserver_disconnectclientswhenlogonhoursexpire) -- [MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel](policy-csp-localpoliciessecurityoptions.md#microsoftnetworkserver_serverspntargetnamevalidationlevel) -- [NetworkAccess_AllowAnonymousSIDOrNameTranslation](policy-csp-localpoliciessecurityoptions.md#networkaccess_allowanonymoussidornametranslation) -- [NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication](policy-csp-localpoliciessecurityoptions.md#networkaccess_donotallowstorageofpasswordsandcredentialsfornetworkauthentication) -- [NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers](policy-csp-localpoliciessecurityoptions.md#networkaccess_leteveryonepermissionsapplytoanonymoususers) -- [NetworkAccess_NamedPipesThatCanBeAccessedAnonymously](policy-csp-localpoliciessecurityoptions.md#networkaccess_namedpipesthatcanbeaccessedanonymously) -- [NetworkAccess_RemotelyAccessibleRegistryPaths](policy-csp-localpoliciessecurityoptions.md#networkaccess_remotelyaccessibleregistrypaths) -- [NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths](policy-csp-localpoliciessecurityoptions.md#networkaccess_remotelyaccessibleregistrypathsandsubpaths) -- [NetworkAccess_SharesThatCanBeAccessedAnonymously](policy-csp-localpoliciessecurityoptions.md#networkaccess_sharesthatcanbeaccessedanonymously) -- [NetworkAccess_SharingAndSecurityModelForLocalAccounts](policy-csp-localpoliciessecurityoptions.md#networkaccess_sharingandsecuritymodelforlocalaccounts) -- [NetworkSecurity_AllowLocalSystemNULLSessionFallback](policy-csp-localpoliciessecurityoptions.md#networksecurity_allowlocalsystemnullsessionfallback) -- [NetworkSecurity_ForceLogoffWhenLogonHoursExpire](policy-csp-localpoliciessecurityoptions.md#networksecurity_forcelogoffwhenlogonhoursexpire) -- [NetworkSecurity_LDAPClientSigningRequirements](policy-csp-localpoliciessecurityoptions.md#networksecurity_ldapclientsigningrequirements) -- [RecoveryConsole_AllowAutomaticAdministrativeLogon](policy-csp-localpoliciessecurityoptions.md#recoveryconsole_allowautomaticadministrativelogon) -- [RecoveryConsole_AllowFloppyCopyAndAccessToAllDrivesAndAllFolders](policy-csp-localpoliciessecurityoptions.md#recoveryconsole_allowfloppycopyandaccesstoalldrivesandallfolders) -- [SystemCryptography_ForceStrongKeyProtection](policy-csp-localpoliciessecurityoptions.md#systemcryptography_forcestrongkeyprotection) -- [SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems](policy-csp-localpoliciessecurityoptions.md#systemobjects_requirecaseinsensitivityfornonwindowssubsystems) -- [SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects](policy-csp-localpoliciessecurityoptions.md#systemobjects_strengthendefaultpermissionsofinternalsystemobjects) - [UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection](policy-csp-localpoliciessecurityoptions.md#useraccountcontrol_behavioroftheelevationpromptforadministratorprotection) - [UserAccountControl_TypeOfAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#useraccountcontrol_typeofadminapprovalmode) @@ -174,105 +124,43 @@ This article lists the policies that are applicable for Windows Insider Preview - [ConfigureDeviceStandbyAction](policy-csp-mixedreality.md#configuredevicestandbyaction) - [ConfigureDeviceStandbyActionTimeout](policy-csp-mixedreality.md#configuredevicestandbyactiontimeout) -## MSSecurityGuide +## NewsAndInterests -- [NetBTNodeTypeConfiguration](policy-csp-mssecurityguide.md#netbtnodetypeconfiguration) - -## NetworkListManager - -- [AllNetworks_NetworkIcon](policy-csp-networklistmanager.md#allnetworks_networkicon) -- [AllNetworks_NetworkLocation](policy-csp-networklistmanager.md#allnetworks_networklocation) -- [AllNetworks_NetworkName](policy-csp-networklistmanager.md#allnetworks_networkname) -- [IdentifyingNetworks_LocationType](policy-csp-networklistmanager.md#identifyingnetworks_locationtype) -- [UnidentifiedNetworks_LocationType](policy-csp-networklistmanager.md#unidentifiednetworks_locationtype) -- [UnidentifiedNetworks_UserPermissions](policy-csp-networklistmanager.md#unidentifiednetworks_userpermissions) - -## Notifications - -- [DisableAccountNotifications](policy-csp-notifications.md#disableaccountnotifications) +- [DisableWidgetsOnLockScreen](policy-csp-newsandinterests.md#disablewidgetsonlockscreen) +- [DisableWidgetsBoard](policy-csp-newsandinterests.md#disablewidgetsboard) ## PassportForWork CSP -- [EnableWindowsHelloProvisioningForSecurityKeys](passportforwork-csp.md#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) - [DisablePostLogonProvisioning](passportforwork-csp.md#devicetenantidpoliciesdisablepostlogonprovisioning) -## Reboot CSP +## Printers -- [WeeklyRecurrent](reboot-csp.md#scheduleweeklyrecurrent) +- [ConfigureIppTlsCertificatePolicy](policy-csp-printers.md#configureipptlscertificatepolicy) ## RemoteDesktopServices -- [LimitServerToClientClipboardRedirection](policy-csp-remotedesktopservices.md#limitservertoclientclipboardredirection) -- [LimitClientToServerClipboardRedirection](policy-csp-remotedesktopservices.md#limitclienttoserverclipboardredirection) -- [DisconnectOnLockLegacyAuthn](policy-csp-remotedesktopservices.md#disconnectonlocklegacyauthn) -- [DisconnectOnLockMicrosoftIdentityAuthn](policy-csp-remotedesktopservices.md#disconnectonlockmicrosoftidentityauthn) - [TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME](policy-csp-remotedesktopservices.md#ts_server_remoteapp_use_shellappruntime) -## Search - -- [ConfigureSearchOnTaskbarMode](policy-csp-search.md#configuresearchontaskbarmode) - ## SettingsSync -- [DisableAccessibilitySettingSync](policy-csp-settingssync.md#disableaccessibilitysettingsync) -- [DisableLanguageSettingSync](policy-csp-settingssync.md#disablelanguagesettingsync) +- [EnableWindowsbackup](policy-csp-settingssync.md#enablewindowsbackup) -## Sudo +## Start -- [EnableSudo](policy-csp-sudo.md#enablesudo) +- [AlwaysShowNotificationIcon](policy-csp-start.md#alwaysshownotificationicon) +- [TurnOffAbbreviatedDateTimeFormat](policy-csp-start.md#turnoffabbreviateddatetimeformat) ## SurfaceHub CSP - [ExchangeModernAuthEnabled](surfacehub-csp.md#deviceaccountexchangemodernauthenabled) -## System +## TextInput -- [HideUnsupportedHardwareNotifications](policy-csp-system.md#hideunsupportedhardwarenotifications) - -## SystemServices - -- [ConfigureComputerBrowserServiceStartupMode](policy-csp-systemservices.md#configurecomputerbrowserservicestartupmode) -- [ConfigureIISAdminServiceStartupMode](policy-csp-systemservices.md#configureiisadminservicestartupmode) -- [ConfigureInfraredMonitorServiceStartupMode](policy-csp-systemservices.md#configureinfraredmonitorservicestartupmode) -- [ConfigureInternetConnectionSharingServiceStartupMode](policy-csp-systemservices.md#configureinternetconnectionsharingservicestartupmode) -- [ConfigureLxssManagerServiceStartupMode](policy-csp-systemservices.md#configurelxssmanagerservicestartupmode) -- [ConfigureMicrosoftFTPServiceStartupMode](policy-csp-systemservices.md#configuremicrosoftftpservicestartupmode) -- [ConfigureRemoteProcedureCallLocatorServiceStartupMode](policy-csp-systemservices.md#configureremoteprocedurecalllocatorservicestartupmode) -- [ConfigureRoutingAndRemoteAccessServiceStartupMode](policy-csp-systemservices.md#configureroutingandremoteaccessservicestartupmode) -- [ConfigureSimpleTCPIPServicesStartupMode](policy-csp-systemservices.md#configuresimpletcpipservicesstartupmode) -- [ConfigureSpecialAdministrationConsoleHelperServiceStartupMode](policy-csp-systemservices.md#configurespecialadministrationconsolehelperservicestartupmode) -- [ConfigureSSDPDiscoveryServiceStartupMode](policy-csp-systemservices.md#configuressdpdiscoveryservicestartupmode) -- [ConfigureUPnPDeviceHostServiceStartupMode](policy-csp-systemservices.md#configureupnpdevicehostservicestartupmode) -- [ConfigureWebManagementServiceStartupMode](policy-csp-systemservices.md#configurewebmanagementservicestartupmode) -- [ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode](policy-csp-systemservices.md#configurewindowsmediaplayernetworksharingservicestartupmode) -- [ConfigureWindowsMobileHotspotServiceStartupMode](policy-csp-systemservices.md#configurewindowsmobilehotspotservicestartupmode) -- [ConfigureWorldWideWebPublishingServiceStartupMode](policy-csp-systemservices.md#configureworldwidewebpublishingservicestartupmode) +- [TouchKeyboardControllerModeAvailability](policy-csp-textinput.md#touchkeyboardcontrollermodeavailability) ## Update - [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol) -- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#configuredeadlinenoautorebootforfeatureupdates) -- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#configuredeadlinenoautorebootforqualityupdates) -- [AlwaysAutoRebootAtScheduledTimeMinutes](policy-csp-update.md#alwaysautorebootatscheduledtimeminutes) - -## UserRights - -- [BypassTraverseChecking](policy-csp-userrights.md#bypasstraversechecking) -- [ReplaceProcessLevelToken](policy-csp-userrights.md#replaceprocessleveltoken) -- [ChangeTimeZone](policy-csp-userrights.md#changetimezone) -- [ShutDownTheSystem](policy-csp-userrights.md#shutdownthesystem) -- [LogOnAsBatchJob](policy-csp-userrights.md#logonasbatchjob) -- [ProfileSystemPerformance](policy-csp-userrights.md#profilesystemperformance) -- [DenyLogOnAsBatchJob](policy-csp-userrights.md#denylogonasbatchjob) -- [LogOnAsService](policy-csp-userrights.md#logonasservice) -- [IncreaseProcessWorkingSet](policy-csp-userrights.md#increaseprocessworkingset) -- [DenyLogOnAsService](policy-csp-userrights.md#denylogonasservice) -- [AdjustMemoryQuotasForProcess](policy-csp-userrights.md#adjustmemoryquotasforprocess) -- [AllowLogOnThroughRemoteDesktop](policy-csp-userrights.md#allowlogonthroughremotedesktop) - -## WebThreatDefense - -- [AutomaticDataCollection](policy-csp-webthreatdefense.md#automaticdatacollection) ## Wifi @@ -281,9 +169,14 @@ This article lists the policies that are applicable for Windows Insider Preview ## WindowsAI -- [DisableAIDataAnalysis](policy-csp-windowsai.md#disableaidataanalysis) +- [SetDenyAppListForRecall](policy-csp-windowsai.md#setdenyapplistforrecall) +- [SetDenyUriListForRecall](policy-csp-windowsai.md#setdenyurilistforrecall) +- [SetMaximumStorageSpaceForRecallSnapshots](policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots) +- [SetMaximumStorageDurationForRecallSnapshots](policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots) - [DisableImageCreator](policy-csp-windowsai.md#disableimagecreator) - [DisableCocreator](policy-csp-windowsai.md#disablecocreator) +- [DisableGenerativeFill](policy-csp-windowsai.md#disablegenerativefill) +- [AllowRecallEnablement](policy-csp-windowsai.md#allowrecallenablement) ## WindowsLicensing CSP @@ -294,11 +187,6 @@ This article lists the policies that are applicable for Windows Insider Preview - [DisableSubscription](windowslicensing-csp.md#subscriptionsdisablesubscription) - [RemoveSubscription](windowslicensing-csp.md#subscriptionsremovesubscription) -## WindowsSandbox - -- [AllowMappedFolders](policy-csp-windowssandbox.md#allowmappedfolders) -- [AllowWriteToMappedFolders](policy-csp-windowssandbox.md#allowwritetomappedfolders) - ## Related articles [Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 0fa200d984..dcd77fb5aa 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,7 +1,8 @@ --- title: Policy CSP description: Learn more about the Policy CSP. -ms.date: 08/07/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1152,6 +1153,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f - [Settings](policy-csp-settings.md) - [SettingsSync](policy-csp-settingssync.md) - [SmartScreen](policy-csp-smartscreen.md) +- [SpeakForMe](policy-csp-speakforme.md) - [Speech](policy-csp-speech.md) - [Start](policy-csp-start.md) - [Stickers](policy-csp-stickers.md) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 05e84c1ade..85f21fa615 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,7 +1,8 @@ --- title: AboveLock Policy CSP description: Learn more about the AboveLock Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 472fa8e6dc..76022ccc57 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,7 +1,8 @@ --- title: Accounts Policy CSP description: Learn more about the Accounts Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 7fe5d7be45..e5822bdb83 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,7 +1,8 @@ --- title: ActiveXControls Policy CSP description: Learn more about the ActiveXControls Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index 23c46228c0..9fe709cf14 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -1,7 +1,8 @@ --- title: ADMX_ActiveXInstallService Policy CSP description: Learn more about the ADMX_ActiveXInstallService Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 5aa088da13..e652181356 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -1,7 +1,8 @@ --- title: ADMX_AddRemovePrograms Policy CSP description: Learn more about the ADMX_AddRemovePrograms Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-admpwd.md b/windows/client-management/mdm/policy-csp-admx-admpwd.md index 4522a908ac..a180c7b671 100644 --- a/windows/client-management/mdm/policy-csp-admx-admpwd.md +++ b/windows/client-management/mdm/policy-csp-admx-admpwd.md @@ -1,7 +1,8 @@ --- title: ADMX_AdmPwd Policy CSP description: Learn more about the ADMX_AdmPwd Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index af4c3a1089..eeea7fe122 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -1,7 +1,8 @@ --- title: ADMX_AppCompat Policy CSP description: Learn more about the ADMX_AppCompat Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index 0cdd78d66b..dd10e18ae3 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -1,7 +1,8 @@ --- title: ADMX_AppxPackageManager Policy CSP description: Learn more about the ADMX_AppxPackageManager Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -32,7 +33,7 @@ ms.date: 08/06/2024 -This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. Special profiles are the following user profiles, where changes are discarded after the user signs off: +This policy setting allows you to manage the deployment of packaged Microsoft Store apps when the user is signed in using a special profile. Special profiles are the following user profiles, where changes are discarded after the user signs off: Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies. @@ -42,9 +43,9 @@ Temporary user profiles, which are created when an error prevents the correct pr User profiles for the Guest account and members of the Guests group. -- If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile. +- If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of packaged Microsoft Store apps when using a special profile. -- If you disable or don't configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile. +- If you disable or don't configure this policy setting, Group Policy blocks deployment operations of packaged Microsoft Store apps when using a special profile. diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index 540235107e..4dc7bea270 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -1,7 +1,8 @@ --- title: ADMX_AppXRuntime Policy CSP description: Learn more about the ADMX_AppXRuntime Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -32,11 +33,11 @@ ms.date: 08/06/2024 -This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer. +This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all packaged Microsoft Store apps that use the enterpriseAuthentication capability on a computer. -- If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use. +- If you enable this policy setting, you can define additional Content URI Rules that all packaged Microsoft Store apps that use the enterpriseAuthentication capability on a computer can use. -- If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules. +- If you disable or don't set this policy setting, packaged Microsoft Store apps will only use the static Content URI Rules. @@ -60,7 +61,7 @@ This policy setting lets you turn on Content URI Rules to supplement the static | Name | Value | |:--|:--| | Name | AppxRuntimeApplicationContentUriRules | -| Friendly Name | Turn on dynamic Content URI Rules for Windows store apps | +| Friendly Name | Turn on dynamic Content URI Rules for packaged Microsoft Store apps | | Location | Computer Configuration | | Path | Windows Components > App runtime | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Packages\Applications | @@ -95,11 +96,11 @@ This policy setting lets you turn on Content URI Rules to supplement the static -This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type. +This policy setting lets you control whether packaged Microsoft Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than packaged Microsoft Store apps, there is a risk that a packaged Microsoft Store app might compromise the system by opening a file in the default desktop app for a file type. -- If you enable this policy setting, Windows Store apps can't open files in the default desktop app for a file type; they can open files only in other Windows Store apps. +- If you enable this policy setting, packaged Microsoft Store apps can't open files in the default desktop app for a file type; they can open files only in other packaged Microsoft Store apps. -- If you disable or don't configure this policy setting, Windows Store apps can open files in the default desktop app for a file type. +- If you disable or don't configure this policy setting, packaged Microsoft Store apps can open files in the default desktop app for a file type. @@ -219,14 +220,14 @@ This policy shouldn't be enabled unless recommended by Microsoft as a security r -This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app. +This policy setting lets you control whether packaged Microsoft Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than packaged Microsoft Store apps, there is a risk that a URI scheme launched by a packaged Microsoft Store app might compromise the system by launching a desktop app. -- If you enable this policy setting, Windows Store apps can't open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps. +- If you enable this policy setting, packaged Microsoft Store apps can't open URIs in the default desktop app for a URI scheme; they can open URIs only in other packaged Microsoft Store apps. -- If you disable or don't configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme. +- If you disable or don't configure this policy setting, packaged Microsoft Store apps can open URIs in the default desktop app for a URI scheme. > [!NOTE] -> Enabling this policy setting doesn't block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk. +> Enabling this policy setting doesn't block packaged Microsoft Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk. diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index 03730b7ad4..654b4071c2 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -1,7 +1,8 @@ --- title: ADMX_AttachmentManager Policy CSP description: Learn more about the ADMX_AttachmentManager Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 3758b90ad9..a9d1568c27 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -1,7 +1,8 @@ --- title: ADMX_AuditSettings Policy CSP description: Learn more about the ADMX_AuditSettings Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index 00b4cf5513..73bc2cb4d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -1,7 +1,8 @@ --- title: ADMX_Bits Policy CSP description: Learn more about the ADMX_Bits Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -348,7 +349,7 @@ This policy setting limits the network bandwidth that Background Intelligent Tra - If you enable this policy setting, you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period. -You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A. M. to 10:00 A. M. on a maintenance schedule. +You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule. - If you disable or don't configure this policy setting, the limits defined for work or nonwork schedules will be used. @@ -412,7 +413,7 @@ This policy setting limits the network bandwidth that Background Intelligent Tra - If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and nonwork hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low. -You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A. M. to 5:00 P. M. on Monday through Friday, and then set the limit to 512 Kbps for nonwork hours. +You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for nonwork hours. - If you disable or don't configure this policy setting, BITS uses all available unused bandwidth for background job transfers. diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 54835ffbf0..c5ac251bbb 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -1,7 +1,8 @@ --- title: ADMX_CipherSuiteOrder Policy CSP description: Learn more about the ADMX_CipherSuiteOrder Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index 308d376d86..d0d10f976e 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -1,7 +1,8 @@ --- title: ADMX_COM Policy CSP description: Learn more about the ADMX_COM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index b819fe73bf..ff11797b8f 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -1,7 +1,8 @@ --- title: ADMX_ControlPanel Policy CSP description: Learn more about the ADMX_ControlPanel Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -36,7 +37,7 @@ This setting allows you to display or hide specified Control Panel items, such a If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. -To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft. Mouse, Microsoft. System, or Microsoft. Personalization. +To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter `Microsoft.Mouse`, `Microsoft.System`, or `Microsoft.Personalization`. > [!NOTE] > For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name should be entered, for example timedate.cpl or inetcpl.cpl. If a Control Panel item doesn't have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered, for example @systemcpl.dll,-1 for System, or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names can be found in MSDN by searching "Control Panel items". @@ -243,7 +244,7 @@ If users try to select a Control Panel item from the Properties item on a contex This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. -To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft. Mouse, Microsoft. System, or Microsoft. Personalization. +To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter `Microsoft.Mouse`, `Microsoft.System`, or `Microsoft.Personalization`. > [!NOTE] > For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name, for example timedate.cpl or inetcpl.cpl, should be entered. If a Control Panel item doesn't have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered. For example, enter @systemcpl.dll,-1 for System or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names of Control Panel items can be found in MSDN by searching "Control Panel items". diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index af2f85b62d..f52bcf1b61 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -1,7 +1,8 @@ --- title: ADMX_ControlPanelDisplay Policy CSP description: Learn more about the ADMX_ControlPanelDisplay Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -519,7 +520,7 @@ Prevents users from changing the background image shown when the machine is lock By default, users can change the background image shown when the machine is locked or displaying the logon screen. -If you enable this setting, the user won't be able to change their lock screen and logon image, and they will instead see the default image. +If you enable this setting, the user won't be able to change their lock screen and logon image, and they'll instead see the default image. @@ -1351,7 +1352,7 @@ Specifies which theme file is applied to the computer the first time a user logs |:--|:--| | Name | CPL_Personalization_SetTheme | | Friendly Name | Load a specific theme | -| Location | User Configuration | +| Location | Computer and User Configuration | | Path | Control Panel > Personalization | | Registry Key Name | Software\Policies\Microsoft\Windows\Personalization | | ADMX File Name | ControlPanelDisplay.admx | diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 8ff5777e97..184afe4fb7 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -1,7 +1,8 @@ --- title: ADMX_Cpls Policy CSP description: Learn more about the ADMX_Cpls Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 66487275ce..30546fe858 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -1,7 +1,8 @@ --- title: ADMX_CredentialProviders Policy CSP description: Learn more about the ADMX_CredentialProviders Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 3384029777..96885646be 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -1,7 +1,8 @@ --- title: ADMX_CredSsp Policy CSP description: Learn more about the ADMX_CredSsp Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index 1d6008f006..d0efc5270c 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -1,7 +1,8 @@ --- title: ADMX_CredUI Policy CSP description: Learn more about the ADMX_CredUI Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index af5b17a0de..024f2b8973 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -1,7 +1,8 @@ --- title: ADMX_CtrlAltDel Policy CSP description: Learn more about the ADMX_CtrlAltDel Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index da6c059f32..093fcaea64 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -1,7 +1,8 @@ --- title: ADMX_DataCollection Policy CSP description: Learn more about the ADMX_DataCollection Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-dcom.md b/windows/client-management/mdm/policy-csp-admx-dcom.md index 82338c786f..c36eaf9f96 100644 --- a/windows/client-management/mdm/policy-csp-admx-dcom.md +++ b/windows/client-management/mdm/policy-csp-admx-dcom.md @@ -1,7 +1,8 @@ --- title: ADMX_DCOM Policy CSP description: Learn more about the ADMX_DCOM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 463d46efd4..47f5d14233 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -1,7 +1,8 @@ --- title: ADMX_Desktop Policy CSP description: Learn more about the ADMX_Desktop Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-devicecompat.md b/windows/client-management/mdm/policy-csp-admx-devicecompat.md index ee02c1fdb1..0b0dd73b2e 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicecompat.md +++ b/windows/client-management/mdm/policy-csp-admx-devicecompat.md @@ -1,7 +1,8 @@ --- title: ADMX_DeviceCompat Policy CSP description: Learn more about the ADMX_DeviceCompat Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-deviceguard.md b/windows/client-management/mdm/policy-csp-admx-deviceguard.md index 9ea0e21a78..0e5aef2c55 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceguard.md @@ -1,7 +1,8 @@ --- title: ADMX_DeviceGuard Policy CSP description: Learn more about the ADMX_DeviceGuard Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -34,7 +35,7 @@ ms.date: 08/06/2024 -Deploy Windows Defender Application Control. +Deploy App Control for Business. This policy setting lets you deploy a Code Integrity Policy to a machine to control what's allowed to run on that machine. @@ -69,7 +70,7 @@ If using a signed and protected policy then disabling this policy setting doesn' | Name | Value | |:--|:--| | Name | ConfigCIPolicy | -| Friendly Name | Deploy Windows Defender Application Control | +| Friendly Name | Deploy App Control for Business | | Location | Computer Configuration | | Path | System > Device Guard | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard | diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index 04bbcda528..ec022eae1a 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -1,7 +1,8 @@ --- title: ADMX_DeviceInstallation Policy CSP description: Learn more about the ADMX_DeviceInstallation Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index 67eea97170..426b54f900 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -1,7 +1,8 @@ --- title: ADMX_DeviceSetup Policy CSP description: Learn more about the ADMX_DeviceSetup Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-dfs.md b/windows/client-management/mdm/policy-csp-admx-dfs.md index 6e3f90a479..b49427af7e 100644 --- a/windows/client-management/mdm/policy-csp-admx-dfs.md +++ b/windows/client-management/mdm/policy-csp-admx-dfs.md @@ -1,7 +1,8 @@ --- title: ADMX_DFS Policy CSP description: Learn more about the ADMX_DFS Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md index 44cc32a941..7dd12c55c1 100644 --- a/windows/client-management/mdm/policy-csp-admx-digitallocker.md +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -1,7 +1,8 @@ --- title: ADMX_DigitalLocker Policy CSP description: Learn more about the ADMX_DigitalLocker Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md index fd3f6d2bcd..b37f4e7fbd 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md @@ -1,7 +1,8 @@ --- title: ADMX_DiskDiagnostic Policy CSP description: Learn more about the ADMX_DiskDiagnostic Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -32,7 +33,7 @@ ms.date: 08/06/2024 -This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S. M. A. R. T. fault. +This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. fault. - If you enable this policy setting, Windows displays custom alert text in the disk diagnostic message. The custom text may not exceed 512 characters. @@ -97,15 +98,15 @@ This policy setting only takes effect if the Disk Diagnostic scenario policy set -This policy setting determines the execution level for S. M. A. R. T.-based disk diagnostics. +This policy setting determines the execution level for S.M.A.R.T.-based disk diagnostics. -Self-Monitoring And Reporting Technology (S. M. A. R. T). is a standard mechanism for storage devices to report faults to Windows. A disk that reports a S. M. A. R. T. fault may need to be repaired or replaced. The Diagnostic Policy Service (DPS) detects and logs S. M. A. R. T. faults to the event log when they occur. +Self-Monitoring And Reporting Technology (S.M.A.R.T). is a standard mechanism for storage devices to report faults to Windows. A disk that reports a S.M.A.R.T. fault may need to be repaired or replaced. The Diagnostic Policy Service (DPS) detects and logs S.M.A.R.T. faults to the event log when they occur. -- If you enable this policy setting, the DPS also warns users of S. M. A. R. T. faults and guides them through backup and recovery to minimize potential data loss. +- If you enable this policy setting, the DPS also warns users of S.M.A.R.T. faults and guides them through backup and recovery to minimize potential data loss. -- If you disable this policy, S. M. A. R. T. faults are still detected and logged, but no corrective action is taken. +- If you disable this policy, S.M.A.R.T. faults are still detected and logged, but no corrective action is taken. -- If you don't configure this policy setting, the DPS enables S. M. A. R. T. fault resolution by default. +- If you don't configure this policy setting, the DPS enables S.M.A.R.T. fault resolution by default. This policy setting takes effect only if the diagnostics-wide scenario execution policy isn't configured. diff --git a/windows/client-management/mdm/policy-csp-admx-disknvcache.md b/windows/client-management/mdm/policy-csp-admx-disknvcache.md index c05e1abb81..aa1b5c42c8 100644 --- a/windows/client-management/mdm/policy-csp-admx-disknvcache.md +++ b/windows/client-management/mdm/policy-csp-admx-disknvcache.md @@ -1,7 +1,8 @@ --- title: ADMX_DiskNVCache Policy CSP description: Learn more about the ADMX_DiskNVCache Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md index 9ed30a6596..4017ed9f80 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskquota.md +++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md @@ -1,7 +1,8 @@ --- title: ADMX_DiskQuota Policy CSP description: Learn more about the ADMX_DiskQuota Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md index 86db7ab46f..657c704404 100644 --- a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md +++ b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md @@ -1,7 +1,8 @@ --- title: ADMX_DistributedLinkTracking Policy CSP description: Learn more about the ADMX_DistributedLinkTracking Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md index 2f447009b6..2fcb54aa93 100644 --- a/windows/client-management/mdm/policy-csp-admx-dnsclient.md +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -1,7 +1,8 @@ --- title: ADMX_DnsClient Policy CSP description: Learn more about the ADMX_DnsClient Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -91,7 +92,7 @@ Specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualifie -Specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. +Specifies that the DNS client may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com" is an example of a fully qualified name because it contains a terminating dot. @@ -103,7 +104,7 @@ If attaching suffixes is allowed, and a DNS client with a primary domain suffix - If you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails. -- If you don't configure this policy setting, computers will use their local DNS client settings to determine the query behavior for unqualified multi-label names. +- If you don't configure this policy setting, the DNS client will use its local settings to determine the query behavior for unqualified multi-label names. @@ -162,9 +163,9 @@ Specifies a connection-specific DNS suffix. This policy setting supersedes local To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. -- If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting. +- If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by the DNS client. -- If you disable this policy setting, or if you don't configure this policy setting, computers will use the local or DHCP supplied connection specific DNS suffix, if configured. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client will use the local or DHCP supplied connection specific DNS suffix, if configured. @@ -234,7 +235,7 @@ Each connection-specific DNS suffix, assigned either through DHCP or specified i For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. -If a DNS suffix search list isn't specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. +If a DNS suffix search list isn't specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the DNS client (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it's under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it's under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix can't be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two. @@ -295,11 +296,11 @@ For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the -Specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured. +Specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the DNS client is on non-domain networks with no WINS servers configured. - If this policy setting is enabled, IDNs aren't converted to Punycode. -- If this policy setting is disabled, or if this policy setting isn't configured, IDNs are converted to Punycode when the computer is on non-domain networks with no WINS servers configured. +- If this policy setting is disabled, or if this policy setting isn't configured, IDNs are converted to Punycode when the DNS client is on non-domain networks with no WINS servers configured. @@ -413,13 +414,13 @@ Specifies whether the DNS client should convert internationalized domain names ( -Defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. +Defines the DNS servers to which the DNS client sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address. -- If you enable this policy setting, the list of DNS servers is applied to all network connections used by computers that receive this policy setting. +- If you enable this policy setting, the list of DNS servers is applied to all network connections used by the DNS client. -- If you disable this policy setting, or if you don't configure this policy setting, computers will use the local or DHCP supplied list of DNS servers, if configured. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client will use the local or DHCP supplied list of DNS servers, if configured. @@ -535,18 +536,18 @@ Specifies that responses from link local name resolution protocols received over -Specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution. +Specifies the primary DNS suffix used by the DNS client in DNS name registration and DNS name resolution. To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com. > [!IMPORTANT] -> In order for changes to this policy setting to be applied on computers that receive it, you must restart Windows. +> In order for changes to this policy setting to be applied on the DNS client, you must restart Windows. - If you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel. You can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix. -- If you disable this policy setting, or if you don't configure this policy setting, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it's joined. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client uses the local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it's joined. @@ -600,18 +601,18 @@ You can use this policy setting to prevent users, including local administrators -Specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. +Specifies if the DNS client performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. -By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com. +By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: `mycomputer.microsoft.com`. -- If you enable this policy setting, a computer will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by computers that receive this policy setting. +- If you enable this policy setting, the DNS client will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by the DNS client. -For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, a computer will register A and PTR resource records for mycomputer. VPNconnection and mycomputer.microsoft.com when this policy setting is enabled. +For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, the DNS client will register A and PTR resource records for `mycomputer.VPNconnection` and `mycomputer.microsoft.com` when this policy setting is enabled. > [!IMPORTANT] -> This policy setting is ignored on a DNS client computer if dynamic DNS registration is disabled. +> This policy setting is ignored by the DNS client if dynamic DNS registration is disabled. -- If you disable this policy setting, or if you don't configure this policy setting, a DNS client computer won't register any A and PTR resource records using a connection-specific DNS suffix. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client won't register any A and PTR resource records using a connection-specific DNS suffix. @@ -666,7 +667,7 @@ For example, with a computer name of mycomputer, a primary DNS suffix of microso -Specifies if DNS client computers will register PTR resource records. +Specifies if the DNS client will register PTR resource records. By default, DNS clients configured to perform dynamic DNS registration will attempt to register PTR resource record only if they successfully registered the corresponding A resource record. @@ -674,13 +675,13 @@ By default, DNS clients configured to perform dynamic DNS registration will atte To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: -Don't register: Computers won't attempt to register PTR resource records. +Don't register: the DNS client won't attempt to register PTR resource records. -Register: Computers will attempt to register PTR resource records even if registration of the corresponding A records wasn't successful. +Register: the DNS client will attempt to register PTR resource records even if registration of the corresponding A records wasn't successful. -Register only if A record registration succeeds: Computers will attempt to register PTR resource records only if registration of the corresponding A records was successful. +Register only if A record registration succeeds: the DNS client will attempt to register PTR resource records only if registration of the corresponding A records was successful. -- If you disable this policy setting, or if you don't configure this policy setting, computers will use locally configured settings. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client will use locally configured settings. @@ -734,11 +735,11 @@ Register only if A record registration succeeds: Computers will attempt to regis -Specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server. +Specifies if DNS dynamic update is enabled. DNS clients configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server. -- If you enable this policy setting, or you don't configure this policy setting, computers will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting mustn't be disabled. +- If you enable this policy setting, or you don't configure this policy setting, the DNS client will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting mustn't be disabled. -- If you disable this policy setting, computers may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections. +- If you disable this policy setting, the DNS client may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections. @@ -795,7 +796,7 @@ Specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic Specifies whether dynamic updates should overwrite existing resource records that contain conflicting IP addresses. -This policy setting is designed for computers that register address (A) resource records in DNS zones that don't use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and doesn't allow a DNS client to overwrite records that are registered by other computers. +This policy setting is designed for DNS clients that register address (A) resource records in DNS zones that don't use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and doesn't allow a DNS client to overwrite records that are registered by other DNS clients. During dynamic update of resource records in a zone that doesn't use Secure Dynamic Updates, an A resource record might exist that associates the client's host name with an IP address different than the one currently in use by the client. By default, the DNS client attempts to replace the existing A resource record with an A resource record that has the client's current IP address. @@ -856,18 +857,18 @@ During dynamic update of resource records in a zone that doesn't use Secure Dyna -Specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies to computers performing dynamic DNS updates. +Specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies DNS clients performing dynamic DNS updates. -Computers configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record hasn't changed. This reregistration is required to indicate to DNS servers that records are current and shouldn't be automatically removed (scavenged) when a DNS server is configured to delete stale records. +DNS clients configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record hasn't changed. This reregistration is required to indicate to DNS servers that records are current and shouldn't be automatically removed (scavenged) when a DNS server is configured to delete stale records. > [!WARNING] > If record scavenging is enabled on the zone, the value of this policy setting should never be longer than the value of the DNS zone refresh interval. Configuring the registration refresh interval to be longer than the refresh interval of the DNS zone might result in the undesired deletion of A and PTR resource records. To specify the registration refresh interval, click Enabled and then enter a value of 1800 or greater. The value that you specify is the number of seconds to use for the registration refresh interval. For example, 1800 seconds is 30 minutes. -- If you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by computers that receive this policy setting. +- If you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by DNS clients that receive this policy setting. -- If you disable this policy setting, or if you don't configure this policy setting, computers will use the local or DHCP supplied setting. By default, client computers configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client will use the local or DHCP supplied setting. By default, DNS clients configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed. @@ -921,13 +922,13 @@ To specify the registration refresh interval, click Enabled and then enter a val -Specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by computers to which this policy setting is applied. +Specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by the DNS client to which this policy setting is applied. To specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes). -- If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by computers that receive this policy setting. +- If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by the DNS client. -- If you disable this policy setting, or if you don't configure this policy setting, computers will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes). +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes). @@ -985,7 +986,7 @@ Specifies the DNS suffixes to attach to an unqualified single-label name before An unqualified single-label name contains no dots. The name "example" is a single-label name. This is different from a fully qualified domain name such as "example.microsoft.com". -Client computers that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name "example" will be modified to "example.microsoft.com" before sending the query to a DNS server if this policy setting is enabled with a suffix of "microsoft.com". +DNS clients that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name "example" will be modified to "example.microsoft.com" before sending the query to a DNS server if this policy setting is enabled with a suffix of "microsoft.com". To use this policy setting, click Enabled, and then enter a string value representing the DNS suffixes that should be appended to single-label names. You must specify at least one suffix. Use a comma-delimited string, such as "microsoft.com,serverua.microsoft.com,office.microsoft.com" to specify multiple suffixes. @@ -1170,15 +1171,15 @@ Specifies the security level for dynamic DNS updates. To use this policy setting, click Enabled and then select one of the following values: -Unsecure followed by secure - computers send secure dynamic updates only when nonsecure dynamic updates are refused. +Unsecure followed by secure - the DNS client sends secure dynamic updates only when nonsecure dynamic updates are refused. -Only unsecure - computers send only nonsecure dynamic updates. +Only unsecure - the DNS client sends only nonsecure dynamic updates. -Only secure - computers send only secure dynamic updates. +Only secure - The DNS client sends only secure dynamic updates. -- If you enable this policy setting, computers that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting. +- If you enable this policy setting, DNS clients that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting. -- If you disable this policy setting, or if you don't configure this policy setting, computers will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update. +- If you disable this policy setting, or if you don't configure this policy setting, DNS clients will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update. @@ -1232,13 +1233,13 @@ Only secure - computers send only secure dynamic updates. -Specifies if computers may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: "com". +Specifies if the DNS client may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: "com". By default, a DNS client that's configured to perform dynamic DNS update will update the DNS zone that's authoritative for its DNS resource records unless the authoritative zone is a top-level domain or root zone. -- If you enable this policy setting, computers send dynamic updates to any zone that's authoritative for the resource records that the computer needs to update, except the root zone. +- If you enable this policy setting, the DNS client sends dynamic updates to any zone that's authoritative for the resource records that the DNS client needs to update, except the root zone. -- If you disable this policy setting, or if you don't configure this policy setting, computers don't send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the computer needs to update. +- If you disable this policy setting, or if you don't configure this policy setting, the DNS client doesn't send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the DNS client needs to update. @@ -1309,7 +1310,7 @@ Each connection-specific DNS suffix, assigned either through DHCP or specified i For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. -If a DNS suffix search list isn't specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. +If a DNS suffix search list isn't specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the DNS client (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it's under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it's under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix can't be devolved beyond a devolution level of two. The devolution level can be configured using the primary DNS suffix devolution level policy setting. The default devolution level is two. @@ -1370,11 +1371,11 @@ For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the -Specifies that link local multicast name resolution (LLMNR) is disabled on client computers. +Specifies that link local multicast name resolution (LLMNR) is disabled on the DNS client. -LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR doesn't require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution isn't possible. +LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a DNS client to another DNS client on the same subnet that also has LLMNR enabled. LLMNR doesn't require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution isn't possible. -- If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer. +- If you enable this policy setting, LLMNR will be disabled on all available network adapters on the DNS client. - If you disable this policy setting, or you don't configure this policy setting, LLMNR will be enabled on all available network adapters. diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md index 1cfe66691d..abf3f0c411 100644 --- a/windows/client-management/mdm/policy-csp-admx-dwm.md +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -1,7 +1,8 @@ --- title: ADMX_DWM Policy CSP description: Learn more about the ADMX_DWM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index 8c7874f974..42f7ad4fe5 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -1,7 +1,8 @@ --- title: ADMX_EAIME Policy CSP description: Learn more about the ADMX_EAIME Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md index 4ff4c47c53..5260ac88e1 100644 --- a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -1,7 +1,8 @@ --- title: ADMX_EncryptFilesonMove Policy CSP description: Learn more about the ADMX_EncryptFilesonMove Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md index f9c29b883f..2c8d9514f5 100644 --- a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -1,7 +1,8 @@ --- title: ADMX_EnhancedStorage Policy CSP description: Learn more about the ADMX_EnhancedStorage Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 7c0a9b383c..7f1e33d55e 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -1,7 +1,8 @@ --- title: ADMX_ErrorReporting Policy CSP description: Learn more about the ADMX_ErrorReporting Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md index 13353ee9ca..74214050d6 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -1,7 +1,8 @@ --- title: ADMX_EventForwarding Policy CSP description: Learn more about the ADMX_EventForwarding Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index 016c98016e..edb3cbcd0f 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -1,7 +1,8 @@ --- title: ADMX_EventLog Policy CSP description: Learn more about the ADMX_EventLog Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventlogging.md b/windows/client-management/mdm/policy-csp-admx-eventlogging.md index 3c13367734..0e2affb87c 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlogging.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlogging.md @@ -1,7 +1,8 @@ --- title: ADMX_EventLogging Policy CSP description: Learn more about the ADMX_EventLogging Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventviewer.md b/windows/client-management/mdm/policy-csp-admx-eventviewer.md index 74f43583b2..809ac58355 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventviewer.md +++ b/windows/client-management/mdm/policy-csp-admx-eventviewer.md @@ -1,7 +1,8 @@ --- title: ADMX_EventViewer Policy CSP description: Learn more about the ADMX_EventViewer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index e9a61f1c6b..54b2715072 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -1,7 +1,8 @@ --- title: ADMX_Explorer Policy CSP description: Learn more about the ADMX_Explorer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -120,7 +121,7 @@ This policy setting configures File Explorer to always display the menu bar. | Name | Value | |:--|:--| | Name | AlwaysShowClassicMenu | -| Friendly Name | Display the menu bar in File Explorer | +| Friendly Name | Display the menu bar in File Explorer | | Location | User Configuration | | Path | WindowsComponents > File Explorer | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | diff --git a/windows/client-management/mdm/policy-csp-admx-externalboot.md b/windows/client-management/mdm/policy-csp-admx-externalboot.md index 5f345d1ef6..2b32f842e4 100644 --- a/windows/client-management/mdm/policy-csp-admx-externalboot.md +++ b/windows/client-management/mdm/policy-csp-admx-externalboot.md @@ -1,7 +1,8 @@ --- title: ADMX_ExternalBoot Policy CSP description: Learn more about the ADMX_ExternalBoot Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-filerecovery.md b/windows/client-management/mdm/policy-csp-admx-filerecovery.md index f2b3cb91db..84e154a8f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-filerecovery.md @@ -1,7 +1,8 @@ --- title: ADMX_FileRecovery Policy CSP description: Learn more about the ADMX_FileRecovery Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-filerevocation.md b/windows/client-management/mdm/policy-csp-admx-filerevocation.md index f62f39edaf..e17de8381a 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerevocation.md +++ b/windows/client-management/mdm/policy-csp-admx-filerevocation.md @@ -1,7 +1,8 @@ --- title: ADMX_FileRevocation Policy CSP description: Learn more about the ADMX_FileRevocation Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -36,7 +37,7 @@ Windows Runtime applications can protect content which has been associated with Example value: -Contoso.com,ContosoIT. HumanResourcesApp_m5g0r7arhahqy. +`Contoso.com,ContosoIT.HumanResourcesApp_m5g0r7arhahqy` - If you enable this policy setting, the application identified by the Package Family Name will be permitted to revoke access to all content protected using the specified EID on the device. diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md index f539b5910d..e9b8b96d7f 100644 --- a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -1,7 +1,8 @@ --- title: ADMX_FileServerVSSProvider Policy CSP description: Learn more about the ADMX_FileServerVSSProvider Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index 03c6eabd47..33379196d4 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -1,7 +1,8 @@ --- title: ADMX_FileSys Policy CSP description: Learn more about the ADMX_FileSys Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -260,7 +261,7 @@ Encrypting the page file prevents malicious users from reading data that has bee -Enabling Win32 long paths will allow manifested win32 applications and Windows Store applications to access paths beyond the normal 260 character limit. Enabling this setting will cause the long paths to be accessible within the process. +Enabling Win32 long paths will allow manifested win32 applications and packaged Microsoft Store applications to access paths beyond the normal 260 character limit. Enabling this setting will cause the long paths to be accessible within the process. @@ -317,7 +318,7 @@ Enabling Win32 long paths will allow manifested win32 applications and Windows S These settings provide control over whether or not short names are generated during file creation. Some applications require short names for compatibility, but short names have a negative performance impact on the system. -If you enable short names on all volumes then short names will always be generated. If you disable them on all volumes then they will never be generated. If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume. If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume. +If you enable short names on all volumes then short names will always be generated. If you disable them on all volumes then they'll never be generated. If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume. If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume. diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index bd04e0fa4f..72c19e4951 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -1,7 +1,8 @@ --- title: ADMX_FolderRedirection Policy CSP description: Learn more about the ADMX_FolderRedirection Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md index a6e699f57e..afba6b4512 100644 --- a/windows/client-management/mdm/policy-csp-admx-framepanes.md +++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md @@ -1,7 +1,8 @@ --- title: ADMX_FramePanes Policy CSP description: Learn more about the ADMX_FramePanes Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-fthsvc.md b/windows/client-management/mdm/policy-csp-admx-fthsvc.md index 6151b18e4e..35b554fc9a 100644 --- a/windows/client-management/mdm/policy-csp-admx-fthsvc.md +++ b/windows/client-management/mdm/policy-csp-admx-fthsvc.md @@ -1,7 +1,8 @@ --- title: ADMX_fthsvc Policy CSP description: Learn more about the ADMX_fthsvc Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md index 6dc909c654..56ed340242 100644 --- a/windows/client-management/mdm/policy-csp-admx-globalization.md +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -1,7 +1,8 @@ --- title: ADMX_Globalization Policy CSP description: Learn more about the ADMX_Globalization Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -638,7 +639,7 @@ This policy setting is related to the "Turn off handwriting personalization" pol -This policy setting restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy setting doesn't change the existing system locale; however, the next time that an administrator attempts to change the computer's system locale, they will be restricted to the specified list. +This policy setting restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy setting doesn't change the existing system locale; however, the next time that an administrator attempts to change the computer's system locale, they'll be restricted to the specified list. The locale list is specified using language names, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-US;en-CA" would restrict the system locale to English (United States) and English (Canada). @@ -1097,7 +1098,7 @@ This policy setting prevents the user from customizing their locale by changing Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy. -When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. The user can't customize their user locale with user overrides. +When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they'll be unable to customize those choices. The user can't customize their user locale with user overrides. - If this policy setting is disabled or not configured, then the user can customize their user locale overrides. @@ -1166,7 +1167,7 @@ This policy setting prevents the user from customizing their locale by changing Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy. -When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. The user can't customize their user locale with user overrides. +When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they'll be unable to customize those choices. The user can't customize their user locale with user overrides. - If this policy setting is disabled or not configured, then the user can customize their user locale overrides. diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index e28587728d..990f6f9dcb 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -1,7 +1,8 @@ --- title: ADMX_GroupPolicy Policy CSP description: Learn more about the ADMX_GroupPolicy Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index fdb73b28f4..5be7157ce1 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -1,7 +1,8 @@ --- title: ADMX_Help Policy CSP description: Learn more about the ADMX_Help Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md index 6f4a746867..e2d790f3ee 100644 --- a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -1,7 +1,8 @@ --- title: ADMX_HelpAndSupport Policy CSP description: Learn more about the ADMX_HelpAndSupport Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-hotspotauth.md b/windows/client-management/mdm/policy-csp-admx-hotspotauth.md index 25af4fd561..9d18ab87a6 100644 --- a/windows/client-management/mdm/policy-csp-admx-hotspotauth.md +++ b/windows/client-management/mdm/policy-csp-admx-hotspotauth.md @@ -1,7 +1,8 @@ --- title: ADMX_hotspotauth Policy CSP description: Learn more about the ADMX_hotspotauth Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index c1437d3c2c..d844742ecd 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -1,7 +1,8 @@ --- title: ADMX_ICM Policy CSP description: Learn more about the ADMX_ICM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-iis.md b/windows/client-management/mdm/policy-csp-admx-iis.md index 56fbe8386c..e007db0cf0 100644 --- a/windows/client-management/mdm/policy-csp-admx-iis.md +++ b/windows/client-management/mdm/policy-csp-admx-iis.md @@ -1,7 +1,8 @@ --- title: ADMX_IIS Policy CSP description: Learn more about the ADMX_IIS Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-iscsi.md b/windows/client-management/mdm/policy-csp-admx-iscsi.md index 8f386092d9..6f7a7b55be 100644 --- a/windows/client-management/mdm/policy-csp-admx-iscsi.md +++ b/windows/client-management/mdm/policy-csp-admx-iscsi.md @@ -1,7 +1,8 @@ --- title: ADMX_iSCSI Policy CSP description: Learn more about the ADMX_iSCSI Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index 17a430e267..eb6ed09af8 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -1,7 +1,8 @@ --- title: ADMX_kdc Policy CSP description: Learn more about the ADMX_kdc Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md index 44ad26e627..756376d2de 100644 --- a/windows/client-management/mdm/policy-csp-admx-kerberos.md +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -1,7 +1,8 @@ --- title: ADMX_Kerberos Policy CSP description: Learn more about the ADMX_Kerberos Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -172,6 +173,8 @@ This policy setting allows you to specify which DNS host names and which DNS suf +> [!NOTE] +> The list of DNS host names and DNS suffixes has a 2048 character limit. This policy would not apply if you exceed this limit. For more information, see [Kerberos realm to host mapping policy string-length limitations](https://support.microsoft.com/topic/e86856c2-1e02-43fe-9c58-d7c9d6386f01). diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md index 15984c691c..a8b4c178c4 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md @@ -1,7 +1,8 @@ --- title: ADMX_LanmanServer Policy CSP description: Learn more about the ADMX_LanmanServer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md index b2fcbf19da..41d3f19fae 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -1,7 +1,8 @@ --- title: ADMX_LanmanWorkstation Policy CSP description: Learn more about the ADMX_LanmanWorkstation Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md index 794a21e5a0..6b146cf631 100644 --- a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md @@ -1,7 +1,8 @@ --- title: ADMX_LeakDiagnostic Policy CSP description: Learn more about the ADMX_LeakDiagnostic Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md index 636061e02e..e204763874 100644 --- a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md +++ b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md @@ -1,7 +1,8 @@ --- title: ADMX_LinkLayerTopologyDiscovery Policy CSP description: Learn more about the ADMX_LinkLayerTopologyDiscovery Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md b/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md index 872eaf9994..a412891fdb 100644 --- a/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md +++ b/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md @@ -1,7 +1,8 @@ --- title: ADMX_LocationProviderAdm Policy CSP description: Learn more about the ADMX_LocationProviderAdm Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md index dc5b8605ca..f54d096327 100644 --- a/windows/client-management/mdm/policy-csp-admx-logon.md +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -1,7 +1,8 @@ --- title: ADMX_Logon Policy CSP description: Learn more about the ADMX_Logon Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 124f07bbb0..6d97074dc2 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -1,7 +1,8 @@ --- title: ADMX_MicrosoftDefenderAntivirus Policy CSP description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1523,11 +1524,13 @@ This policy setting defines the number of days items should be kept in the Quara -This policy setting allows you to configure the scheduled scan, and the scheduled security intelligence update, start time window in hours. +This policy setting allows you to configure the randomization of the scheduled scan start time and the scheduled definition update start time. -- If you disable or don't configure this setting, scheduled tasks will begin at a random time within 4 hours after the time specified in Task Scheduler. +- If you enable or don't configure this policy setting, and didn't set a randomization window in the Configure scheduled task time randomization window setting , then randomization will be added between 0-4 hours. -- If you enable this setting, you can widen, or narrow, this randomization period. Specify a randomization window of between 1 and 23 hours. +- If you enable or don't configure this policy setting, and set a randomization window in the Configure scheduled task time randomization window setting, the configured randomization window will be used. + +- If you disable this policy setting, but configured the scheduled task time randomization window, randomization won't be done. @@ -2936,7 +2939,7 @@ This policy setting allows you to manage whether or not end users can pause a sc -This policy setting allows you to configure the maximum directory depth level into which archive files such as . ZIP or . CAB are unpacked during scanning. The default directory depth level is 0. +This policy setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. The default directory depth level is 0. - If you enable this setting, archive files will be scanned to the directory depth level specified. @@ -2995,7 +2998,7 @@ This policy setting allows you to configure the maximum directory depth level in -This policy setting allows you to configure the maximum size of archive files such as . ZIP or . CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning. +This policy setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning. - If you enable this setting, archive files less than or equal to the size specified will be scanned. @@ -3054,7 +3057,7 @@ This policy setting allows you to configure the maximum size of archive files su -This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as . ZIP or . CAB files. +This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. - If you enable or don't configure this setting, archive files will be scanned. @@ -3528,11 +3531,11 @@ This policy setting allows you to configure scanning mapped network drives. -This policy setting allows you to configure scanning for network files. It's recommended that you don't enable this setting. +This policy setting allows the scanning of network files using on access protection. The default is enabled. Recommended to remain enabled in most cases. -- If you enable this setting, network files will be scanned. +- If you enable or don't configure this setting, network files will be scanned. -- If you disable or don't configure this setting, network files won't be scanned. +- If you disable this setting, network files won't be scanned. @@ -3556,7 +3559,7 @@ This policy setting allows you to configure scanning for network files. It's rec | Name | Value | |:--|:--| | Name | Scan_DisableScanningNetworkFiles | -| Friendly Name | Scan network files | +| Friendly Name | Configure scanning of network files | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -5436,12 +5439,7 @@ Valid remediation action values are: - -This policy setting allows you to configure whether or not to display additional text to clients when they need to perform an action. The text displayed is a custom administrator-defined string. For example, the phone number to call the company help desk. The client interface will only display a maximum of 1024 characters. Longer strings will be truncated before display. - -- If you enable this setting, the additional text specified will be displayed. - -- If you disable or don't configure this setting, there will be no additional text displayed. + @@ -5458,6 +5456,7 @@ This policy setting allows you to configure whether or not to display additional + [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -5465,10 +5464,6 @@ This policy setting allows you to configure whether or not to display additional | Name | Value | |:--|:--| | Name | UX_Configuration_CustomDefaultActionToastString | -| Friendly Name | Display additional text to clients when they need to perform an action | -| Location | Computer Configuration | -| Path | Windows Components > Microsoft Defender Antivirus > Client Interface | -| Registry Key Name | Software\Policies\Microsoft\Windows Defender\UX Configuration | | ADMX File Name | WindowsDefender.admx | diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md index 2b2fc19e76..ee0f2f64f1 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmc.md +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -1,7 +1,8 @@ --- title: ADMX_MMC Policy CSP description: Learn more about the ADMX_MMC Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index 91840fc2df..3bfee0b99c 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -1,7 +1,8 @@ --- title: ADMX_MMCSnapins Policy CSP description: Learn more about the ADMX_MMCSnapins Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md b/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md index ef789f1e59..a1e72125dd 100644 --- a/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md @@ -1,7 +1,8 @@ --- title: ADMX_MobilePCMobilityCenter Policy CSP description: Learn more about the ADMX_MobilePCMobilityCenter Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md b/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md index fd3c2b80c1..2bdad89c22 100644 --- a/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md @@ -1,7 +1,8 @@ --- title: ADMX_MobilePCPresentationSettings Policy CSP description: Learn more about the ADMX_MobilePCPresentationSettings Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index f15b1bf8f8..47fa9b04a4 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -1,7 +1,8 @@ --- title: ADMX_MSAPolicy Policy CSP description: Learn more about the ADMX_MSAPolicy Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md index 47f4f1113c..19b53cd8bd 100644 --- a/windows/client-management/mdm/policy-csp-admx-msched.md +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -1,7 +1,8 @@ --- title: ADMX_msched Policy CSP description: Learn more about the ADMX_msched Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index 4824f2f7af..77e9a412d2 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -1,7 +1,8 @@ --- title: ADMX_MSDT Policy CSP description: Learn more about the ADMX_MSDT Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 104e20e9ca..d95bea4d31 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -1,7 +1,8 @@ --- title: ADMX_MSI Policy CSP description: Learn more about the ADMX_MSI Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md b/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md index 5fd4e17f27..ddea63e18e 100644 --- a/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md @@ -1,7 +1,8 @@ --- title: ADMX_MsiFileRecovery Policy CSP description: Learn more about the ADMX_MsiFileRecovery Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md index a99b4bd0bf..f30f26a334 100644 --- a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -1,7 +1,8 @@ --- title: ADMX_MSS-legacy Policy CSP description: Learn more about the ADMX_MSS-legacy Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index 4c6b4307a3..e1aa9cee16 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -1,7 +1,8 @@ --- title: ADMX_nca Policy CSP description: Learn more about the ADMX_nca Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 05752f6756..42de79d204 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -1,7 +1,8 @@ --- title: ADMX_NCSI Policy CSP description: Learn more about the ADMX_NCSI Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index 6603256c75..7d9ab6185d 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -1,7 +1,8 @@ --- title: ADMX_Netlogon Policy CSP description: Learn more about the ADMX_Netlogon Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -420,6 +421,8 @@ Note that this policy setting doesn't affect NetBIOS-based discovery for DC loca - If you enable or don't configure this policy setting, the DC location algorithm doesn't use NetBIOS-based discovery as a fallback mechanism when DNS-based discovery fails. This is the default behavior. - If you disable this policy setting, the DC location algorithm can use NetBIOS-based discovery as a fallback mechanism when DNS based discovery fails. + +This setting has no effect unless the BlockNetbiosDiscovery setting is disabled. NetBIOS-based discovery is considered unsecure, has many limitations, and will be deprecated in a future release. For these reasons, NetBIOS-based discovery isn't recommended. See for more information. diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index d79ef60825..9861e1f408 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -1,7 +1,8 @@ --- title: ADMX_NetworkConnections Policy CSP description: Learn more about the ADMX_NetworkConnections Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index f7467145fb..ca14cf11b9 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -1,7 +1,8 @@ --- title: ADMX_OfflineFiles Policy CSP description: Learn more about the ADMX_OfflineFiles Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -352,7 +353,7 @@ This setting replaces the Default Cache Size setting used by pre-Windows Vista s Determines how computers respond when they're disconnected from particular offline file servers. This setting overrides the default response, a user-specified response, and the response specified in the "Action on server disconnect" setting. -To use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type "0" if users can work offline when they're disconnected from this server, or type "1" if they cannot. +To use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type "0" if users can work offline when they're disconnected from this server, or type "1" if they can't. This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured for a particular server, the setting in Computer Configuration takes precedence over the setting in User Configuration. Both Computer and User configuration take precedence over a user's setting. This setting doesn't prevent users from setting custom actions through the Offline Files tab. However, users are unable to change any custom actions established via this setting. @@ -413,7 +414,7 @@ This setting appears in the Computer Configuration and User Configuration folder Determines how computers respond when they're disconnected from particular offline file servers. This setting overrides the default response, a user-specified response, and the response specified in the "Action on server disconnect" setting. -To use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type "0" if users can work offline when they're disconnected from this server, or type "1" if they cannot. +To use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type "0" if users can work offline when they're disconnected from this server, or type "1" if they can't. This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured for a particular server, the setting in Computer Configuration takes precedence over the setting in User Configuration. Both Computer and User configuration take precedence over a user's setting. This setting doesn't prevent users from setting custom actions through the Offline Files tab. However, users are unable to change any custom actions established via this setting. diff --git a/windows/client-management/mdm/policy-csp-admx-pca.md b/windows/client-management/mdm/policy-csp-admx-pca.md index a2d2187900..12a079ed9c 100644 --- a/windows/client-management/mdm/policy-csp-admx-pca.md +++ b/windows/client-management/mdm/policy-csp-admx-pca.md @@ -1,7 +1,8 @@ --- title: ADMX_pca Policy CSP description: Learn more about the ADMX_pca Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index 37985a6c6e..8a5e2e1eed 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -1,7 +1,8 @@ --- title: ADMX_PeerToPeerCaching Policy CSP description: Learn more about the ADMX_PeerToPeerCaching Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-pentraining.md b/windows/client-management/mdm/policy-csp-admx-pentraining.md index 44ee096673..dc5a034d65 100644 --- a/windows/client-management/mdm/policy-csp-admx-pentraining.md +++ b/windows/client-management/mdm/policy-csp-admx-pentraining.md @@ -1,7 +1,8 @@ --- title: ADMX_PenTraining Policy CSP description: Learn more about the ADMX_PenTraining Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md index d8152d1814..ce8ed0a6be 100644 --- a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -1,7 +1,8 @@ --- title: ADMX_PerformanceDiagnostics Policy CSP description: Learn more about the ADMX_PerformanceDiagnostics Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-power.md b/windows/client-management/mdm/policy-csp-admx-power.md index 0ae111ff74..80cb0391aa 100644 --- a/windows/client-management/mdm/policy-csp-admx-power.md +++ b/windows/client-management/mdm/policy-csp-admx-power.md @@ -1,7 +1,8 @@ --- title: ADMX_Power Policy CSP description: Learn more about the ADMX_Power Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md index d16b9ad08c..80bf7ac963 100644 --- a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -1,7 +1,8 @@ --- title: ADMX_PowerShellExecutionPolicy Policy CSP description: Learn more about the ADMX_PowerShellExecutionPolicy Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-previousversions.md b/windows/client-management/mdm/policy-csp-admx-previousversions.md index 48f1d71724..258e872a33 100644 --- a/windows/client-management/mdm/policy-csp-admx-previousversions.md +++ b/windows/client-management/mdm/policy-csp-admx-previousversions.md @@ -1,7 +1,8 @@ --- title: ADMX_PreviousVersions Policy CSP description: Learn more about the ADMX_PreviousVersions Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index d610c2f9e8..2c6b23768b 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -1,7 +1,8 @@ --- title: ADMX_Printing Policy CSP description: Learn more about the ADMX_Printing Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -749,7 +750,7 @@ This preference allows you to change default printer management. -Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default in Windows 10, Windows 10 and Windows Server 2022. +Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default in Windows 10, Windows 10 and Windows Server 2025. - If you enable this group policy setting, the default MXDW output format is the legacy Microsoft XPS (*.xps). diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index c71f46d09d..dd8543a643 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -1,7 +1,8 @@ --- title: ADMX_Printing2 Policy CSP description: Learn more about the ADMX_Printing2 Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index 1c448b67f8..928117fb7b 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -1,7 +1,8 @@ --- title: ADMX_Programs Policy CSP description: Learn more about the ADMX_Programs Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md index 805395134d..21a5f026d6 100644 --- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md +++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md @@ -1,7 +1,8 @@ --- title: ADMX_PushToInstall Policy CSP description: Learn more about the ADMX_PushToInstall Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md index 00a0b30f09..121df9124f 100644 --- a/windows/client-management/mdm/policy-csp-admx-qos.md +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -1,7 +1,8 @@ --- title: ADMX_QOS Policy CSP description: Learn more about the ADMX_QOS Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-radar.md b/windows/client-management/mdm/policy-csp-admx-radar.md index ffcba6e38e..9196f8c101 100644 --- a/windows/client-management/mdm/policy-csp-admx-radar.md +++ b/windows/client-management/mdm/policy-csp-admx-radar.md @@ -1,7 +1,8 @@ --- title: ADMX_Radar Policy CSP description: Learn more about the ADMX_Radar Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md index c5ac96a8e4..bc92e44fae 100644 --- a/windows/client-management/mdm/policy-csp-admx-reliability.md +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -1,7 +1,8 @@ --- title: ADMX_Reliability Policy CSP description: Learn more about the ADMX_Reliability Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md index fa9cd31f9c..39a5c54ac1 100644 --- a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -1,7 +1,8 @@ --- title: ADMX_RemoteAssistance Policy CSP description: Learn more about the ADMX_RemoteAssistance Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md index 6010e92b08..6af1242454 100644 --- a/windows/client-management/mdm/policy-csp-admx-removablestorage.md +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -1,7 +1,8 @@ --- title: ADMX_RemovableStorage Policy CSP description: Learn more about the ADMX_RemovableStorage Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index c39da81dc2..20b71871da 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -1,7 +1,8 @@ --- title: ADMX_RPC Policy CSP description: Learn more about the ADMX_RPC Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index 8e30372654..29c561bce4 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -1,7 +1,8 @@ --- title: ADMX_sam Policy CSP description: Learn more about the ADMX_sam Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md index e4f196f9c1..a6f14787c7 100644 --- a/windows/client-management/mdm/policy-csp-admx-scripts.md +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -1,7 +1,8 @@ --- title: ADMX_Scripts Policy CSP description: Learn more about the ADMX_Scripts Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md index f1a0bd29ec..c7df498781 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiageng.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -1,7 +1,8 @@ --- title: ADMX_sdiageng Policy CSP description: Learn more about the ADMX_sdiageng Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md index 449d3b0270..ddbaf8e3a1 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md @@ -1,7 +1,8 @@ --- title: ADMX_sdiagschd Policy CSP description: Learn more about the ADMX_sdiagschd Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md index 5d85d32ab3..f9bd2b2d9c 100644 --- a/windows/client-management/mdm/policy-csp-admx-securitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -1,7 +1,8 @@ --- title: ADMX_Securitycenter Policy CSP description: Learn more about the ADMX_Securitycenter Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md index 3702686690..48ddd100cf 100644 --- a/windows/client-management/mdm/policy-csp-admx-sensors.md +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -1,7 +1,8 @@ --- title: ADMX_Sensors Policy CSP description: Learn more about the ADMX_Sensors Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-servermanager.md b/windows/client-management/mdm/policy-csp-admx-servermanager.md index c61b343f81..3d6347374d 100644 --- a/windows/client-management/mdm/policy-csp-admx-servermanager.md +++ b/windows/client-management/mdm/policy-csp-admx-servermanager.md @@ -1,7 +1,8 @@ --- title: ADMX_ServerManager Policy CSP description: Learn more about the ADMX_ServerManager Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md index b7608a80f3..9b97bf82aa 100644 --- a/windows/client-management/mdm/policy-csp-admx-servicing.md +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -1,7 +1,8 @@ --- title: ADMX_Servicing Policy CSP description: Learn more about the ADMX_Servicing Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 28649a54bb..32ec1c0f80 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -1,7 +1,8 @@ --- title: ADMX_SettingSync Policy CSP description: Learn more about the ADMX_SettingSync Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index dc791f72b5..27e087cf56 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -1,7 +1,8 @@ --- title: ADMX_SharedFolders Policy CSP description: Learn more about the ADMX_SharedFolders Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md index fb685b026e..29aaa13813 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharing.md +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -1,7 +1,8 @@ --- title: ADMX_Sharing Policy CSP description: Learn more about the ADMX_Sharing Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index 87242a5c8d..7868dc6f91 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -1,7 +1,8 @@ --- title: ADMX_ShellCommandPromptRegEditTools Policy CSP description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index f7b65e39b9..f4a71bef5e 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -1,7 +1,8 @@ --- title: ADMX_Smartcard Policy CSP description: Learn more about the ADMX_Smartcard Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md index 36fe79b61d..2f50365b26 100644 --- a/windows/client-management/mdm/policy-csp-admx-snmp.md +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -1,7 +1,8 @@ --- title: ADMX_Snmp Policy CSP description: Learn more about the ADMX_Snmp Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-soundrec.md b/windows/client-management/mdm/policy-csp-admx-soundrec.md index de2a3b6bf9..6094515818 100644 --- a/windows/client-management/mdm/policy-csp-admx-soundrec.md +++ b/windows/client-management/mdm/policy-csp-admx-soundrec.md @@ -1,7 +1,8 @@ --- title: ADMX_SoundRec Policy CSP description: Learn more about the ADMX_SoundRec Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md index 9f738881cb..d8c7480832 100644 --- a/windows/client-management/mdm/policy-csp-admx-srmfci.md +++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md @@ -1,7 +1,8 @@ --- title: ADMX_srmfci Policy CSP description: Learn more about the ADMX_srmfci Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index e43437afce..2a80ace809 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -1,7 +1,8 @@ --- title: ADMX_StartMenu Policy CSP description: Learn more about the ADMX_StartMenu Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -997,7 +998,7 @@ This policy setting allows you to prevent users from changing their Start screen |:--|:--| | Name | NoChangeStartMenu | | Friendly Name | Prevent users from customizing their Start Screen | -| Location | User Configuration | +| Location | Computer and User Configuration | | Path | Start Menu and Taskbar | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | | Registry Value Name | NoChangeStartMenu | diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md index 5cabd1d034..eeb57dfceb 100644 --- a/windows/client-management/mdm/policy-csp-admx-systemrestore.md +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -1,7 +1,8 @@ --- title: ADMX_SystemRestore Policy CSP description: Learn more about the ADMX_SystemRestore Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md index 53afd9ca6d..134dcb28e4 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -1,7 +1,8 @@ --- title: ADMX_TabletPCInputPanel Policy CSP description: Learn more about the ADMX_TabletPCInputPanel Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletshell.md b/windows/client-management/mdm/policy-csp-admx-tabletshell.md index 54cd7e2993..2958e9e921 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletshell.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletshell.md @@ -1,7 +1,8 @@ --- title: ADMX_TabletShell Policy CSP description: Learn more about the ADMX_TabletShell Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index 15a624d898..a9a78648d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -1,7 +1,8 @@ --- title: ADMX_Taskbar Policy CSP description: Learn more about the ADMX_Taskbar Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -69,7 +70,7 @@ A reboot is required for this policy setting to take effect. |:--|:--| | Name | DisableNotificationCenter | | Friendly Name | Remove Notifications and Action Center | -| Location | User Configuration | +| Location | Computer and User Configuration | | Path | Start Menu and Taskbar | | Registry Key Name | Software\Policies\Microsoft\Windows\Explorer | | Registry Value Name | DisableNotificationCenter | @@ -748,11 +749,11 @@ This policy setting allows you to turn off automatic promotion of notification i -This policy setting allows users to see Windows Store apps on the taskbar. +This policy setting allows users to see packaged Microsoft Store apps on the taskbar. -- If you enable this policy setting, users will see Windows Store apps on the taskbar. +- If you enable this policy setting, users will see packaged Microsoft Store apps on the taskbar. -- If you disable this policy setting, users won't see Windows Store apps on the taskbar. +- If you disable this policy setting, users won't see packaged Microsoft Store apps on the taskbar. - If you don't configure this policy setting, the default setting for the user's device will be used, and the user can choose to change it. @@ -778,7 +779,7 @@ This policy setting allows users to see Windows Store apps on the taskbar. | Name | Value | |:--|:--| | Name | ShowWindowsStoreAppsOnTaskbar | -| Friendly Name | Show Windows Store apps on the taskbar | +| Friendly Name | Show packaged Microsoft Store apps on the taskbar | | Location | User Configuration | | Path | Start Menu and Taskbar | | Registry Key Name | Software\Policies\Microsoft\Windows\Explorer | diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index 2cf61bd6b9..b9eca775bc 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -1,7 +1,8 @@ --- title: ADMX_tcpip Policy CSP description: Learn more about the ADMX_tcpip Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index c4f588506a..e5582ef354 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -1,7 +1,8 @@ --- title: ADMX_TerminalServer Policy CSP description: Learn more about the ADMX_TerminalServer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -3585,7 +3586,7 @@ This policy setting allows you to specify which protocols can be used for Remote - If you enable this policy setting, you must specify if you would like RDP to use UDP. -You can select one of the following options: "Use both UDP and TCP", "Use only TCP" or "Use either UDP or TCP (default)". +You can select one of the following options: "Use either UDP or TCP (default)" or "Use only TCP". If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md index 7095179c9c..68ed3bd626 100644 --- a/windows/client-management/mdm/policy-csp-admx-thumbnails.md +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -1,7 +1,8 @@ --- title: ADMX_Thumbnails Policy CSP description: Learn more about the ADMX_Thumbnails Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -95,11 +96,14 @@ File Explorer displays thumbnail images by default. This policy setting allows you to configure how File Explorer displays thumbnail images or icons on network folders. -File Explorer displays thumbnail images on network folders by default. +File Explorer displays only icons and never displays thumbnail images on network folders by default. -- If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images on network folders. +- If you disable this policy setting, File Explorer displays thumbnail images on network folders. -- If you disable or don't configure this policy setting, File Explorer displays only thumbnail images on network folders. +- If you enable or don't configure this policy setting, File Explorer displays only icons and never displays thumbnail images on network folders. + +> [!NOTE] +> Allowing the use of thumbnail images from network folders can expose the users' computers to security risks. diff --git a/windows/client-management/mdm/policy-csp-admx-touchinput.md b/windows/client-management/mdm/policy-csp-admx-touchinput.md index 0dd7cbbfb3..6c4a106687 100644 --- a/windows/client-management/mdm/policy-csp-admx-touchinput.md +++ b/windows/client-management/mdm/policy-csp-admx-touchinput.md @@ -1,7 +1,8 @@ --- title: ADMX_TouchInput Policy CSP description: Learn more about the ADMX_TouchInput Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index f32dd4464c..d562fe09f8 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -1,7 +1,8 @@ --- title: ADMX_TPM Policy CSP description: Learn more about the ADMX_TPM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index 01ba02840f..aa95c5771b 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -1,7 +1,8 @@ --- title: ADMX_UserExperienceVirtualization Policy CSP description: Learn more about the ADMX_UserExperienceVirtualization Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -7541,7 +7542,7 @@ This policy setting configures where custom settings location templates are stor - If you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location. -If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored. +If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they'll be ignored. If you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used. diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index f6d72112f3..e169874574 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -1,7 +1,8 @@ --- title: ADMX_UserProfiles Policy CSP description: Learn more about the ADMX_UserProfiles Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -157,7 +158,7 @@ This policy setting controls whether Windows forcefully unloads the user's regis This policy setting determines whether the system retains a roaming user's Windows Installer and Group Policy based software installation data on their profile deletion. -By default Windows deletes all information related to a roaming user (which includes the user's settings, data, Windows Installer related data, and the like) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they will need to reinstall all apps published via policy at logon increasing logon time. You can use this policy setting to change this behavior. +By default Windows deletes all information related to a roaming user (which includes the user's settings, data, Windows Installer related data, and the like) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they'll need to reinstall all apps published via policy at logon increasing logon time. You can use this policy setting to change this behavior. - If you enable this policy setting, Windows won't delete Windows Installer or Group Policy software installation data for roaming users when profiles are deleted from the machine. This will improve the performance of Group Policy based Software Installation during user logon when a user profile is deleted and that user subsequently logs on to the machine. diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index 36500806d4..c5e04d51fe 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -1,7 +1,8 @@ --- title: ADMX_W32Time Policy CSP description: Learn more about the ADMX_W32Time Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index 67bae2d6f2..eddfd41aa9 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -1,7 +1,8 @@ --- title: ADMX_WCM Policy CSP description: Learn more about the ADMX_WCM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wdi.md b/windows/client-management/mdm/policy-csp-admx-wdi.md index 1c28ee517e..886ee5fbba 100644 --- a/windows/client-management/mdm/policy-csp-admx-wdi.md +++ b/windows/client-management/mdm/policy-csp-admx-wdi.md @@ -1,7 +1,8 @@ --- title: ADMX_WDI Policy CSP description: Learn more about the ADMX_WDI Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md index 182bcadb67..fda5e84038 100644 --- a/windows/client-management/mdm/policy-csp-admx-wincal.md +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -1,7 +1,8 @@ --- title: ADMX_WinCal Policy CSP description: Learn more about the ADMX_WinCal Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md index d975aa7c0c..938407c19d 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md +++ b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsColorSystem Policy CSP description: Learn more about the ADMX_WindowsColorSystem Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md index 581b608823..547df1e902 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsConnectNow Policy CSP description: Learn more about the ADMX_WindowsConnectNow Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 44d542de9d..ee2d66d528 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsExplorer Policy CSP description: Learn more about the ADMX_WindowsExplorer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -472,7 +473,15 @@ You can specify a known folder using its known folder id or using its canonical - + +This policy setting determines the application of the Mark of the Web tag to files sourced from insecure locations. + +- If you enable this policy setting, files copied from unsecure sources won't be tagged with the Mark of the Web. + +- If you disable or don't configure this policy setting, files copied from unsecure sources will be tagged with the appropriate Mark of the Web. + +> [!NOTE] +> Failure to tag files from unsecure sources with the Mark of the Web can expose users' computers to security risks. @@ -489,7 +498,6 @@ You can specify a known folder using its known folder id or using its canonical - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -497,6 +505,11 @@ You can specify a known folder using its known folder id or using its canonical | Name | Value | |:--|:--| | Name | DisableMotWOnInsecurePathCopy | +| Friendly Name | Do not apply the Mark of the Web tag to files copied from insecure sources | +| Location | Computer Configuration | +| Path | WindowsComponents > File Explorer | +| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer | +| Registry Value Name | DisableMotWOnInsecurePathCopy | | ADMX File Name | WindowsExplorer.admx | @@ -4456,7 +4469,7 @@ Shows or hides sleep from the power options menu. -This policy setting allows up to five Libraries or Search Connectors to be pinned to the "Search again" links and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. To add a Library or Search Connector link, specify the path of the . Library-ms or .searchConnector-ms file in the "Location" text box (for example, "C:\sampleLibrary. Library-ms" for the Documents library, or "C:\sampleSearchConnector.searchConnector-ms" for a Search Connector). The pinned link will only work if this path is valid and the location contains the specified . Library-ms or .searchConnector-ms file. +This policy setting allows up to five Libraries or Search Connectors to be pinned to the "Search again" links and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. To add a Library or Search Connector link, specify the path of the `.Library-ms or .searchConnector-ms` file in the "Location" text box (for example, "C:\sampleLibrary.Library-ms" for the Documents library, or "C:\sampleSearchConnector.searchConnector-ms" for a Search Connector). The pinned link will only work if this path is valid and the location contains the specified `.Library-ms or .searchConnector-ms` file. You can add up to five additional links to the "Search again" links at the bottom of results returned in File Explorer after a search is executed. These links will be shared between Internet search sites and Search Connectors/Libraries. Search Connector/Library links take precedence over Internet search links. diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md index 1e41f5c049..ef7a2157f4 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsMediaDRM Policy CSP description: Learn more about the ADMX_WindowsMediaDRM Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md index 7f1dc35461..038328fa16 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsMediaPlayer Policy CSP description: Learn more about the ADMX_WindowsMediaPlayer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md index 6839ac8703..999113f8f3 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsRemoteManagement Policy CSP description: Learn more about the ADMX_WindowsRemoteManagement Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md index 16548d4632..af0e371994 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsstore.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -1,7 +1,8 @@ --- title: ADMX_WindowsStore Policy CSP description: Learn more about the ADMX_WindowsStore Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md index 53c453b291..626f2e0cf7 100644 --- a/windows/client-management/mdm/policy-csp-admx-wininit.md +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -1,7 +1,8 @@ --- title: ADMX_WinInit Policy CSP description: Learn more about the ADMX_WinInit Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index 3777efde58..4921e607a7 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -1,7 +1,8 @@ --- title: ADMX_WinLogon Policy CSP description: Learn more about the ADMX_WinLogon Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-winsrv.md b/windows/client-management/mdm/policy-csp-admx-winsrv.md index 4bb456deae..aeb9221473 100644 --- a/windows/client-management/mdm/policy-csp-admx-winsrv.md +++ b/windows/client-management/mdm/policy-csp-admx-winsrv.md @@ -1,7 +1,8 @@ --- title: ADMX_Winsrv Policy CSP description: Learn more about the ADMX_Winsrv Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md index f757409689..27ddcde8a5 100644 --- a/windows/client-management/mdm/policy-csp-admx-wlansvc.md +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -1,7 +1,8 @@ --- title: ADMX_wlansvc Policy CSP description: Learn more about the ADMX_wlansvc Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wordwheel.md b/windows/client-management/mdm/policy-csp-admx-wordwheel.md index 100d06044e..a9e13d8d5a 100644 --- a/windows/client-management/mdm/policy-csp-admx-wordwheel.md +++ b/windows/client-management/mdm/policy-csp-admx-wordwheel.md @@ -1,7 +1,8 @@ --- title: ADMX_WordWheel Policy CSP description: Learn more about the ADMX_WordWheel Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md index 0cc0f52149..b89ba70666 100644 --- a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md +++ b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md @@ -1,7 +1,8 @@ --- title: ADMX_WorkFoldersClient Policy CSP description: Learn more about the ADMX_WorkFoldersClient Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md index bfddc2641c..300f775095 100644 --- a/windows/client-management/mdm/policy-csp-admx-wpn.md +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -1,7 +1,8 @@ --- title: ADMX_WPN Policy CSP description: Learn more about the ADMX_WPN Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -254,7 +255,7 @@ No reboots or service restarts are required for this policy setting to take effe |:--|:--| | Name | NoToastNotification | | Friendly Name | Turn off toast notifications | -| Location | User Configuration | +| Location | Computer and User Configuration | | Path | Start Menu and Taskbar > Notifications | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications | | Registry Value Name | NoToastApplicationNotification | diff --git a/windows/client-management/mdm/policy-csp-appdeviceinventory.md b/windows/client-management/mdm/policy-csp-appdeviceinventory.md index 7e0fb8176b..93ca6fdfaa 100644 --- a/windows/client-management/mdm/policy-csp-appdeviceinventory.md +++ b/windows/client-management/mdm/policy-csp-appdeviceinventory.md @@ -1,7 +1,8 @@ --- title: AppDeviceInventory Policy CSP description: Learn more about the AppDeviceInventory Area in Policy CSP. -ms.date: 08/07/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -33,7 +34,12 @@ ms.date: 08/07/2024 - + +This policy controls the state of API Sampling. API Sampling monitors the sampled collection of application programming interfaces used during system runtime to help diagnose compatibility problems. + +- If you enable this policy, API Sampling won't be run. + +- If you disable or don't configure this policy, API Sampling will be turned on. @@ -50,7 +56,6 @@ ms.date: 08/07/2024 - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -58,6 +63,11 @@ ms.date: 08/07/2024 | Name | Value | |:--|:--| | Name | TurnOffAPISamping | +| Friendly Name | Turn off API Sampling | +| Location | Computer Configuration | +| Path | Windows Components > App and Device Inventory | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppCompat | +| Registry Value Name | DisableAPISamping | | ADMX File Name | AppDeviceInventory.admx | @@ -83,7 +93,12 @@ ms.date: 08/07/2024 - + +This policy controls the state of Application Footprint. Application Footprint monitors the sampled collection of registry and file usage to help diagnose compatibility problems. + +- If you enable this policy, Application Footprint won't be run. + +- If you disable or don't configure this policy, Application Footprint will be turned on. @@ -100,7 +115,6 @@ ms.date: 08/07/2024 - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -108,6 +122,11 @@ ms.date: 08/07/2024 | Name | Value | |:--|:--| | Name | TurnOffApplicationFootprint | +| Friendly Name | Turn off Application Footprint | +| Location | Computer Configuration | +| Path | Windows Components > App and Device Inventory | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppCompat | +| Registry Value Name | DisableApplicationFootprint | | ADMX File Name | AppDeviceInventory.admx | @@ -133,7 +152,12 @@ ms.date: 08/07/2024 - + +This policy controls the state of Install Tracing. Install Tracing is a mechanism that tracks application installs to help diagnose compatibility problems. + +- If you enable this policy, Install Tracing won't be run. + +- If you disable or don't configure this policy, Install Tracing will be turned on. @@ -150,7 +174,6 @@ ms.date: 08/07/2024 - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -158,6 +181,11 @@ ms.date: 08/07/2024 | Name | Value | |:--|:--| | Name | TurnOffInstallTracing | +| Friendly Name | Turn off Install Tracing | +| Location | Computer Configuration | +| Path | Windows Components > App and Device Inventory | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppCompat | +| Registry Value Name | DisableInstallTracing | | ADMX File Name | AppDeviceInventory.admx | @@ -167,6 +195,65 @@ ms.date: 08/07/2024 + +## TurnOffWin32AppBackup + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/AppDeviceInventory/TurnOffWin32AppBackup +``` + + + + +This policy controls the state of the compatibility scan for backed up applications. The compatibility scan for backed up applications evaluates for compatibility problems in installed applications. + +- If you enable this policy, the compatibility scan for backed up applications won't be run. + +- If you disable or don't configure this policy, the compatibility scan for backed up applications will be run. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | TurnOffWin32AppBackup | +| Friendly Name | Turn off compatibility scan for backed up applications | +| Location | Computer Configuration | +| Path | Windows Components > App and Device Inventory | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppCompat | +| Registry Value Name | DisableWin32AppBackup | +| ADMX File Name | AppDeviceInventory.admx | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 8b9aeb6e3c..91b1fc4ac8 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,7 +1,8 @@ --- title: ApplicationDefaults Policy CSP description: Learn more about the ApplicationDefaults Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 7b1698c462..a35a33a38a 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,7 +1,8 @@ --- title: ApplicationManagement Policy CSP description: Learn more about the ApplicationManagement Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,6 +10,10 @@ ms.date: 04/10/2024 # Policy CSP - ApplicationManagement +[!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] + +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -30,11 +35,11 @@ ms.date: 04/10/2024 -This policy setting allows you to manage the installation of trusted line-of-business (LOB) or developer-signed Windows Store apps. +This policy setting allows you to manage the installation of trusted line-of-business (LOB) or developer-signed packaged Microsoft Store apps. -- If you enable this policy setting, you can install any LOB or developer-signed Windows Store app (which must be signed with a certificate chain that can be successfully validated by the local computer). +- If you enable this policy setting, you can install any LOB or developer-signed packaged Microsoft Store app (which must be signed with a certificate chain that can be successfully validated by the local computer). -- If you disable or don't configure this policy setting, you can't install LOB or developer-signed Windows Store apps. +- If you disable or don't configure this policy setting, you can't install LOB or developer-signed packaged Microsoft Store apps. @@ -269,7 +274,7 @@ Allows or denies development of Microsoft Store applications and installing them | Name | Value | |:--|:--| | Name | AllowDevelopmentWithoutDevLicense | -| Friendly Name | Allows development of Windows Store apps and installing them from an integrated development environment (IDE) | +| Friendly Name | Allows development of packaged Microsoft Store apps and installing them from an integrated development environment (IDE) | | Location | Computer Configuration | | Path | Windows Components > App Package Deployment | | Registry Key Name | Software\Policies\Microsoft\Windows\Appx | @@ -283,6 +288,56 @@ Allows or denies development of Microsoft Store applications and installing them + +## AllowedNonAdminPackageFamilyNameRules + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowedNonAdminPackageFamilyNameRules +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowedNonAdminPackageFamilyNameRules | +| ADMX File Name | AppxPackageManager.admx | + + + + + + + + ## AllowGameDVR @@ -371,7 +426,7 @@ If the setting is enabled or not configured, then Recording and Broadcasting (st Manages a Windows app's ability to share data between users who have installed the app. -- If you enable this policy, a Windows app can share app data with other instances of that app. Data is shared through the SharedLocal folder. This folder is available through the Windows. Storage API. +- If you enable this policy, a Windows app can share app data with other instances of that app. Data is shared through the SharedLocal folder. This folder is available through the `Windows.Storage` API. - If you disable this policy, a Windows app can't share app data with other instances of that app. If this policy was previously enabled, any previously shared app data will remain in the SharedLocal folder. @@ -629,7 +684,7 @@ Disable turns off the launch of all apps from the Microsoft Store that came pre- | Name | Value | |:--|:--| | Name | DisableStoreApps | -| Friendly Name | Disable all apps from Microsoft Store | +| Friendly Name | Disable all apps from Microsoft Store | | Location | Computer Configuration | | Path | Windows Components > Store | | Registry Key Name | Software\Policies\Microsoft\WindowsStore | @@ -867,7 +922,7 @@ This policy setting directs Windows Installer to use elevated permissions when i Denies access to the retail catalog in the Microsoft Store, but displays the private store. -- If you enable this setting, users won't be able to view the retail catalog in the Microsoft Store, but they will be able to view apps in the private store. +- If you enable this setting, users won't be able to view the retail catalog in the Microsoft Store, but they'll be able to view apps in the private store. - If you disable or don't configure this setting, users can access the retail catalog in the Microsoft Store. diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 20cddfc183..f350d286be 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,7 +1,8 @@ --- title: AppRuntime Policy CSP description: Learn more about the AppRuntime Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -32,9 +33,9 @@ ms.date: 01/18/2024 -This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it. +This policy setting lets you control whether Microsoft accounts are optional for packaged Microsoft Store apps that require an account to sign in. This policy only affects packaged Microsoft Store apps that support it. -- If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead. +- If you enable this policy setting, packaged Microsoft Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead. - If you disable or don't configure this policy setting, users will need to sign in with a Microsoft account. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 6e677aa3b7..410bed737a 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,7 +1,8 @@ --- title: AppVirtualization Policy CSP description: Learn more about the AppVirtualization Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -33,6 +34,9 @@ ms.date: 01/18/2024 This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect. + +> [!NOTE] +> Application Virtualization (App-V) will reach end-of-life April 2026. After that time, the App-V client will be excluded from new versions of the Windows operating system. See aka.ms/AppVDeprecation for more information. @@ -309,7 +313,7 @@ Enables a UX to display to the user when a publishing refresh is performed on th Reporting Server URL: Displays the URL of reporting server. -Reporting Time: When the client data should be reported to the server. Acceptable range is 0~23, corresponding to the 24 hours in a day. A good practice is, don't set this time to a busy hour, e.g. 9. AM. +Reporting Time: When the client data should be reported to the server. Acceptable range is 0~23, corresponding to the 24 hours in a day. A good practice is, don't set this time to a busy hour, e.g. 9AM. Delay reporting for the random minutes: The maximum minutes of random delay on top of the reporting time. For a busy system, the random delay will help reduce the server load. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index 63caf16da0..66a283655a 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,7 +1,8 @@ --- title: AttachmentManager Policy CSP description: Learn more about the AttachmentManager Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -154,7 +155,7 @@ This policy setting allows you to manage whether users can manually remove the z -This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant. +This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they'll all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant. - If you enable this policy setting, Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 3e7b9cbfee..6e6a59f438 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,7 +1,8 @@ --- title: Audit Policy CSP description: Learn more about the Audit Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -846,7 +847,7 @@ Volume: Low. -This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged-on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). +This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged-on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index bfd166053c..b05b71eb8e 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,7 +1,8 @@ --- title: Authentication Policy CSP description: Learn more about the Authentication Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index f94c675d89..955e4d92ab 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,7 +1,8 @@ --- title: Autoplay Policy CSP description: Learn more about the Autoplay Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 85ba82af82..308853dff2 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -1,7 +1,8 @@ --- title: Bitlocker Policy CSP description: Learn more about the Bitlocker Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 01dbd07987..eb4c4c5f2b 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -1,7 +1,8 @@ --- title: BITS Policy CSP description: Learn more about the BITS Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -32,7 +33,7 @@ ms.date: 01/18/2024 This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting doesn't affect foreground transfers). -You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours. - If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. @@ -98,7 +99,7 @@ Consider using this setting to prevent BITS transfers from competing for network This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting doesn't affect foreground transfers). -You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours. - If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. @@ -164,7 +165,7 @@ Consider using this setting to prevent BITS transfers from competing for network This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting doesn't affect foreground transfers). -You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours. - If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index fc321bd1b1..0d33c7e54f 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,7 +1,8 @@ --- title: Bluetooth Policy CSP description: Learn more about the Bluetooth Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -265,7 +266,7 @@ Sets the local Bluetooth device name. If this is set, the value that it's set to -Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide. +Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index a86b54d3d2..1acad4511f 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,7 +1,8 @@ --- title: Browser Policy CSP description: Learn more about the Browser Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 3882e07879..7e02fa6542 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,7 +1,8 @@ --- title: Camera Policy CSP description: Learn more about the Camera Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index a2cfae0564..b45e85ec8a 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,7 +1,8 @@ --- title: Cellular Policy CSP description: Learn more about the Cellular Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index cb287ddd00..d216746bc8 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -1,7 +1,8 @@ --- title: CloudDesktop Policy CSP description: Learn more about the CloudDesktop Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 1a15adf8c0..c22245a862 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,7 +1,8 @@ --- title: Connectivity Policy CSP description: Learn more about the Connectivity Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -11,6 +12,8 @@ ms.date: 04/10/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -584,6 +587,159 @@ Also, see the "Web-based printing" policy setting in Computer Configuration/Admi + +## DisableCellularOperatorSettingsPage + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Connectivity/DisableCellularOperatorSettingsPage +``` + + + + +This policy makes all configurable settings in the 'Cellular' > 'Mobile operator settings' page read-only. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + + + + + + + +## DisableCellularSettingsPage + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Connectivity/DisableCellularSettingsPage +``` + + + + +This policy makes all configurable settings in the 'Cellular' Settings page read-only. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + + + + + + + +## DisableCrossDeviceResume + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/Connectivity/DisableCrossDeviceResume +``` + + + + +This policy allows IT admins to turn off CrossDeviceResume feature to continue tasks, such as browsing file, continue using 1P/ 3P apps that require linking between Phone and PC. + +- If you enable this policy setting, the Windows device won't receive any CrossDeviceResume notification. + +- If you disable this policy setting, the Windows device will receive notification to resume activity from linked phone. + +- If you don't configure this policy setting, the default behavior is that the CrossDeviceResume feature is turned 'ON'. Changes to this policy take effect on reboot. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | CrossDeviceResume is Enabled. | +| 1 | CrossDeviceResume is Disabled. | + + + + + + + + ## DisableDownloadingOfPrintDriversOverHTTP @@ -899,6 +1055,55 @@ If you disable this setting or don't configure it, the user will be able to crea + +## UseCellularWhenWiFiPoor + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Connectivity/UseCellularWhenWiFiPoor +``` + + + + +This policy allows the use of a cellular connection when Wi-Fi connectivity is limited. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 (Default) | Enabled. | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index cd2bf997f6..14777213d3 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,7 +1,8 @@ --- title: ControlPolicyConflict Policy CSP description: Learn more about the ControlPolicyConflict Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -37,7 +38,7 @@ If set to 1 then any MDM policy that's set that has an equivalent GP policy will > [!NOTE] -> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). Nor does it apply to the [Update Policy CSP](policy-csp-update.md) for managing Windows updates. +> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). As a result, it is recommended that the same settings should not be configured in both GPO and MDM policies unless the settings are under the control of MDMWinsOverGP. Otherwise, there will be a race condition and no guarantee which one wins. This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index d73b3ade9c..543e2efb7f 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,7 +1,8 @@ --- title: CredentialProviders Policy CSP description: Learn more about the CredentialProviders Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index af3cee543f..263eb0058e 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,7 +1,8 @@ --- title: CredentialsDelegation Policy CSP description: Learn more about the CredentialsDelegation Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index f6f9d847a7..1e2a4e8319 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,7 +1,8 @@ --- title: CredentialsUI Policy CSP description: Learn more about the CredentialsUI Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 27aae04079..709e9e57bd 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,7 +1,8 @@ --- title: Cryptography Policy CSP description: Learn more about the Cryptography Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 01/18/2024 # Policy CSP - Cryptography -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -79,7 +78,7 @@ Allows or disallows the Federal Information Processing Standard (FIPS) policy. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -146,7 +145,7 @@ CertUtil.exe -DisplayEccCurve. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -196,7 +195,7 @@ System cryptography: Force strong key protection for user keys stored on the com | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -235,7 +234,7 @@ Override minimal enabled TLS version for client role. Last write wins. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -274,7 +273,7 @@ Override minimal enabled TLS version for server role. Last write wins. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -313,7 +312,7 @@ Override minimal enabled TLS version for client role. Last write wins. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index ed3d5d84d4..be943180ef 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,7 +1,8 @@ --- title: DataProtection Policy CSP description: Learn more about the DataProtection Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 37ef82f657..d821a157ad 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,7 +1,8 @@ --- title: DataUsage Policy CSP description: Learn more about the DataUsage Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index a790f24a26..885ebb21e6 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,7 +1,8 @@ --- title: Defender Policy CSP description: Learn more about the Defender Area in Policy CSP. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -30,7 +31,7 @@ ms.date: 06/28/2024 -This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as . ZIP or . CAB files. +This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. - If you enable or don't configure this setting, archive files will be scanned. @@ -745,7 +746,7 @@ This policy setting allows you to configure scheduled scans and on-demand (manua | Name | Value | |:--|:--| | Name | Scan_DisableScanningNetworkFiles | -| Friendly Name | Scan network files | +| Friendly Name | Configure scanning of network files | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 171f5c4349..6bf367d3e9 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,7 +1,8 @@ --- title: DeliveryOptimization Policy CSP description: Learn more about the DeliveryOptimization Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -34,11 +35,7 @@ ms.date: 08/06/2024 -Specifies the maximum size in GB of Delivery Optimization cache. - -This policy overrides the DOMaxCacheSize policy. - -The value 0 (zero) means "unlimited" cache; Delivery Optimization will clear the cache when the device runs low on disk space. +Specifies the maximum size in GB of Delivery Optimization cache. This policy overrides the MaxCacheSize policy. @@ -93,7 +90,7 @@ The value 0 (zero) means "unlimited" cache; Delivery Optimization will clear the -Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network. +Specifies whether the device, with an active VPN connection, is allowed to participate in P2P or not. @@ -125,8 +122,8 @@ Specifies whether the device is allowed to participate in Peer Caching while con | Name | Value | |:--|:--| | Name | AllowVPNPeerCaching | -| Friendly Name | Enable Peer Caching while the device connects via VPN | -| Element Name | Enable Peer Caching while the device connects via VPN. | +| Friendly Name | Enable P2P while the device connects via VPN | +| Element Name | Enable P2P while the device connects via VPN. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -156,15 +153,13 @@ Specifies whether the device is allowed to participate in Peer Caching while con -This policy allows you to set one or more Microsoft Connected Cache servers that will be used by your client(s). - -One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas. +Specifies one or more Microsoft Connected Cache servers that will be used by your client(s). One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas. > [!NOTE] -> Clients don't talk to multiple Microsoft Connected Cache (MCC) servers at the same time. If you configure a list of MCC servers in this policy, the clients will round robin until they successfully connect to an MCC server. The clients have no way to determine if the MCC server has the content or not. If the MCC server doesn't have the content, it caches the content as it is handing the content back to the client. +> Clients don't talk to multiple Microsoft Connected Cache servers at the same time. If you configure a list of Connected Cache servers in this policy, the clients will round robin until they successfully connect to a Connected Cache server. The clients have no way to determine if the Connected Cache server has the content or not. If the Connected Cache server doesn't have the content, it caches the content as it is handing the content back to the client. @@ -214,17 +209,10 @@ One or more values can be added as either fully qualified domain names (FQDN) or -This policy allows you to specify how your client(s) can discover Microsoft Connected Cache servers dynamically. - -Options available are: - -0 = Disable DNS-SD. - -1 = DHCP Option 235. +Specifies how your client(s) can discover Microsoft Connected Cache servers dynamically. +1 = DHCP Option 235 2 = DHCP Option 235 Force. - -If this policy isn't configured, the client will attempt to automatically find a cache server using DNS-SD. If set to 0, the client won't use DNS-SD to automatically find a cache server. If set to 1 or 2, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if configured. @@ -240,10 +228,18 @@ If this policy isn't configured, the client will attempt to automatically find a |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-4294967295]` | | Default Value | 0 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | DHCP Option 235. | +| 2 | DHCP Option 235 Force. | + + **Group policy mapping**: @@ -281,13 +277,7 @@ If this policy isn't configured, the client will attempt to automatically find a -This policy allows you to delay the use of an HTTP source in a background download that's allowed to use P2P. - -After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that couldn't be downloaded from Peers. - -Note that a download that's waiting for peer sources, will appear to be stuck for the end user. - -The recommended value is 1 hour (3600). +For background downloads that use P2P, specifies the time to wait before starting to download from the HTTP source. @@ -311,7 +301,7 @@ The recommended value is 1 hour (3600). | Name | Value | |:--|:--| | Name | DelayBackgroundDownloadFromHttp | -| Friendly Name | Delay background download from http (in secs) | +| Friendly Name | Delay background download from http (in seconds) | | Element Name | Delay background download from http (in secs) | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | @@ -342,7 +332,7 @@ The recommended value is 1 hour (3600). -Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for a background content download. Note that the DODelayBackgroundDownloadFromHttp policy takes precedence over this policy to allow downloads from peers first. +For background downloads that use a cache server, specifies the time to wait before falling back to download from the original HTTP source. @@ -397,7 +387,7 @@ Specifies the time in seconds to delay the fallback from Cache Server to the HTT -Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for foreground content download. Note that the DODelayForegroundDownloadFromHttp policy takes precedence over this policy to allow downloads from peers first. +For foreground downloads that use a cache server, specifies the time to wait before falling back to download from the original HTTP source. @@ -452,13 +442,7 @@ Specifies the time in seconds to delay the fallback from Cache Server to the HTT -This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that's allowed to use P2P. - -After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that couldn't be downloaded from Peers. - -Note that a download that's waiting for peer sources, will appear to be stuck for the end user. - -The recommended value is 1 minute (60). +For foreground downloads that use P2P, specifies the time to wait before starting to download from the HTTP source. @@ -482,7 +466,7 @@ The recommended value is 1 minute (60). | Name | Value | |:--|:--| | Name | DelayForegroundDownloadFromHttp | -| Friendly Name | Delay Foreground download from http (in secs) | +| Friendly Name | Delay Foreground download from http (in seconds) | | Element Name | Delay Foreground download from http (in secs) | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | @@ -513,7 +497,7 @@ The recommended value is 1 minute (60). -Disallow downloads from Microsoft Connected Cache servers when the device connects via VPN. By default, the device is allowed to download from Microsoft Connected Cache when connected via VPN. +Specify to disallow downloads from Microsoft Connected Cache servers when the device has an active VPN connection. By default, the button is 'Not Set'. This means the device is allowed to download from Microsoft Connected Cache when the device has an active VPN connection. To block these downloads, turn the button on to 'Enabled'. @@ -535,8 +519,8 @@ Disallow downloads from Microsoft Connected Cache servers when the device connec | Value | Description | |:--|:--| -| 0 (Default) | Allowed. | -| 1 | Not allowed. | +| 0 (Default) | Not Set. | +| 1 | Enabled. | @@ -572,13 +556,13 @@ Disallow downloads from Microsoft Connected Cache servers when the device connec -Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates. The default value is 1. +Specifies the method that Delivery Optimization can use to download content on behalf of various Microsoft products. > [!NOTE] -> The Delivery Optimization service on the clients checks to see if there are peers and/or an MCC server which contains the content and determines the best source for the content. +> The Delivery Optimization service on the clients checks to see if there are peers and/or a Connected Cache server which contains the content and determines the best source for the content. @@ -598,10 +582,10 @@ Specifies the download method that Delivery Optimization can use in downloads of |:--|:--| | 0 (Default) | HTTP only, no peering. | | 1 | HTTP blended with peering behind the same NAT. | -| 2 | When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. | +| 2 | HTTP blended with peering across a private group. | | 3 | HTTP blended with Internet peering. | -| 99 | Simple download mode with no peering. Delivery Optimization downloads using HTTP only and doesn't attempt to contact the Delivery Optimization cloud services. Added in Windows 10, version 1607. | -| 100 | Bypass mode. Windows 10: Don't use Delivery Optimization and use BITS instead. Windows 11: Deprecated, use Simple mode instead. | +| 99 | HTTP only, no peering, no use of DO cloud service. | +| 100 | Bypass mode, deprecated in Windows 11. | @@ -641,11 +625,7 @@ Specifies the download method that Delivery Optimization can use in downloads of -Group ID must be set as a GUID. This Policy specifies an arbitrary group ID that the device belongs to. - -Use this if you need to create a single group for Local Network Peering for branches that are on different domains or aren't on the same LAN. - -Note this is a best effort optimization and shouldn't be relied on for an authentication of identity. +Specifies an arbitrary group ID that the device belongs to. A GUID must be used. @@ -698,7 +678,7 @@ Note this is a best effort optimization and shouldn't be relied on for an authen -Set this policy to restrict peer selection to a specific source. Available options are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix, 5 = Microsoft Entra ID. When set, the Group ID will be assigned automatically from the selected source. This policy is ignored if the GroupID policy is also set. The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. Starting with Windows 10, version 1903, you can use the Microsoft Entra tenant ID as a means to define groups. To do this, set the value of DOGroupIdSource to 5. +Specifies the source of group ID used for peer selection. @@ -722,12 +702,12 @@ Set this policy to restrict peer selection to a specific source. Available optio | Value | Description | |:--|:--| -| 0 (Default) | Unset. | +| 0 (Default) | Not Set. | | 1 | AD site. | | 2 | Authenticated domain SID. | -| 3 | DHCP user option. | -| 4 | DNS suffix. | -| 5 | Microsoft Entra ID. | +| 3 | DHCP Option ID. | +| 4 | DNS Suffix. | +| 5 | Entra ID Tenant ID. | @@ -768,8 +748,6 @@ Set this policy to restrict peer selection to a specific source. Available optio Specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. - -The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. @@ -824,7 +802,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts -Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. The value 0 (zero) means unlimited; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size hasn't exceeded. The value 0 is new in Windows 10, version 1607. The default value is 604800 seconds (7 days). +Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. @@ -879,7 +857,7 @@ Specifies the maximum time in seconds that each file is held in the Delivery Opt -Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). The default value is 20. +Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of the available drive space. @@ -935,8 +913,6 @@ Specifies the maximum cache size that Delivery Optimization can utilize, as a pe Specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. - -The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. @@ -991,7 +967,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts -Specifies the minimum download QoS (Quality of Service or speed) in KiloBytes/sec for background downloads. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from the HTTP source to achieve the minimum QoS value set. The default value is 20480 (20 MB/s). +Specifies the minimum download QoS (Quality of Service) in KiloBytes/sec for background downloads. @@ -1046,11 +1022,7 @@ Specifies the minimum download QoS (Quality of Service or speed) in KiloBytes/se -Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on DC power (Battery). - -The recommended value to set if you allow uploads on battery is 40 (for 40%). The device can download from peers while on battery regardless of this policy. - -The value 0 means "not-limited"; The cloud service set default value will be used. +Specifies the minimum battery level required for uploading to peers, while on battery power. @@ -1105,12 +1077,7 @@ The value 0 means "not-limited"; The cloud service set default value will be use -Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The cloud service set default value will be used. - -Recommended values: 64 GB to 256 GB. - -> [!NOTE] -> If the DOModifyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy. +Specifies the required minimum total disk size in GB for the device to use P2P. @@ -1134,8 +1101,8 @@ Recommended values: 64 GB to 256 GB. | Name | Value | |:--|:--| | Name | MinDiskSizeAllowedToPeer | -| Friendly Name | Minimum disk size allowed to use Peer Caching (in GB) | -| Element Name | Minimum disk size allowed to use Peer Caching (in GB) | +| Friendly Name | Minimum disk size allowed to use P2P (in GB) | +| Element Name | Minimum disk size allowed to use P2P (in GB) | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1165,7 +1132,7 @@ Recommended values: 64 GB to 256 GB. -Specifies the minimum content file size in MB enabled to use Peer Caching. Recommended values: 1 MB to 100,000 MB. The default value is 100 MB. +Specifies the minimum content file size in MB eligible to use P2P. @@ -1189,8 +1156,8 @@ Specifies the minimum content file size in MB enabled to use Peer Caching. Recom | Name | Value | |:--|:--| | Name | MinFileSizeToCache | -| Friendly Name | Minimum Peer Caching Content File Size (in MB) | -| Element Name | Minimum Peer Caching Content File Size (in MB) | +| Friendly Name | Minimum P2P Content File Size (in MB) | +| Element Name | Minimum P2P Content File Size (in MB) | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1220,7 +1187,7 @@ Specifies the minimum content file size in MB enabled to use Peer Caching. Recom -Specifies the minimum RAM size in GB required to use Peer Caching. For example, if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB. The default value is 4 GB. +Specifies the minimum total RAM size in GB required to use P2P. @@ -1244,8 +1211,8 @@ Specifies the minimum RAM size in GB required to use Peer Caching. For example, | Name | Value | |:--|:--| | Name | MinRAMAllowedToPeer | -| Friendly Name | Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB) | -| Element Name | Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB) | +| Friendly Name | Minimum RAM capacity (inclusive) required to enable use of P2P (in GB) | +| Element Name | Minimum RAM capacity (inclusive) required to enable use of P2P (in GB) | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1275,9 +1242,7 @@ Specifies the minimum RAM size in GB required to use Peer Caching. For example, -Specifies the drive Delivery Optimization shall use for its cache. - -By default, %SystemDrive% is used to store the cache. The drive location can be specified using environment variables, drive letter or using a full path. +Specifies the drive that Delivery Optimization should use for its cache. The drive location can be specified using environment variables, drive letter or using a full path. @@ -1330,7 +1295,7 @@ By default, %SystemDrive% is used to store the cache. The drive location can be -Specifies the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. The value 0 (zero) means unlimited; No monthly upload limit's applied if 0 is set. The default value is 5120 (5 TB). +Specifies the maximum bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. @@ -1386,8 +1351,6 @@ Specifies the maximum total bytes in GB that Delivery Optimization is allowed to Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. - -The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads. @@ -1445,8 +1408,6 @@ Downloads from LAN peers won't be throttled even when this policy is set. Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. - -The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. @@ -1501,7 +1462,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts -Set this policy to restrict peer selection via selected option. Options available are: 1=Subnet mask, 2 = Local discovery (DNS-SD). These options apply to both Download Mode LAN (1) and Group (2). +Specifies to restrict peer selection using the selected method, in addition to the DownloadMode policy. @@ -1528,7 +1489,7 @@ In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer |:--|:--| | 0 (Default) | None. | | 1 | Subnet mask. | -| 2 | Local peer discovery (DNS-SD). | +| 2 | Local discovery (DNS-SD). | @@ -1681,7 +1642,7 @@ This policy allows an IT Admin to define the following details: -This policy allows you to set one or more keywords used to recognize VPN connections. To add multiple keywords, separate them with commas. +Specifies one or more keywords used to recognize VPN connections. To add multiple keywords, separate each by a comma. diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 60c0d9c6aa..c2c1c5c18b 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,7 +1,8 @@ --- title: Desktop Policy CSP description: Learn more about the Desktop Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-desktopappinstaller.md b/windows/client-management/mdm/policy-csp-desktopappinstaller.md index 2b3fea16a4..eb317efb9d 100644 --- a/windows/client-management/mdm/policy-csp-desktopappinstaller.md +++ b/windows/client-management/mdm/policy-csp-desktopappinstaller.md @@ -1,7 +1,8 @@ --- title: DesktopAppInstaller Policy CSP description: Learn more about the DesktopAppInstaller Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -11,8 +12,6 @@ ms.date: 01/18/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -215,7 +214,14 @@ Users will still be able to execute the *winget* command. The default help will - + +This policy controls whether the [Windows Package Manager](/windows/package-manager/) will validate the Microsoft Store certificate hash matches to a known Microsoft Store certificate when initiating a connection to the Microsoft Store Source. + +- If you enable this policy, the [Windows Package Manager](/windows/package-manager/) will bypass the Microsoft Store certificate validation. + +- If you disable this policy, the [Windows Package Manager](/windows/package-manager/) will validate the Microsoft Store certificate used is valid and belongs to the Microsoft Store before communicating with the Microsoft Store source. + +- If you don't configure this policy, the [Windows Package Manager](/windows/package-manager/) administrator settings will be adhered to. @@ -232,7 +238,6 @@ Users will still be able to execute the *winget* command. The default help will - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -240,6 +245,11 @@ Users will still be able to execute the *winget* command. The default help will | Name | Value | |:--|:--| | Name | EnableBypassCertificatePinningForMicrosoftStore | +| Friendly Name | Enable App Installer Microsoft Store Source Certificate Validation Bypass | +| Location | Computer Configuration | +| Path | Windows Components > Desktop App Installer | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppInstaller | +| Registry Value Name | EnableBypassCertificatePinningForMicrosoftStore | | ADMX File Name | DesktopAppInstaller.admx | @@ -445,7 +455,14 @@ This policy controls whether or not the [Windows Package Manager](/windows/packa - + +This policy controls the ability to override malware vulnerability scans when installing an archive file using a local manifest using the command line arguments. + +- If you enable this policy, users can override the malware scan when performing a local manifest install of an archive file. + +- If you disable this policy, users will be unable to override the malware scan of an archive file when installing using a local manifest. + +- If you don't configure this policy, the [Windows Package Manager](/windows/package-manager/) administrator settings will be adhered to. @@ -462,7 +479,6 @@ This policy controls whether or not the [Windows Package Manager](/windows/packa - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -470,6 +486,11 @@ This policy controls whether or not the [Windows Package Manager](/windows/packa | Name | Value | |:--|:--| | Name | EnableLocalArchiveMalwareScanOverride | +| Friendly Name | Enable App Installer Local Archive Malware Scan Override | +| Location | Computer Configuration | +| Path | Windows Components > Desktop App Installer | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppInstaller | +| Registry Value Name | EnableLocalArchiveMalwareScanOverride | | ADMX File Name | DesktopAppInstaller.admx | @@ -618,9 +639,9 @@ This policy controls the Microsoft Store source included with the [Windows Packa This policy controls whether users can install packages from a website that's using the ms-appinstaller protocol. -- If you enable or don't configure this setting, users will be able to install packages from websites that use this protocol. +- If you enable this setting, users will be able to install packages from websites that use this protocol. -- If you disable this setting, users won't be able to install packages from websites that use this protocol. +- If you disable or don't configure this setting, users won't be able to install packages from websites that use this protocol. @@ -724,7 +745,7 @@ The settings are stored inside of a .json file on the user’s system. It may be | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -734,7 +755,14 @@ The settings are stored inside of a .json file on the user’s system. It may be - + +This policy determines if a user can perform an action using the [Windows Package Manager](/windows/package-manager/) through a command line interface (WinGet CLI, or WinGet PowerShell). + +If you disable this policy, users won't be able execute the [Windows Package Manager](/windows/package-manager/) CLI, and PowerShell cmdlets. + +If you enable, or don't configuring this policy, users will be able to execute the [Windows Package Manager](/windows/package-manager/) CLI commands, and PowerShell cmdlets. (Provided "Enable App Installer" policy isn't disabled). + +This policy doesn't override the "Enable App Installer" policy. @@ -751,7 +779,6 @@ The settings are stored inside of a .json file on the user’s system. It may be - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -759,6 +786,11 @@ The settings are stored inside of a .json file on the user’s system. It may be | Name | Value | |:--|:--| | Name | EnableWindowsPackageManagerCommandLineInterfaces | +| Friendly Name | Enable Windows Package Manager command line interfaces | +| Location | Computer Configuration | +| Path | Windows Components > Desktop App Installer | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppInstaller | +| Registry Value Name | EnableWindowsPackageManagerCommandLineInterfaces | | ADMX File Name | DesktopAppInstaller.admx | @@ -774,7 +806,7 @@ The settings are stored inside of a .json file on the user’s system. It may be | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -784,7 +816,12 @@ The settings are stored inside of a .json file on the user’s system. It may be - + +This policy controls whether the [Windows Package Manager](/windows/package-manager/) configuration feature can be used by users. + +- If you enable or don't configure this setting, users will be able to use the [Windows Package Manager](/windows/package-manager/) configuration feature. + +- If you disable this setting, users won't be able to use the [Windows Package Manager](/windows/package-manager/) configuration feature. @@ -801,7 +838,6 @@ The settings are stored inside of a .json file on the user’s system. It may be - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -809,6 +845,11 @@ The settings are stored inside of a .json file on the user’s system. It may be | Name | Value | |:--|:--| | Name | EnableWindowsPackageManagerConfiguration | +| Friendly Name | Enable Windows Package Manager Configuration | +| Location | Computer Configuration | +| Path | Windows Components > Desktop App Installer | +| Registry Key Name | Software\Policies\Microsoft\Windows\AppInstaller | +| Registry Value Name | EnableWindowsPackageManagerConfiguration | | ADMX File Name | DesktopAppInstaller.admx | @@ -835,9 +876,9 @@ The settings are stored inside of a .json file on the user’s system. It may be -This policy controls the auto update interval for package-based sources. +This policy controls the auto-update interval for package-based sources. The default source for [Windows Package Manager](/windows/package-manager/) is configured such that an index of the packages is cached on the local machine. The index is downloaded when a user invokes a command, and the interval has passed. -- If you disable or don't configure this setting, the default interval or the value specified in settings will be used by the [Windows Package Manager](/windows/package-manager/). +- If you disable or don't configure this setting, the default interval or the value specified in the [Windows Package Manager](/windows/package-manager/) settings will be used. - If you enable this setting, the number of minutes specified will be used by the [Windows Package Manager](/windows/package-manager/). diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index c27a142696..d015682073 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,7 +1,8 @@ --- title: DeviceGuard Policy CSP description: Learn more about the DeviceGuard Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,6 +10,8 @@ ms.date: 01/18/2024 # Policy CSP - DeviceGuard +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -205,6 +208,70 @@ Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if config + +## MachineIdentityIsolation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceGuard/MachineIdentityIsolation +``` + + + + +Machine Identity Isolation: 0 - Machine password is only LSASS-bound and stored in $MACHINE.ACC registry key. 1 - Machine password both LSASS-bound and IUM-bound. It's stored in $MACHINE.ACC and $MACHINE.ACC.IUM registry keys. 2 - Machine password is only IUM-bound and stored in $MACHINE.ACC.IUM registry key. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | (Disabled) Machine password is only LSASS-bound and stored in $MACHINE.ACC registry key. | +| 1 | (Enabled in audit mode) Machine password both LSASS-bound and IUM-bound. It's stored in $MACHINE.ACC and $MACHINE.ACC.IUM registry keys. | +| 2 | (Enabled in enforcement mode) Machine password is only IUM-bound and stored in $MACHINE.ACC.IUM registry key. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | VirtualizationBasedSecurity | +| Friendly Name | Turn On Virtualization Based Security | +| Element Name | Machine Identity Isolation Configuration. | +| Location | Computer Configuration | +| Path | System > Device Guard | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard | +| ADMX File Name | DeviceGuard.admx | + + + + + + + + ## RequirePlatformSecurityFeatures diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index 271866959b..a91246ac62 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -1,7 +1,8 @@ --- title: DeviceHealthMonitoring Policy CSP description: Learn more about the DeviceHealthMonitoring Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -30,7 +31,7 @@ ms.date: 01/18/2024 -Enable/disable 4. Nines device health monitoring on devices. +Enable/disable device health monitoring on devices. diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 87f3608dd1..d4c8aab970 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -1,7 +1,8 @@ --- title: DeviceInstallation Policy CSP description: Learn more about the DeviceInstallation Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 259d88a891..4bacc831f5 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,7 +1,8 @@ --- title: DeviceLock Policy CSP description: Learn more about the DeviceLock Area in Policy CSP. -ms.date: 08/05/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -11,8 +12,6 @@ ms.date: 08/05/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - > [!IMPORTANT] @@ -25,7 +24,7 @@ ms.date: 08/05/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -64,7 +63,7 @@ Account lockout threshold - This security setting determines the number of faile | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -329,7 +328,7 @@ Determines the type of PIN or password required. This policy only applies if the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -685,7 +684,7 @@ The number of authentication failures allowed before the device will be wiped. A | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1025,7 +1024,7 @@ This security setting determines the period of time (in days) that a password mu | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1078,7 +1077,7 @@ This security setting determines the least number of characters that a password | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1128,7 +1127,7 @@ This security setting determines the minimum password length for which password | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1188,7 +1187,7 @@ Complexity requirements are enforced when passwords are changed or created. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1360,7 +1359,7 @@ If you enable this setting, users will no longer be able to modify slide show se | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 8f021f8337..2c7e2917eb 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,7 +1,8 @@ --- title: Display Policy CSP description: Learn more about the Display Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,10 +10,72 @@ ms.date: 01/18/2024 # Policy CSP - Display +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + +## ConfigureMultipleDisplayMode + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Display/ConfigureMultipleDisplayMode +``` + + + + +This policy sets the default display arrangement to pick between clone or extend. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Default. | +| 1 (Default) | Clone. | +| 2 | Extend. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureMultipleDisplayMode | +| Path | Display > AT > System > DisplayCat | +| Element Name | DisplayConfigureMultipleDisplayModeSettings | + + + + + + + + ## DisablePerProcessDpiForApps @@ -236,6 +299,66 @@ Enabling this setting lets you specify the system-wide default for desktop appli + +## SetClonePreferredResolutionSource + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Display/SetClonePreferredResolutionSource +``` + + + + +This policy sets the cloned monitor preferred resolution source to an internal or external monitor by default. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Default. | +| 1 (Default) | Internal. | +| 2 | External. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetClonePreferredResolutionSource | +| Path | Display > AT > System > DisplayCat | +| Element Name | DisplaySetClonePreferredResolutionSourceSettings | + + + + + + + + ## TurnOffGdiDPIScalingForApps diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index ed3b7b4609..f3c22ca841 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -1,7 +1,8 @@ --- title: DmaGuard Policy CSP description: Learn more about the DmaGuard Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-eap.md b/windows/client-management/mdm/policy-csp-eap.md index 14022fde28..64de1f0ca5 100644 --- a/windows/client-management/mdm/policy-csp-eap.md +++ b/windows/client-management/mdm/policy-csp-eap.md @@ -1,7 +1,8 @@ --- title: Eap Policy CSP description: Learn more about the Eap Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -30,7 +31,7 @@ ms.date: 01/18/2024 -Added in Windows 10, version 21. H1. Allow or disallow use of TLS 1.3 during EAP client authentication. +Added in Windows 10, version 21H1. Allow or disallow use of TLS 1.3 during EAP client authentication. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index cfd49a1bf0..4efe4c1ad8 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -1,7 +1,8 @@ --- title: Education Policy CSP description: Learn more about the Education Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 016c5d5a51..0d94ccfd85 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -1,7 +1,8 @@ --- title: EnterpriseCloudPrint Policy CSP description: Learn more about the EnterpriseCloudPrint Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index 50e401227e..1fc4e56ebb 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -1,7 +1,8 @@ --- title: ErrorReporting Policy CSP description: Learn more about the ErrorReporting Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index 83a5c6c350..e79a85ea8b 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -1,7 +1,8 @@ --- title: EventLogService Policy CSP description: Learn more about the EventLogService Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index f0831810bd..37d22f55dc 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,7 +1,8 @@ --- title: Experience Policy CSP description: Learn more about the Experience Area in Policy CSP. -ms.date: 08/07/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 08/07/2024 # Policy CSP - Experience -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -484,7 +483,7 @@ Allow screen capture. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -494,7 +493,7 @@ Allow screen capture. - + This policy setting allows you to control whether screen recording functionality is available in the Windows Snipping Tool app. - If you disable this policy setting, screen recording functionality won't be accessible in the Windows Snipping Tool app. @@ -531,7 +530,12 @@ This policy setting allows you to control whether screen recording functionality | Name | Value | |:--|:--| | Name | AllowScreenRecorder | -| Path | Programs > AT > WindowsComponents > SnippingTool | +| Friendly Name | Allow Screen Recorder | +| Location | User Configuration | +| Path | Windows Components > Snipping Tool | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\SnippingTool | +| Registry Value Name | AllowScreenRecorder | +| ADMX File Name | Programs.admx | @@ -1681,7 +1685,7 @@ This policy setting lets you turn off cloud consumer account state content in al | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1887,7 +1891,7 @@ _**Turn syncing off by default but don’t disable**_ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4828] and later
    ✅ Windows 11, version 22H2 with [KB5020044](https://support.microsoft.com/help/5020044) [10.0.22621.900] and later
    ✅ Windows Insider Preview | +| ❌ Device
    ✅ User | ❌ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 with [KB5041582](https://support.microsoft.com/help/5041582) [10.0.19045.4842] and later
    ✅ Windows 11, version 22H2 with [KB5020044](https://support.microsoft.com/help/5020044) [10.0.22621.900] and later
    ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 6d947b5cd3..1722439b80 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -1,7 +1,8 @@ --- title: ExploitGuard Policy CSP description: Learn more about the ExploitGuard Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-federatedauthentication.md b/windows/client-management/mdm/policy-csp-federatedauthentication.md index 4b4de43f51..da5662f29d 100644 --- a/windows/client-management/mdm/policy-csp-federatedauthentication.md +++ b/windows/client-management/mdm/policy-csp-federatedauthentication.md @@ -1,7 +1,8 @@ --- title: FederatedAuthentication Policy CSP description: Learn more about the FederatedAuthentication Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index fb55df7a5d..e49af36ddf 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -1,7 +1,8 @@ --- title: FileExplorer Policy CSP description: Learn more about the FileExplorer Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -138,7 +139,7 @@ When This PC location is restricted, give the user the option to enumerate and n -Turning off this setting will prevent File Explorer from requesting cloud file metadata and displaying it in the homepage and other views in File Explorer. Any insights and files available based on account activity will be stopped in views such as Recent, Recommended, Favorites, etc. +Turning off this setting will prevent File Explorer from requesting cloud file metadata and displaying it in the homepage and other views in File Explorer. Any insights and files available based on account activity will be stopped in views such as Recent, Recommended, Favorites, Details pane, etc. diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md index f1d4135999..bc73918bf9 100644 --- a/windows/client-management/mdm/policy-csp-filesystem.md +++ b/windows/client-management/mdm/policy-csp-filesystem.md @@ -1,7 +1,8 @@ --- title: FileSystem Policy CSP description: Learn more about the FileSystem Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index d16bea4048..42f5209042 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -1,7 +1,8 @@ --- title: Games Policy CSP description: Learn more about the Games Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 6cd40803bd..2dc76390b0 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -1,7 +1,8 @@ --- title: Handwriting Policy CSP description: Learn more about the Handwriting Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 3ef891ed68..38c80beebe 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -1,7 +1,8 @@ --- title: HumanPresence Policy CSP description: Learn more about the HumanPresence Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -21,7 +22,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -85,7 +86,7 @@ Determines whether Allow Adaptive Dimming When Battery Saver On checkbox is forc | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -149,7 +150,7 @@ Determines whether Allow Lock on Leave When Battery Saver On checkbox is forced | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -213,7 +214,7 @@ Determines whether Allow Wake on Approach When External Display Connected checkb | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -528,6 +529,183 @@ Determines the timeout for Lock on Leave forced by the MDM policy. The user will + +## ForcePrivacyScreen + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForcePrivacyScreen +``` + + + + +Determines whether detect when other people are looking at my screen is forced on/off by the MDM policy. The user won't be able to change this setting and the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedOff. | +| 1 | ForcedOn. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForcePrivacyScreen | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForcePrivacyScreenDim + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForcePrivacyScreenDim +``` + + + + +Determines whether dim the screen when other people are looking at my screen checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForcePrivacyScreenDim | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForcePrivacyScreenNotification + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForcePrivacyScreenNotification +``` + + + + +Determines whether providing alert when people are looking at my screen checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForcePrivacyScreenNotification | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 5e218fe45c..c10d0663c7 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,7 +1,8 @@ --- title: InternetExplorer Policy CSP description: Learn more about the InternetExplorer Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1005,7 +1006,12 @@ Note. It's recommended to configure template policy settings in one Group Policy - + +This policy setting allows the use of some disabled functionality, such as WorkingDirectory field or pluggable protocol handling, in Internet Shortcut files. + +If you enable this policy, disabled functionality for Internet Shortcut files will be re-enabled. + +If you disable, or don't configure this policy, some functionality for Internet Shortcut files, such as WorkingDirectory field or pluggable protocol handling, will be disabled. @@ -1022,7 +1028,6 @@ Note. It's recommended to configure template policy settings in one Group Policy - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -1030,6 +1035,11 @@ Note. It's recommended to configure template policy settings in one Group Policy | Name | Value | |:--|:--| | Name | AllowLegacyURLFields | +| Friendly Name | Allow legacy functionality for Internet Shortcut files | +| Location | Computer and User Configuration | +| Path | Windows Components > Internet Explorer | +| Registry Key Name | Software\Policies\Microsoft\Internet Explorer\Main | +| Registry Value Name | AllowLegacyURLFields | | ADMX File Name | inetres.admx | @@ -2463,11 +2473,11 @@ This policy setting determines whether Internet Explorer requires that all file- -This setting determines whether IE automatically downloads updated versions of Microsoft's VersionList. XML. IE uses this file to determine whether an ActiveX control should be stopped from loading. +This setting determines whether IE automatically downloads updated versions of Microsoft's VersionList.XML. IE uses this file to determine whether an ActiveX control should be stopped from loading. -- If you enable this setting, IE stops downloading updated versions of VersionList. XML. Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. +- If you enable this setting, IE stops downloading updated versions of VersionList.XML. Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. -- If you disable or don't configure this setting, IE continues to download updated versions of VersionList. XML. +- If you disable or don't configure this setting, IE continues to download updated versions of VersionList.XML. For more information, see "Out-of-date ActiveX control blocking" in the Internet Explorer TechNet library. @@ -4420,7 +4430,7 @@ This policy setting allows you to manage a list of domains on which Internet Exp - If you enable this policy setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in Internet Explorer. Each domain entry must be formatted like one of the following: -1. "domain.name. TLD". For example, if you want to include *.contoso.com/*, use "contoso.com" +1. "domain.name.TLD". For example, if you want to include *.contoso.com/*, use "contoso.com" 2. "hostname". For example, if you want to include https://example, use "example". 3. "file:///path/filename.htm". For example, use "file:///C:/Users/contoso/Desktop/index.htm". @@ -5263,7 +5273,7 @@ This policy setting allows you to manage the loading of Extensible Application M -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -6816,7 +6826,7 @@ This policy setting allows you to manage the opening of windows and frames and a -This policy setting allows you to manage whether . NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. @@ -7328,7 +7338,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -7923,13 +7933,11 @@ This policy setting allows you to manage the opening of windows and frames and a -This policy setting specifies whether JScript or JScript9Legacy is loaded for MSHTML/WebOC/MSXML/Cscript based invocations. +This policy setting specifies whether JScript or JScript9Legacy is loaded. -- If you enable this policy setting, JScript9Legacy will be loaded in situations where JScript is instantiated. +- If you enable this policy setting or not configured, JScript9Legacy will be loaded in situations where JScript is instantiated. - If you disable this policy, then JScript will be utilized. - -- If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript. @@ -7953,7 +7961,7 @@ This policy setting specifies whether JScript or JScript9Legacy is loaded for MS | Name | Value | |:--|:--| | Name | JScriptReplacement | -| Friendly Name | Replace JScript by loading JScript9Legacy in place of JScript via MSHTML/WebOC. | +| Friendly Name | Replace JScript by loading JScript9Legacy in place of JScript. | | Location | Computer and User Configuration | | Path | Windows Components > Internet Explorer | | Registry Key Name | Software\Policies\Microsoft\Internet Explorer\Main | @@ -8403,7 +8411,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -9318,7 +9326,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -10167,7 +10175,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -10876,7 +10884,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -11655,7 +11663,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -12434,7 +12442,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -13366,7 +13374,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T | Name | Value | |:--|:--| | Name | VerMgmtDisableRunThisTime | -| Friendly Name | Remove "Run this time" button for outdated ActiveX controls in Internet Explorer | +| Friendly Name | Remove "Run this time" button for outdated ActiveX controls in Internet Explorer | | Location | Computer and User Configuration | | Path | Windows Components > Internet Explorer > Security Features > Add-on Management | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Ext | @@ -13407,7 +13415,7 @@ If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode If you disable, or don't configure this policy, the zoom of an HTML dialog in Internet Explorer mode will be set based on the zoom of it's parent page. -For more information, see +For more information, see @@ -14300,7 +14308,7 @@ This policy setting allows you to manage whether a user's browser can be redirec -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. @@ -15855,7 +15863,7 @@ If you selected Prompt in the drop-down box, users are asked to choose whether t -This policy setting allows you to manage whether . NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. @@ -16465,7 +16473,7 @@ Also, see the "Security zones: Don't allow users to change policies" policy. | Name | Value | |:--|:--| | Name | Security_HKLM_only | -| Friendly Name | Security Zones: Use only machine settings | +| Friendly Name | Security Zones: Use only machine settings | | Location | Computer Configuration | | Path | Windows Components > Internet Explorer | | Registry Key Name | Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings | @@ -16974,7 +16982,7 @@ This policy setting allows you to manage whether Web sites from less privileged -This policy setting allows you to manage whether . NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. +This policy setting allows you to manage whether .NET Framework components that aren't signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. - If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 092f0fcfa3..acc05b4bdf 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,7 +1,8 @@ --- title: Kerberos Policy CSP description: Learn more about the Kerberos Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index ab923304b0..061ecffdfa 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -1,7 +1,8 @@ --- title: KioskBrowser Policy CSP description: Learn more about the KioskBrowser Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index b3e44fe44d..69d9d6d17c 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -1,7 +1,8 @@ --- title: LanmanWorkstation Policy CSP description: Learn more about the LanmanWorkstation Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -36,6 +37,8 @@ This policy setting determines if the SMB client will allow insecure guest logon - If you disable this policy setting, the SMB client will reject insecure guest logons. +If you enable signing, the SMB client will reject insecure guest logons. + Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. While uncommon in an enterprise environment, insecure guest logons are frequently used by consumer Network Attached Storage (NAS) appliances acting as file servers. Windows file servers require authentication and don't use insecure guest logons by default. Since insecure guest logons are unauthenticated, important security features such as SMB Signing and SMB Encryption are disabled. As a result, clients that allow insecure guest logons are vulnerable to a variety of man-in-the-middle attacks that can result in data loss, data corruption, and exposure to malware. Additionally, any data written to a file server using an insecure guest logon is potentially accessible to anyone on the network. Microsoft recommends disabling insecure guest logons and configuring file servers to require authenticated access". diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 69f8d74490..b57d3f7614 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -1,7 +1,8 @@ --- title: Licensing Policy CSP description: Learn more about the Licensing Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 8caa34c334..9ce6bd86df 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,7 +1,8 @@ --- title: LocalPoliciesSecurityOptions Policy CSP description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -360,7 +361,7 @@ Accounts: Rename guest account This security setting determines whether a differ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -388,10 +389,27 @@ Audit: Audit the use of Backup and Restore privilege This security setting deter |:--|:--| | Format | `b64` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: ``) | -| Default Value | 00 | +| Default Value | AA== | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| AQ== | Enable. | +| AA== (Default) | Disable. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Audit: Audit the use of Backup and Restore privilege | +| Path | Windows Settings > Security Settings > Local Policies > Security Options | + + @@ -404,7 +422,7 @@ Audit: Audit the use of Backup and Restore privilege This security setting deter | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -445,7 +463,7 @@ Audit: Force audit policy subcategory settings (Windows Vista or later) to overr | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -718,7 +736,7 @@ Devices: Restrict CD-ROM access to locally logged-on user only This security set | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -771,7 +789,7 @@ Devices: Restrict floppy access to locally logged-on user only This security set | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -825,7 +843,7 @@ Domain member: Digitally encrypt or sign secure channel data (always) This secur | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -878,7 +896,7 @@ Domain member: Digitally encrypt secure channel data (when possible) This securi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -928,7 +946,7 @@ Domain member: Digitally sign secure channel data (when possible) This security | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -982,7 +1000,7 @@ Domain member: Disable machine account password changes Determines whether a dom | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1035,7 +1053,7 @@ Domain member: Maximum machine account password age This security setting determ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1335,7 +1353,7 @@ Interactive logon: Don't require CTRL+ALT+DEL This security setting determines w | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1454,6 +1472,8 @@ Interactive logon: Message text for users attempting to log on This security set +> [!IMPORTANT] +> Windows Autopilot pre-provisioning doesn't work when this policy setting is enabled. For more information, see [Windows Autopilot troubleshooting FAQ](/autopilot/troubleshooting-faq#troubleshooting-policy-conflicts-with-windows-autopilot). @@ -1503,6 +1523,8 @@ Interactive logon: Message title for users attempting to log on This security se +> [!IMPORTANT] +> Windows Autopilot pre-provisioning doesn't work when this policy setting is enabled. For more information, see [Windows Autopilot troubleshooting FAQ](/autopilot/troubleshooting-faq#troubleshooting-policy-conflicts-with-windows-autopilot). @@ -1551,6 +1573,8 @@ Interactive logon: Number of previous logons to cache (in case domain controller +> [!NOTE] +> This setting previously showed as applicable to Windows 11, version 24H2 [10.0.26100] and later in error. MDM solutions may show as applicable to that version until a future release. @@ -1575,7 +1599,7 @@ Interactive logon: Number of previous logons to cache (in case domain controller | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1864,7 +1888,7 @@ Microsoft network client: Send unencrypted password to connect to third-party SM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2047,7 +2071,7 @@ Microsoft network server: Digitally sign communications (if client agrees) This | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2090,7 +2114,7 @@ Microsoft network server: Disconnect clients when logon hours expire This securi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2131,7 +2155,7 @@ Microsoft network server: Server SPN target name validation level This policy se | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2312,7 +2336,7 @@ Network access: Don't allow anonymous enumeration of SAM accounts and shares Thi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2360,7 +2384,7 @@ Network access: Don't allow storage of passwords and credentials for network aut | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2412,7 +2436,7 @@ Network access: Let Everyone permissions apply to anonymous users This security | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2452,7 +2476,7 @@ Network access: Named pipes that can be accessed anonymously This security setti | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2495,7 +2519,7 @@ Network access: Remotely accessible registry paths This security setting determi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2644,7 +2668,7 @@ Network access: Restrict clients allowed to make remote calls to SAM This policy | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2684,7 +2708,7 @@ Network access: Shares that can be accessed anonymously This security setting de | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2728,7 +2752,7 @@ Network access: Sharing and security model for local accounts This security sett | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2958,7 +2982,7 @@ Network security: Don't store LAN Manager hash value on next password change Thi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3083,7 +3107,7 @@ Network security LAN Manager authentication level This security setting determin | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3489,7 +3513,7 @@ Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers This po | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3539,7 +3563,7 @@ Recovery console: Allow automatic administrative logon This security setting det | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3696,7 +3720,7 @@ Shutdown: Clear virtual memory pagefile This security setting determines whether | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3737,7 +3761,7 @@ System Cryptography: Force strong key protection for user keys stored on the com | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -3787,7 +3811,7 @@ System objects: Require case insensitivity for non-Windows subsystems This secur | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index 08570e074e..da2922a942 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -1,7 +1,8 @@ --- title: LocalUsersAndGroups Policy CSP description: Learn more about the LocalUsersAndGroups Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index 95f4c33c50..11299e781b 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -1,7 +1,8 @@ --- title: LockDown Policy CSP description: Learn more about the LockDown Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-lsa.md b/windows/client-management/mdm/policy-csp-lsa.md index d4773d4c5d..9338d13c66 100644 --- a/windows/client-management/mdm/policy-csp-lsa.md +++ b/windows/client-management/mdm/policy-csp-lsa.md @@ -1,7 +1,8 @@ --- title: LocalSecurityAuthority Policy CSP description: Learn more about the LocalSecurityAuthority Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -93,7 +94,7 @@ This policy controls the configuration under which LSASS loads custom SSPs and A This policy controls the configuration under which LSASS is run. -- If you don't configure this policy and there is no current setting in the registry, LSA will run as protected process for clean installed, HVCI capable, client SKUs that are domain or cloud domain joined devices. This configuration isn't UEFI locked. This can be overridden if the policy is configured. +- If you don't configure this policy and there is no current setting in the registry, LSA will run as protected process for all clean installed, HVCI capable, client SKUs. This configuration isn't UEFI locked. This can be overridden if the policy is configured. - If you configure and set this policy setting to "Disabled", LSA won't run as a protected process. @@ -135,7 +136,7 @@ This policy controls the configuration under which LSASS is run. | Friendly Name | Configures LSASS to run as a protected process | | Location | Computer Configuration | | Path | System > Local Security Authority | -| Registry Key Name | System\CurrentControlSet\Control\Lsa | +| Registry Key Name | Software\Policies\Microsoft\Windows\System | | ADMX File Name | LocalSecurityAuthority.admx | diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 7dc52aed91..0148a014f0 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -1,7 +1,8 @@ --- title: Maps Policy CSP description: Learn more about the Maps Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-memorydump.md b/windows/client-management/mdm/policy-csp-memorydump.md index d6550053a3..ae3cea44fd 100644 --- a/windows/client-management/mdm/policy-csp-memorydump.md +++ b/windows/client-management/mdm/policy-csp-memorydump.md @@ -1,7 +1,8 @@ --- title: MemoryDump Policy CSP description: Learn more about the MemoryDump Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index 30117ff84d..bdb2fb5e55 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -1,7 +1,8 @@ --- title: Messaging Policy CSP description: Learn more about the Messaging Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index d2ccb8d7eb..ace4441d82 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -1,7 +1,8 @@ --- title: MixedReality Policy CSP description: Learn more about the MixedReality Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -139,7 +140,7 @@ This opt-in policy can help with the setup of new devices in new areas or new us -By default, launching applications via Launcher API (Launcher Class (Windows. System) - Windows UWP applications | Microsoft Docs) is disabled in single app kiosk mode. To enable applications to launch in single app kiosk mode on HoloLens devices, set the policy value to true. +By default, launching applications via Launcher API is disabled in single app kiosk mode. To enable applications to launch in single app kiosk mode on HoloLens devices, set the policy value to true. diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index da47e000cd..988bfdc000 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,7 +1,8 @@ --- title: MSSecurityGuide Policy CSP description: Learn more about the MSSecurityGuide Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -11,8 +12,6 @@ ms.date: 01/31/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -223,7 +222,7 @@ ms.date: 01/31/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 6e60b0d9dd..ad3748f44a 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,7 +1,8 @@ --- title: MSSLegacy Policy CSP description: Learn more about the MSSLegacy Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index 84df0472de..06d1458a87 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -1,7 +1,8 @@ --- title: Multitasking Policy CSP description: Learn more about the Multitasking Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 14633df6c8..6ec838f5ad 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -1,7 +1,8 @@ --- title: NetworkIsolation Policy CSP description: Learn more about the NetworkIsolation Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index 5864c486c1..71e78973a4 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -1,7 +1,8 @@ --- title: NetworkListManager Policy CSP description: Learn more about the NetworkListManager Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 08/06/2024 # Policy CSP - NetworkListManager -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -21,7 +20,7 @@ ms.date: 08/06/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -70,7 +69,7 @@ This policy setting allows you to specify whether users can change the network i | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -119,7 +118,7 @@ This policy setting allows you to specify whether users can change the network l | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -262,7 +261,7 @@ This policy setting provides the string that names a network. If this setting is | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -311,7 +310,7 @@ This policy setting allows you to configure the Network Location for networks th | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -360,7 +359,7 @@ This policy setting allows you to configure the Network Location type for networ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ❌ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-newsandinterests.md b/windows/client-management/mdm/policy-csp-newsandinterests.md index 16fabdc822..fe79c499b0 100644 --- a/windows/client-management/mdm/policy-csp-newsandinterests.md +++ b/windows/client-management/mdm/policy-csp-newsandinterests.md @@ -1,7 +1,8 @@ --- title: NewsAndInterests Policy CSP description: Learn more about the NewsAndInterests Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,6 +10,8 @@ ms.date: 01/18/2024 # Policy CSP - NewsAndInterests +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -82,6 +85,122 @@ This policy applies to the entire widgets experience, including content on the t + +## DisableWidgetsBoard + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NewsAndInterests/DisableWidgetsBoard +``` + + + + +Disable widgets board. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enabled. | +| 1 | Disabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableWidgetsBoard | +| Path | NewsAndInterests > AT > WindowsComponents > NewsAndInterests | + + + + + + + + + +## DisableWidgetsOnLockScreen + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NewsAndInterests/DisableWidgetsOnLockScreen +``` + + + + +Disable widgets on lock screen. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enabled. | +| 1 | Disabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableWidgetsOnLockScreen | +| Path | NewsAndInterests > AT > WindowsComponents > NewsAndInterests | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 65d5cb42bc..30942a896d 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -1,7 +1,8 @@ --- title: Notifications Policy CSP description: Learn more about the Notifications Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 01/18/2024 # Policy CSP - Notifications -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -21,7 +20,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 165845af43..8e6e557bb7 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1,7 +1,8 @@ --- title: Power Policy CSP description: Learn more about the Power Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index fa423988bf..cb984a7530 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -1,7 +1,8 @@ --- title: Printers Policy CSP description: Learn more about the Printers Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -11,6 +12,8 @@ ms.date: 01/31/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -348,6 +351,56 @@ The following are the supported values: + +## ConfigureIppTlsCertificatePolicy + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureIppTlsCertificatePolicy +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureIppTlsCertificatePolicy | +| ADMX File Name | Printing.admx | + + + + + + + + ## ConfigureRedirectionGuardPolicy @@ -369,7 +422,7 @@ Determines whether Redirection Guard is enabled for the print spooler. You can enable this setting to configure the Redirection Guard policy being applied to spooler. -- If you disable or don't configure this policy setting, Redirection Guard will default to being 'enabled'. +- If you disable or don't configure this policy setting, Redirection Guard will default to being 'Enabled'. - If you enable this setting you may select the following options: @@ -435,7 +488,12 @@ The following are the supported values: - + +This policy setting controls whether packet level privacy is enabled for RPC for incoming connections. + +By default packet level privacy is enabled for RPC for incoming connections. + +If you enable or don't configure this policy setting, packet level privacy is enabled for RPC for incoming connections. @@ -452,7 +510,6 @@ The following are the supported values: - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -460,6 +517,11 @@ The following are the supported values: | Name | Value | |:--|:--| | Name | ConfigureRpcAuthnLevelPrivacyEnabled | +| Friendly Name | Configure RPC packet level privacy setting for incoming connections | +| Location | Computer Configuration | +| Path | Printers | +| Registry Key Name | System\CurrentControlSet\Control\Print | +| Registry Value Name | RpcAuthnLevelPrivacyEnabled | | ADMX File Name | Printing.admx | @@ -685,7 +747,16 @@ If you disable or don't configure this policy setting, dynamic TCP ports are use - + +Determines whether Windows protected print is enabled on this computer. + +By default, Windows protected print isn't enabled and there aren't any restrictions on the print drivers that can be installed or print functionality. + +- If you enable this setting, the computer will operate in Windows protected print mode which only allows printing to printers that support a subset of inbox Windows print drivers. + +- If you disable this setting or don't configure it, there aren't any restrictions on the print drivers that can be installed or print functionality. + +For more information, please see [insert link to web page with WPP info] @@ -702,7 +773,6 @@ If you disable or don't configure this policy setting, dynamic TCP ports are use - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -710,6 +780,11 @@ If you disable or don't configure this policy setting, dynamic TCP ports are use | Name | Value | |:--|:--| | Name | ConfigureWindowsProtectedPrint | +| Friendly Name | Configure Windows protected print | +| Location | Computer Configuration | +| Path | Printers | +| Registry Key Name | Software\Policies\Microsoft\Windows NT\Printers\WPP | +| Registry Value Name | WindowsProtectedPrintGroupPolicyState | | ADMX File Name | Printing.admx | diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 895ee8c286..6ef4648bc0 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,7 +1,8 @@ --- title: Privacy Policy CSP description: Learn more about the Privacy Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -2398,207 +2399,6 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - -## LetAppsAccessGenerativeAI - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI -``` - - - - -This policy setting specifies whether Windows apps can use generative AI features of Windows. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `int` | -| Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-2]` | -| Default Value | 0 | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | LetAppsAccessGenerativeAI | -| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | -| Element Name | LetAppsAccessGenerativeAI_Enum | - - - - - - - - - -## LetAppsAccessGenerativeAI_ForceAllowTheseApps - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI_ForceAllowTheseApps -``` - - - - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to use generative AI features of Windows. This setting overrides the default LetAppsAccessGenerativeAI policy setting for the specified apps. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `chr` (string) | -| Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `;`) | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | LetAppsAccessGenerativeAI | -| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | -| Element Name | LetAppsAccessGenerativeAI_ForceAllowTheseApps_List | - - - - - - - - - -## LetAppsAccessGenerativeAI_ForceDenyTheseApps - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI_ForceDenyTheseApps -``` - - - - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the use generative AI features of Windows. This setting overrides the default LetAppsAccessGenerativeAI policy setting for the specified apps. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `chr` (string) | -| Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `;`) | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | LetAppsAccessGenerativeAI | -| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | -| Element Name | LetAppsAccessGenerativeAI_ForceDenyTheseApps_List | - - - - - - - - - -## LetAppsAccessGenerativeAI_UserInControlOfTheseApps - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI_UserInControlOfTheseApps -``` - - - - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the generative AI setting for the listed apps. This setting overrides the default LetAppsAccessGenerativeAI policy setting for the specified apps. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `chr` (string) | -| Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `;`) | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | LetAppsAccessGenerativeAI | -| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | -| Element Name | LetAppsAccessGenerativeAI_UserInControlOfTheseApps_List | - - - - - - - - ## LetAppsAccessGraphicsCaptureProgrammatic diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 1e190204ac..7e150cadbe 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -1,7 +1,8 @@ --- title: RemoteAssistance Policy CSP description: Learn more about the RemoteAssistance Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index f549cfc712..b6a52d4ce2 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -1,7 +1,8 @@ --- title: RemoteDesktop Policy CSP description: Learn more about the RemoteDesktop Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 68895bc0f7..6075c67e97 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,7 +1,8 @@ --- title: RemoteDesktopServices Policy CSP description: Learn more about the RemoteDesktopServices Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -156,7 +157,7 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2461] and later
    ✅ [10.0.25398.887] and later
    ✅ Windows 10, version 2004 [10.0.19041.4474] and later
    ✅ Windows 11, version 21H2 with [KB5037770](https://support.microsoft.com/help/5037770) [10.0.22000.2960] and later
    ✅ Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) [10.0.22621.3593] and later
    ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -166,7 +167,14 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp - + +This policy setting allows you to configure the user experience when the Remote Desktop session is locked by the user or by a policy. You can specify whether the remote session will show the remote lock screen or disconnect when the remote session is locked. Disconnecting the remote session ensures that a remote session can't be left on the lock screen and can't reconnect automatically due to loss of network connectivity. + +This policy applies only when using legacy authentication to authenticate to the remote PC. Legacy authentication is limited to username and password, or certificates like smartcards. Legacy authentication doesn't leverage the Microsoft identity platform, such as Microsoft Entra ID. Legacy authentication includes the NTLM, CredSSP, RDSTLS, TLS, and RDP basic authentication protocols. + +- If you enable this policy setting, Remote Desktop connections using legacy authentication will disconnect the remote session when the remote session is locked. Users can reconnect when they're ready and re-enter their credentials when prompted. + +- If you disable or don't configure this policy setting, Remote Desktop connections using legacy authentication will show the remote lock screen when the remote session is locked. Users can unlock the remote session using their username and password, or certificates. @@ -183,7 +191,6 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -191,7 +198,12 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp | Name | Value | |:--|:--| | Name | TS_DISCONNECT_ON_LOCK_POLICY | -| ADMX File Name | terminalserver.admx | +| Friendly Name | Disconnect remote session on lock for legacy authentication | +| Location | Computer Configuration | +| Path | Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services | +| Registry Value Name | fDisconnectOnLockLegacy | +| ADMX File Name | TerminalServer.admx | @@ -206,7 +218,7 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2461] and later
    ✅ [10.0.25398.887] and later
    ✅ Windows 10, version 2004 [10.0.19041.4474] and later
    ✅ Windows 11, version 21H2 with [KB5037770](https://support.microsoft.com/help/5037770) [10.0.22000.2960] and later
    ✅ Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) [10.0.22621.3593] and later
    ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -216,7 +228,14 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp - + +This policy setting allows you to configure the user experience when the Remote Desktop session is locked by the user or by a policy. You can specify whether the remote session will show the remote lock screen or disconnect when the remote session is locked. Disconnecting the remote session ensures that a remote session can't be left on the lock screen and can't reconnect automatically due to loss of network connectivity. + +This policy applies only when using an identity provider that uses the Microsoft identity platform, such as Microsoft Entra ID, to authenticate to the remote PC. This policy doesn't apply when using Legacy authentication which includes the NTLM, CredSSP, RDSTLS, TLS, and RDP basic authentication protocols. + +- If you enable or don't configure this policy setting, Remote Desktop connections using the Microsoft identity platform will disconnect the remote session when the remote session is locked. Users can reconnect when they're ready and can use passwordless authentication if configured. + +- If you disable this policy setting, Remote Desktop connections using the Microsoft identity platform will show the remote lock screen when the remote session is locked. Users can unlock the remote session using their username and password, or certificates. @@ -233,7 +252,6 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -241,7 +259,12 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp | Name | Value | |:--|:--| | Name | TS_DISCONNECT_ON_LOCK_AAD_POLICY | -| ADMX File Name | terminalserver.admx | +| Friendly Name | Disconnect remote session on lock for Microsoft identity platform authentication | +| Location | Computer Configuration | +| Path | Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services | +| Registry Value Name | fDisconnectOnLockMicrosoftIdentity | +| ADMX File Name | TerminalServer.admx | @@ -439,7 +462,7 @@ By default, Remote Desktop allows redirection of WebAuthn requests. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2523] and later
    ✅ [10.0.25398.946] and later
    ✅ Windows 11, version 21H2 [10.0.22000.3014] and later
    ✅ Windows 11, version 22H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22621.3672] and later
    ✅ Windows 11, version 23H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22631.3672] and later
    ✅ Windows Insider Preview | +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2523] and later
    ✅ [10.0.25398.946] and later
    ✅ Windows 11, version 21H2 [10.0.22000.3014] and later
    ✅ Windows 11, version 22H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22621.3672] and later
    ✅ Windows 11, version 23H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22631.3672] and later
    ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -453,7 +476,25 @@ By default, Remote Desktop allows redirection of WebAuthn requests. - + +This policy setting allows you to restrict clipboard data transfers from client to server. + +- If you enable this policy setting, you must choose from the following behaviors: + +- Disable clipboard transfers from client to server. + +- Allow plain text copying from client to server. + +- Allow plain text and images copying from client to server. + +- Allow plain text, images and Rich Text Format copying from client to server. + +- Allow plain text, images, Rich Text Format and HTML copying from client to server. + +- If you disable or don't configure this policy setting, users can copy arbitrary contents from client to server if clipboard redirection is enabled. + +> [!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the stricter restriction will be used. @@ -470,7 +511,6 @@ By default, Remote Desktop allows redirection of WebAuthn requests. - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -478,7 +518,11 @@ By default, Remote Desktop allows redirection of WebAuthn requests. | Name | Value | |:--|:--| | Name | TS_CLIENT_CLIPBOARDRESTRICTION_CS | -| ADMX File Name | terminalserver.admx | +| Friendly Name | Restrict clipboard transfer from client to server | +| Location | Computer and User Configuration | +| Path | Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services | +| ADMX File Name | TerminalServer.admx | @@ -493,7 +537,7 @@ By default, Remote Desktop allows redirection of WebAuthn requests. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2523] and later
    ✅ [10.0.25398.946] and later
    ✅ Windows 11, version 21H2 [10.0.22000.3014] and later
    ✅ Windows 11, version 22H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22621.3672] and later
    ✅ Windows 11, version 23H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22631.3672] and later
    ✅ Windows Insider Preview | +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2523] and later
    ✅ [10.0.25398.946] and later
    ✅ Windows 11, version 21H2 [10.0.22000.3014] and later
    ✅ Windows 11, version 22H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22621.3672] and later
    ✅ Windows 11, version 23H2 with [KB5037853](https://support.microsoft.com/help/5037853) [10.0.22631.3672] and later
    ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -507,7 +551,25 @@ By default, Remote Desktop allows redirection of WebAuthn requests. - + +This policy setting allows you to restrict clipboard data transfers from server to client. + +- If you enable this policy setting, you must choose from the following behaviors: + +- Disable clipboard transfers from server to client. + +- Allow plain text copying from server to client. + +- Allow plain text and images copying from server to client. + +- Allow plain text, images and Rich Text Format copying from server to client. + +- Allow plain text, images, Rich Text Format and HTML copying from server to client. + +- If you disable or don't configure this policy setting, users can copy arbitrary contents from server to client if clipboard redirection is enabled. + +> [!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the stricter restriction will be used. @@ -524,7 +586,6 @@ By default, Remote Desktop allows redirection of WebAuthn requests. - [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] **ADMX mapping**: @@ -532,7 +593,11 @@ By default, Remote Desktop allows redirection of WebAuthn requests. | Name | Value | |:--|:--| | Name | TS_CLIENT_CLIPBOARDRESTRICTION_SC | -| ADMX File Name | terminalserver.admx | +| Friendly Name | Restrict clipboard transfer from server to client | +| Location | Computer and User Configuration | +| Path | Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services | +| ADMX File Name | TerminalServer.admx | diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 0f19f54970..cd2bb62790 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -1,7 +1,8 @@ --- title: RemoteManagement Policy CSP description: Learn more about the RemoteManagement Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -285,7 +286,7 @@ For example, if you want the service to listen only on IPv4 addresses, leave the Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter. Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22 -Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562. +Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index 1def7d700f..891a76c576 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -1,7 +1,8 @@ --- title: RemoteProcedureCall Policy CSP description: Learn more about the RemoteProcedureCall Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -105,11 +106,11 @@ This policy setting impacts all RPC applications. In a domain environment this p This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they're making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) can't process authentication information supplied in this manner. -- If you disable this policy setting, RPC clients won't authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Endpoint Mapper Service on Windows NT4 Server. +- If you disable this policy setting, RPC clients won't authenticate to the Endpoint Mapper Service, but they'll be able to communicate with the Endpoint Mapper Service on Windows NT4 Server. - If you enable this policy setting, RPC clients will authenticate to the Endpoint Mapper Service for calls that contain authentication information. Clients making such calls won't be able to communicate with the Windows NT4 Server Endpoint Mapper Service. -- If you don't configure this policy setting, it remains disabled. RPC clients won't authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Windows NT4 Server Endpoint Mapper Service. +- If you don't configure this policy setting, it remains disabled. RPC clients won't authenticate to the Endpoint Mapper Service, but they'll be able to communicate with the Windows NT4 Server Endpoint Mapper Service. > [!NOTE] > This policy won't be applied until the system is rebooted. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index e7c0d076a7..e8ec5c3a48 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -1,7 +1,8 @@ --- title: RemoteShell Policy CSP description: Learn more about the RemoteShell Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 6c8af25f6a..330359312f 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -1,7 +1,8 @@ --- title: RestrictedGroups Policy CSP description: Learn more about the RestrictedGroups Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 005ef18357..a0c7802840 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,7 +1,8 @@ --- title: Search Policy CSP description: Learn more about the Search Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 08/06/2024 # Policy CSP - Search -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -648,7 +647,7 @@ The most restrictive value is `0` to now allow automatic language detection. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -930,13 +929,13 @@ This policy setting configures whether or not locations on removable drives can -This policy setting allows you to control whether or not Search can perform queries on the web, if web results are displayed in Search, and if search highlights are shown in the search box and in search home. +This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search. -- If you enable this policy setting, queries won't be performed on the web, web results won't be displayed when a user performs a query in Search, and search highlights won't be shown in the search box and in search home. +- If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search. -- If you disable this policy setting, queries will be performed on the web, web results will be displayed when a user performs a query in Search, and search highlights will be shown in the search box and in search home. +- If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search. -- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search, and if search highlights are shown in the search box and in search home. +- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 25e55a8941..a640213a1c 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,7 +1,8 @@ --- title: Security Policy CSP description: Learn more about the Security Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 46c10a8e9a..0b7daa00a9 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -1,7 +1,8 @@ --- title: ServiceControlManager Policy CSP description: Learn more about the ServiceControlManager Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index bf9e5d11f5..89c42f0030 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,7 +1,8 @@ --- title: Settings Policy CSP description: Learn more about the Settings Area in Policy CSP. -ms.date: 05/20/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index 39e032a8b4..9b8ffbd08d 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -1,7 +1,8 @@ --- title: SettingsSync Policy CSP description: Learn more about the SettingsSync Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -23,7 +24,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -84,7 +85,7 @@ If you don't set or disable this setting, syncing of the "accessibility" group i | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -139,6 +140,56 @@ If you don't set or disable this setting, syncing of the "language preferences" + +## EnableWindowsbackup + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/SettingsSync/EnableWindowsbackup +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnableWindowsbackup | +| ADMX File Name | SettingSync.admx | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 6e99e05ccb..6f7fd23280 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -1,7 +1,8 @@ --- title: SmartScreen Policy CSP description: Learn more about the SmartScreen Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -29,20 +30,11 @@ ms.date: 01/31/2024 - -App Install Control is a feature of Windows Defender SmartScreen that helps protect PCs by allowing users to install apps only from the Store. SmartScreen must be enabled for this feature to work properly. + +Allows IT Admins to control whether users are allowed to install apps from places other than the Store. -- If you enable this setting, you must choose from the following behaviors: - -- Turn off app recommendations. - -- Show me app recommendations. - -- Warn me before installing apps from outside the Store. - -- Allow apps from Store only. - -- If you disable or don't configure this setting, users will be able to install apps from anywhere, including files downloaded from the Internet. +> [!NOTE] +> This policy will block installation only while the device is online. To block offline installation too, SmartScreen/PreventOverrideForFilesInShell and SmartScreen/EnableSmartScreenInShell policies should also be enabled. This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet. @@ -110,23 +102,8 @@ App Install Control is a feature of Windows Defender SmartScreen that helps prot - -This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that don't appear to be suspicious. - -Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. - -- If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options: - -- Warn and prevent bypass -- Warn. - -- If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs won't present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app. - -- If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen won't warn the user again for that app if the user tells SmartScreen to run the app. - -- If you disable this policy, SmartScreen will be turned off for all users. Users won't be warned if they try to run suspicious apps from the Internet. - -- If you don't configure this policy, SmartScreen will be enabled by default, but users may change their settings. + +Allows IT Admins to configure SmartScreen for Windows. @@ -188,23 +165,8 @@ Some information is sent to Microsoft about files and programs run on PCs with t - -This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that don't appear to be suspicious. - -Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. - -- If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options: - -- Warn and prevent bypass -- Warn. - -- If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs won't present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app. - -- If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen won't warn the user again for that app if the user tells SmartScreen to run the app. - -- If you disable this policy, SmartScreen will be turned off for all users. Users won't be warned if they try to run suspicious apps from the Internet. - -- If you don't configure this policy, SmartScreen will be enabled by default, but users may change their settings. + +Allows IT Admins to control whether users can ignore SmartScreen warnings and run malicious files. diff --git a/windows/client-management/mdm/policy-csp-speakforme.md b/windows/client-management/mdm/policy-csp-speakforme.md new file mode 100644 index 0000000000..d03ff6ce59 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-speakforme.md @@ -0,0 +1,80 @@ +--- +title: SpeakForMe Policy CSP +description: Learn more about the SpeakForMe Area in Policy CSP. +ms.date: 02/13/2025 +ms.topic: generated-reference +--- + + + + +# Policy CSP - SpeakForMe + + + + + + +## EnableSpeakForMe + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/SpeakForMe/EnableSpeakForMe +``` + + + + +This policy setting controls whether to allow the creation of personal voices with SpeakForMe Accessibility Windows Application. + +- If you enable this policy setting, then user can create their personal voice models. + +- If you disable this policy setting, then user can't create their personal voice models with SpeakForMe. + +- If you don't configure this policy setting (default), then users can launch the training flow and create their personal voice model through SpeakForMe. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 437f917212..7f7060963f 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -1,7 +1,8 @@ --- title: Speech Policy CSP description: Learn more about the Speech Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 418199d466..8b02053b78 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1,7 +1,8 @@ --- title: Start Policy CSP description: Learn more about the Start Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,6 +10,8 @@ ms.date: 08/06/2024 # Policy CSP - Start +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -513,6 +516,63 @@ This policy controls the visibility of the Videos shortcut on the Start menu. Th + +## AlwaysShowNotificationIcon + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/Start/AlwaysShowNotificationIcon +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Auto-hide notification bell icon. | +| 1 | Show notification bell icon. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AlwaysShowNotificationIcon | +| Path | Taskbar > AT > StartMenu | + + + + + + + + ## ConfigureStartPins @@ -2247,6 +2307,63 @@ For more information on how to customize the Start layout, see [Customize the St + +## TurnOffAbbreviatedDateTimeFormat + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/Start/TurnOffAbbreviatedDateTimeFormat +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Show abbreviated time and date format. | +| 1 | Show classic time and date format. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | TurnOffAbbreviatedDateTimeFormat | +| Path | Taskbar > AT > StartMenu | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index 34b5c89385..ce1b8bc8d9 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -1,7 +1,8 @@ --- title: Stickers Policy CSP description: Learn more about the Stickers Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 78f789eba8..ef35797a4d 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1,7 +1,8 @@ --- title: Storage Policy CSP description: Learn more about the Storage Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-sudo.md b/windows/client-management/mdm/policy-csp-sudo.md index 09a4e3c938..eaa5e96654 100644 --- a/windows/client-management/mdm/policy-csp-sudo.md +++ b/windows/client-management/mdm/policy-csp-sudo.md @@ -1,7 +1,8 @@ --- title: Sudo Policy CSP description: Learn more about the Sudo Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 04/10/2024 # Policy CSP - Sudo -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -21,7 +20,7 @@ ms.date: 04/10/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ❌ Pro
    ❌ Enterprise
    ❌ Education
    ❌ Windows SE
    ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -31,7 +30,20 @@ ms.date: 04/10/2024 - + +This policy setting controls use of the sudo.exe command line tool. + +- If you enable this policy setting, then you may set a maximum allowed mode to run sudo in. This restricts the ways in which users may interact with command-line applications run with sudo. You may pick one of the following modes to allow sudo to run in: + +"Disabled": sudo is entirely disabled on this machine. When the user tries to run sudo, sudo will print an error message and exit. + +"Force new window": When sudo launches a command line application, it will launch that app in a new console window. + +"Disable input": When sudo launches a command line application, it will launch the app in the current console window, but the user won't be able to type input to the command line app. The user may also choose to run sudo in "Force new window" mode. + +"Normal": When sudo launches a command line application, it will launch the app in the current console window. The user may also choose to run sudo in "Force new window" or "Disable input" mode. + +- If you disable this policy or don't configure it, the user will be able to run sudo.exe normally (after enabling the setting in the Settings app). @@ -65,7 +77,11 @@ ms.date: 04/10/2024 | Name | Value | |:--|:--| | Name | EnableSudo | -| Path | Sudo > AT > System | +| Friendly Name | Configure the behavior of the sudo command | +| Location | Computer Configuration | +| Path | System | +| Registry Key Name | Software\Policies\Microsoft\Windows\Sudo | +| ADMX File Name | Sudo.admx | diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 57739476b7..98fd8a3ee9 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1,7 +1,8 @@ --- title: System Policy CSP description: Learn more about the System Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -11,8 +12,6 @@ ms.date: 08/06/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -431,7 +430,7 @@ This policy setting determines whether Windows is allowed to download fonts and - If you enable this policy setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. -- If you disable this policy setting, Windows doesn't connect to an online font provider and only enumerates locally installed fonts. +- If you disable this policy setting, Windows doesn't connect to an online font provider and only enumerates locally-installed fonts. - If you don't configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. @@ -569,7 +568,7 @@ Specifies whether to allow app access to the Location service. Most restricted v This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. This policy setting configures a Microsoft Entra joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. For customers who enroll into the Microsoft Managed Desktop service, enabling this policy is required to allow Microsoft to process data for operational and analytic needs. See for more information. -When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. +hen these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. This setting has no effect on devices unless they're properly enrolled in Microsoft Managed Desktop. If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. @@ -888,7 +887,7 @@ To enable this behavior: When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -If you disable or don't configure this policy setting, devices enrolled to Windows Autopatch won't be able to take advantage of some deployment service features. +If you disable or don't configure this policy setting, devices enrolled to the Windows Update for Business deployment service won't be able to take advantage of some deployment service features. @@ -1471,7 +1470,7 @@ This policy setting lets you prevent apps and features from working with files o * Users can't access OneDrive from the OneDrive app and file picker. -* Windows Store apps can't access OneDrive using the WinRT API. +* Packaged Microsoft Store apps can't access OneDrive using the WinRT API. * OneDrive doesn't appear in the navigation pane in File Explorer. @@ -1739,7 +1738,7 @@ This policy setting controls whether Windows records attempts to connect with th -Diagnostic files created when feedback is filed in the Feedback Hub app will always be saved locally. If this policy isn't present or set to false, users will be presented with the option to save locally. The default is to not save locally. +Diagnostic files created when a feedback is filed in the Feedback Hub app will always be saved locally. If this policy isn't present or set to false, users will be presented with the option to save locally. The default is to not save locally. @@ -1761,8 +1760,8 @@ Diagnostic files created when feedback is filed in the Feedback Hub app will alw | Value | Description | |:--|:--| -| 0 (Default) | False. The Feedback Hub won't always save a local copy of diagnostics that may be created when feedback is submitted. The user will have the option to do so. | -| 1 | True. The Feedback Hub should always save a local copy of diagnostics that may be created when feedback is submitted. | +| 0 (Default) | False. The Feedback Hub won't always save a local copy of diagnostics that may be created when a feedback is submitted. The user will have the option to do so. | +| 1 | True. The Feedback Hub should always save a local copy of diagnostics that may be created when a feedback is submitted. | @@ -1777,7 +1776,7 @@ Diagnostic files created when feedback is filed in the Feedback Hub app will alw | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 2d9c9595f5..028d0720fb 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,7 +1,8 @@ --- title: SystemServices Policy CSP description: Learn more about the SystemServices Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 04/10/2024 # Policy CSP - SystemServices -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -21,7 +20,7 @@ ms.date: 04/10/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -171,7 +170,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -221,7 +220,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -271,7 +270,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -321,7 +320,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -371,7 +370,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -421,7 +420,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -471,7 +470,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -521,7 +520,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -571,7 +570,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -621,7 +620,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -671,7 +670,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -721,7 +720,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -771,7 +770,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -821,7 +820,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -871,7 +870,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 439cfdb8d3..0de2582caa 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,7 +1,8 @@ --- title: TaskManager Policy CSP description: Learn more about the TaskManager Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index bfe95ab006..d8eae077b9 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,7 +1,8 @@ --- title: TaskScheduler Policy CSP description: Learn more about the TaskScheduler Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md index 6c9181ab8c..00a0d03419 100644 --- a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md +++ b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md @@ -1,7 +1,8 @@ --- title: TenantDefinedTelemetry Policy CSP description: Learn more about the TenantDefinedTelemetry Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md index 484f4c88ad..92aabbaa29 100644 --- a/windows/client-management/mdm/policy-csp-tenantrestrictions.md +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -1,7 +1,8 @@ --- title: TenantRestrictions Policy CSP description: Learn more about the TenantRestrictions Area in Policy CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -41,9 +42,9 @@ When you enable this setting, compliant applications will be prevented from acce -Before enabling firewall protection, ensure that a Windows Defender Application Control (WDAC) policy that correctly tags applications has been applied to the target devices. Enabling firewall protection without a corresponding WDAC policy will prevent all applications from reaching Microsoft endpoints. This firewall setting isn't supported on all versions of Windows - see the following link for more information. +Before enabling firewall protection, ensure that an App Control for Business policy that correctly tags applications has been applied to the target devices. Enabling firewall protection without a corresponding App Control for Business policy will prevent all applications from reaching Microsoft endpoints. This firewall setting isn't supported on all versions of Windows - see the following link for more information. -For details about setting up WDAC with tenant restrictions, see +For details about setting up App Control with tenant restrictions, see diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 359c78a5c8..aeb348c64d 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,7 +1,8 @@ --- title: TextInput Policy CSP description: Learn more about the TextInput Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,6 +10,8 @@ ms.date: 01/18/2024 # Policy CSP - TextInput +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -1172,6 +1175,56 @@ Specifies the touch keyboard is always docked. When this policy is set to enable + +## TouchKeyboardControllerModeAvailability + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/TextInput/TouchKeyboardControllerModeAvailability +``` + + + + +Specifies whether the controller keyboard mode is enabled or disabled for the touch keyboard. When this policy is set to disabled, the controller keyboard mode for touch keyboard is disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | The OS determines when it's most appropriate to be available. | +| 1 | Controller keyboard is always available. | +| 2 | Controller keyboard is always disabled. | + + + + + + + + ## TouchKeyboardDictationButtonAvailability diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index cfd36f3bb7..46ccf7ac9e 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,7 +1,8 @@ --- title: TimeLanguageSettings Policy CSP description: Learn more about the TimeLanguageSettings Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 4e27dcdaee..9445141187 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,7 +1,8 @@ --- title: Troubleshooting Policy CSP description: Learn more about the Troubleshooting Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 9ecb6a207c..23b1f025ff 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,7 +1,8 @@ --- title: Update Policy CSP description: Learn more about the Update Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,18 +10,12 @@ ms.date: 09/11/2024 # Policy CSP - Update -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - Update CSP policies are listed below based on the group policy area: -- [Windows Insider Preview](#windows-insider-preview) - - [AlwaysAutoRebootAtScheduledTimeMinutes](#alwaysautorebootatscheduledtimeminutes) - - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) - - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update) - [AllowNonMicrosoftSignedUpdate](#allownonmicrosoftsignedupdate) - [AllowOptionalContent](#allowoptionalcontent) @@ -61,7 +56,8 @@ Update CSP policies are listed below based on the group policy area: - [ConfigureDeadlineForQualityUpdates](#configuredeadlineforqualityupdates) - [ConfigureDeadlineGracePeriod](#configuredeadlinegraceperiod) - [ConfigureDeadlineGracePeriodForFeatureUpdates](#configuredeadlinegraceperiodforfeatureupdates) - - [ConfigureDeadlineNoAutoReboot](#configuredeadlinenoautoreboot) + - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) + - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [ConfigureFeatureUpdateUninstallPeriod](#configurefeatureupdateuninstallperiod) - [NoUpdateNotificationsDuringActiveHours](#noupdatenotificationsduringactivehours) - [ScheduledInstallDay](#scheduledinstallday) @@ -76,6 +72,7 @@ Update CSP policies are listed below based on the group policy area: - [SetEDURestart](#setedurestart) - [UpdateNotificationLevel](#updatenotificationlevel) - [Legacy Policies](#legacy-policies) + - [AlwaysAutoRebootAtScheduledTimeMinutes](#alwaysautorebootatscheduledtimeminutes) - [AutoRestartDeadlinePeriodInDays](#autorestartdeadlineperiodindays) - [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](#autorestartdeadlineperiodindaysforfeatureupdates) - [AutoRestartNotificationSchedule](#autorestartnotificationschedule) @@ -99,188 +96,6 @@ Update CSP policies are listed below based on the group policy area: - [ScheduleRestartWarning](#schedulerestartwarning) - [SetAutoRestartNotificationDisable](#setautorestartnotificationdisable) -## Windows Insider Preview - - -### AlwaysAutoRebootAtScheduledTimeMinutes - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Update/AlwaysAutoRebootAtScheduledTimeMinutes -``` - - - - - -- If you enable this policy, a restart timer will always begin immediately after Windows Update installs important updates, instead of first notifying users on the login screen for at least two days. - -The restart timer can be configured to start with any value from 15 to 180 minutes. When the timer runs out, the restart will proceed even if the PC has signed-in users. - -- If you disable or don't configure this policy, Windows Update won't alter its restart behavior. - -If the "No auto-restart with logged-on users for scheduled automatic updates installations" policy is enabled, then this policy has no effect. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `int` | -| Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[15-180]` | -| Default Value | 15 | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | AlwaysAutoRebootAtScheduledTime | -| Friendly Name | Always automatically restart at the scheduled time | -| Element Name | work (minutes) | -| Location | Computer Configuration | -| Path | Windows Components > Windows Update > Manage end user experience | -| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | -| ADMX File Name | WindowsUpdate.admx | - - - - - - - - - -### ConfigureDeadlineNoAutoRebootForFeatureUpdates - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoRebootForFeatureUpdates -``` - - - - -When enabled, devices won't automatically restart outside of active hours until the deadline and grace period have expired for feature updates, even if an update is ready for restart. When disabled, an automatic restart may be attempted outside of active hours after update is ready for restart before the deadline is reached. Takes effect only if Update/ConfigureDeadlineForFeatureUpdates is configured. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `int` | -| Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 (Default) | Disabled. | -| 1 | Enabled. | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | ConfigureDeadlineNoAutoRebootForFeatureUpdates | -| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | -| Element Name | ConfigureDeadlineNoAutoRebootForFeatureUpdates | - - - - - - - - - -### ConfigureDeadlineNoAutoRebootForQualityUpdates - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoRebootForQualityUpdates -``` - - - - -When enabled, devices won't automatically restart outside of active hours until the deadline and grace period have expired for quality updates, even if an update is ready for restart. When disabled, an automatic restart may be attempted outside of active hours after update is ready for restart before the deadline is reached. Takes effect only if Update/ConfigureDeadlineForQualityUpdates is configured. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `int` | -| Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 (Default) | Disabled. | -| 1 | Enabled. | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | ConfigureDeadlineNoAutoRebootForQualityUpdates | -| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | -| Element Name | ConfigureDeadlineNoAutoRebootForQualityUpdates | - - - - - - - - ## Manage updates offered from Windows Update @@ -2518,8 +2333,8 @@ Number of days before feature updates are installed on devices automatically reg | Name | Value | |:--|:--| -| Name | ComplianceDeadline | -| Friendly Name | Specify deadlines for automatic updates and restarts | +| Name | ComplianceDeadlineForFU | +| Friendly Name | Specify deadline for automatic updates and restarts for feature update | | Element Name | Deadline (days) | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | @@ -2578,7 +2393,7 @@ Number of days before quality updates are installed on devices automatically reg | Name | Value | |:--|:--| | Name | ComplianceDeadline | -| Friendly Name | Specify deadlines for automatic updates and restarts | +| Friendly Name | Specify deadline for automatic updates and restarts for quality update | | Element Name | Deadline (days) | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | @@ -2633,7 +2448,7 @@ Minimum number of days from update installation until restarts occur automatical | Name | Value | |:--|:--| | Name | ComplianceDeadline | -| Friendly Name | Specify deadlines for automatic updates and restarts | +| Friendly Name | Specify deadline for automatic updates and restarts for quality update | | Element Name | Grace period (days) | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | @@ -2687,8 +2502,8 @@ Minimum number of days from update installation until restarts occur automatical | Name | Value | |:--|:--| -| Name | ComplianceDeadline | -| Friendly Name | Specify deadlines for automatic updates and restarts | +| Name | ComplianceDeadlineForFU | +| Friendly Name | Specify deadline for automatic updates and restarts for feature update | | Element Name | Grace Period (days) | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | @@ -2702,31 +2517,47 @@ Minimum number of days from update installation until restarts occur automatical - -### ConfigureDeadlineNoAutoReboot + +### ConfigureDeadlineNoAutoRebootForFeatureUpdates - + | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1903 [10.0.18362] and later | - +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | + - + ```Device -./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoReboot +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoRebootForFeatureUpdates ``` - + - - -When enabled, devices won't automatically restart outside of active hours until the deadline and grace period have expired, even if an update is ready for restart. When disabled, an automatic restart may be attempted outside of active hours after update is ready for restart before the deadline is reached. Takes effect only if Update/ConfigureDeadlineForQualityUpdates or Update/ConfigureDeadlineForFeatureUpdates is configured. - + + +This policy lets you specify the number of days before feature updates are installed on devices automatically, and a grace period after which required restarts occur automatically. - +Set deadlines for feature updates and quality updates to meet your compliance goals. Updates will be downloaded and installed as soon as they're offered and automatic restarts will be attempted outside of active hours. Once the deadline has passed, restarts will occur regardless of active hours, and users won't be able to reschedule. If the deadline is set to 0 days, the update will be installed immediately upon offering, but might not finish within the day due to device availability and network connectivity. + +Set a grace period for feature updates to guarantee users a minimum time to manage their restarts once updates are installed. Users will be able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. The grace period might not take effect if users already have more than the number of days set as grace period to manage their restart, based on deadline configurations. + +You can set the device to delay restarting until both the deadline and grace period have expired. + +If you disable or don't configure this policy, devices will get updates and will restart according to the default schedule. + +This policy will override the following policies: + +1. Specify deadline before auto restart for update installation +1. Specify Engaged restart transition and notification schedule for updates. + +1. Always automatically restart at the scheduled time +1. Configure Automatic Updates. + + + - + - + **Description framework properties**: | Property name | Property value | @@ -2734,36 +2565,115 @@ When enabled, devices won't automatically restart outside of active hours until | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 0 | - + - + **Allowed values**: | Value | Description | |:--|:--| | 0 (Default) | Disabled. | | 1 | Enabled. | - + - + **Group policy mapping**: | Name | Value | |:--|:--| -| Name | ComplianceDeadline | -| Friendly Name | Specify deadlines for automatic updates and restarts | +| Name | ComplianceDeadlineForFU | +| Friendly Name | Specify deadline for automatic updates and restarts for feature update | | Element Name | Don't auto-restart until end of grace period. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | | ADMX File Name | WindowsUpdate.admx | - + - + - + - + + + +### ConfigureDeadlineNoAutoRebootForQualityUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoRebootForQualityUpdates +``` + + + + +This policy lets you specify the number of days before quality updates are installed on devices automatically, and a grace period after which required restarts occur automatically. + +Set deadlines for quality updates to meet your compliance goals. Updates will be downloaded and installed as soon as they're offered and automatic restarts will be attempted outside of active hours. Once the deadline has passed, restarts will occur regardless of active hours, and users won't be able to reschedule. If the deadline is set to 0 days, the update will be installed immediately upon offering, but might not finish within the day due to device availability and network connectivity. + +Set a grace period for quality updates to guarantee users a minimum time to manage their restarts once updates are installed. Users will be able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. The grace period might not take effect if users already have more than the number of days set as grace period to manage their restart, based on deadline configurations. + +You can set the device to delay restarting until both the deadline and grace period have expired. + +If you disable or don't configure this policy, devices will get updates and will restart according to the default schedule. + +This policy will override the following policies: + +1. Specify deadline before auto restart for update installation +1. Specify Engaged restart transition and notification schedule for updates. + +1. Always automatically restart at the scheduled time +1. Configure Automatic Updates. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ComplianceDeadline | +| Friendly Name | Specify deadline for automatic updates and restarts for quality update | +| Element Name | Don't auto-restart until end of grace period. | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + ### ConfigureFeatureUpdateUninstallPeriod @@ -3328,7 +3238,7 @@ These policies are not exclusive and can be used in any combination. Together wi - the IT admin to schedule the time of the update installation. The data type is a integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. +Enables the IT admin to schedule the time of the update installation. The data type is a integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. @@ -3647,6 +3557,68 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2 ## Legacy Policies + +### AlwaysAutoRebootAtScheduledTimeMinutes + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AlwaysAutoRebootAtScheduledTimeMinutes +``` + + + + + +- If you enable this policy, a restart timer will always begin immediately after Windows Update installs important updates, instead of first notifying users on the login screen for at least two days. + +The restart timer can be configured to start with any value from 15 to 180 minutes. When the timer runs out, the restart will proceed even if the PC has signed-in users. + +- If you disable or don't configure this policy, Windows Update won't alter its restart behavior. + +If the "No auto-restart with logged-on users for scheduled automatic updates installations" policy is enabled, then this policy has no effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[15-180]` | +| Default Value | 15 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AlwaysAutoRebootAtScheduledTime | +| Friendly Name | Always automatically restart at the scheduled time | +| Element Name | work (minutes) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + ### AutoRestartDeadlinePeriodInDays diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index dc226ea336..c489be1733 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,7 +1,8 @@ --- title: UserRights Policy CSP description: Learn more about the UserRights Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 01/18/2024 # Policy CSP - UserRights -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as Security Identifiers (SID) or strings. For more information, see [Well-known SID structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab). @@ -258,7 +257,7 @@ This user right allows a process to impersonate any user without authentication. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -359,7 +358,7 @@ This user right determines which users can log on to the computer. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -460,7 +459,7 @@ This user right determines which users can bypass file, directory, registry, and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -567,7 +566,7 @@ This user right determines which users and groups can change the time and date o | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1027,7 +1026,7 @@ This security setting determines which service accounts are prevented from regis | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1076,7 +1075,7 @@ This security setting determines which accounts are prevented from being able to | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1336,7 +1335,7 @@ Assigning this user right to a user allows programs running on behalf of that us | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1543,7 +1542,7 @@ This user right determines which accounts can use a process to keep data in phys | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1592,7 +1591,7 @@ This security setting allows a user to be logged-on by means of a batch-queue fa | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1889,7 +1888,7 @@ This user right determines which users can use performance monitoring tools to m | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -1987,7 +1986,7 @@ This user right determines which users are allowed to shut down a computer from | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -2088,7 +2087,7 @@ This user right determines which users can bypass file, directory, registry, and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md index bfea6628c8..2d9385587a 100644 --- a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md +++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md @@ -1,7 +1,8 @@ --- title: VirtualizationBasedTechnology Policy CSP description: Learn more about the VirtualizationBasedTechnology Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md index 0b01461d1e..7b29ec716d 100644 --- a/windows/client-management/mdm/policy-csp-webthreatdefense.md +++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md @@ -1,7 +1,8 @@ --- title: WebThreatDefense Policy CSP description: Learn more about the WebThreatDefense Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 01/31/2024 # Policy CSP - WebThreatDefense -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - > [!NOTE] @@ -23,7 +22,7 @@ ms.date: 01/31/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -310,7 +309,7 @@ This policy setting determines whether Enhanced Phishing Protection in Microsoft - If you disable this policy setting, Enhanced Phishing Protection in Microsoft Defender SmartScreen is off and it won't capture events, send telemetry, or notify users. Additionally, your users are unable to turn it on. -- If you don't configure this setting, users can decide whether or not they will enable Enhanced Phishing Protection in Microsoft Defender SmartScreen. +- If you don't configure this setting, users can decide whether or not they'll enable Enhanced Phishing Protection in Microsoft Defender SmartScreen. diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 677a40fffb..9629567316 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,7 +1,8 @@ --- title: Wifi Policy CSP description: Learn more about the Wifi Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -188,10 +189,7 @@ By default, ICS is disabled when you create a remote access connection, but admi -Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0. - -> [!NOTE] -> Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that aren't user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted. +Allow or block connections to Wi-Fi outside of MDM server-installed networks. If you change this setting to Block, you must deploy enterprise Wi-Fi profiles to the device using the Wi-Fi CSP before you apply this setting. Otherwise, the device will go offline since it won't be able to connect to Wi-Fi. Note that choosing to block Wi-Fi connections will delete any previously installed user-configured Wi-Fi profiles from the device, though not all non-MDM profiles will be deleted. diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index 1d1a1691af..64a8c63abe 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,7 +1,8 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -ms.date: 09/11/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -15,30 +16,103 @@ ms.date: 09/11/2024 + +## AllowRecallEnablement + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallEnablement +``` + + + + +This policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own. + +- If this policy isn't configured, end users will have the Recall component in a disabled state. + +- If this policy is disabled, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they'll be deleted when this policy is disabled. Removing Recall requires a device restart. + +- If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DisableAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users will be able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Recall isn't available. | +| 1 (Default) | Recall is available. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowRecallEnablement | +| Friendly Name | Allow Recall to be enabled | +| Location | Computer Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | AllowRecallEnablement | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + ## DisableAIDataAnalysis | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | ```User ./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis ``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis +``` - -This policy setting allows you to determine whether end users have the option to allow snapshots to be saved on their PCs. + +This policy setting allows you to determine whether snapshots of the screen can be saved for use with Recall. By default, snapshots for Recall aren't enabled. IT administrators can't, on their own, enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent. -- If disabled, end users will have a choice to save snapshots of their screen on their PC and then use Recall to find things they've seen. +- If the policy isn't configured, snapshots won't be saved for use with Recall. -- If the policy is enabled, end users won't be able to save snapshots on their PC. +- If you enable this policy, snapshots won't be saved for use with Recall. If snapshots were previously saved on the device, they'll be deleted when this policy is enabled. -- If the policy isn't configured, end users may or may not be able to save snapshots on their PC-depending on other policy configurations. +If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device. @@ -70,7 +144,12 @@ This policy setting allows you to determine whether end users have the option to | Name | Value | |:--|:--| | Name | DisableAIDataAnalysis | -| Path | WindowsAI > AT > WindowsComponents > WindowsAI | +| Friendly Name | Turn off saving snapshots for use with Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | DisableAIDataAnalysis | +| ADMX File Name | WindowsCopilot.admx | @@ -141,6 +220,68 @@ This policy setting allows you to control whether Cocreator functionality is dis + +## DisableGenerativeFill + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableGenerativeFill +``` + + + + +This policy setting allows you to control whether generative fill functionality is disabled in the Windows Paint app. + +- If this policy is enabled, generative fill functionality won't be accessible in the Paint app. + +- If this policy is disabled or not configured, users will be able to access generative fill functionality. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Generative fill is enabled. | +| 1 | Generative fill is disabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableGenerativeFill | +| Path | WindowsAI > AT > WindowsComponents > Paint | + + + + + + + + ## DisableImageCreator @@ -203,6 +344,350 @@ This policy setting allows you to control whether Image Creator functionality is + +## SetCopilotHardwareKey + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 with [KB5044380](https://support.microsoft.com/help/5044380) [10.0.22621.4391] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetCopilotHardwareKey +``` + + + + +This policy setting determines which app opens when the user presses the Copilot key on their keyboard. + +- If the policy is enabled, the specified app will open when the user presses the Copilot key. Users can change the key assignment in Settings. + +- If the policy isn't configured, Copilot will open if it's available in that country or region. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetCopilotHardwareKey | +| Friendly Name | Set Copilot Hardware Key | +| Location | User Configuration | +| Path | Windows Components > Windows Copilot | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CopilotKey | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetDenyAppListForRecall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall +``` + + + + +This policy allows you to define a list of apps that won't be included in snapshots for Recall. + +Users will be able to add additional applications to exclude from snapshots using Recall settings. + +The list can include Application User Model IDs (AUMID) or name of the executable file. + +Use a semicolon-separated list of apps to define the deny app list for Recall. + +For example: `code.exe;Microsoft.WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe` + +> [!IMPORTANT] +> When configuring this policy setting, changes won't take effect until the device restarts. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetDenyAppListForRecall | +| Friendly Name | Set a list of apps to be filtered from snapshots for Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetDenyAppListForRecall | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetDenyUriListForRecall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall +``` + + + + +This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs. + +For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com` + +Adding `https://www.WoodgroveBank.com` to the list would also filter `https://Account.WoodgroveBank.com` and `https://www.WoodgroveBank.com/Account`. + +> [!IMPORTANT] +> Changes to this policy take effect after device restart. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetDenyUriListForRecall | +| Friendly Name | Set a list of URIs to be filtered from snapshots for Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetDenyUriListForRecall | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetMaximumStorageDurationForRecallSnapshots + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots +``` + + + + +This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall. + +When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days. + +When this policy isn't configured, a time frame isn't set for deleting snapshots. + +Snapshots aren't deleted until the maximum storage allocation for Recall is reached, and then the oldest snapshots are deleted first. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Let the OS define the maximum amount of time the snapshots will be saved. | +| 30 | 30 days. | +| 60 | 60 days. | +| 90 | 90 days. | +| 180 | 180 days. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetMaximumStorageDurationForRecallSnapshots | +| Friendly Name | Set maximum duration for storing snapshots used by Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetMaximumStorageDurationForRecallSnapshots | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetMaximumStorageSpaceForRecallSnapshots + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
    ✅ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots +``` + + + + +This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall. + +You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. + +When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. + +25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Let the OS define the maximum storage amount based on hard drive storage size. | +| 10240 | 10GB. | +| 25600 | 25GB. | +| 51200 | 50GB. | +| 76800 | 75GB. | +| 102400 | 100GB. | +| 153600 | 150GB. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetMaximumStorageSpaceForRecallSnapshots | +| Friendly Name | Set maximum storage for snapshots used by Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetMaximumStorageSpaceForRecallSnapshots | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + ## TurnOffWindowsCopilot @@ -231,10 +716,10 @@ This policy setting allows you to turn off Windows Copilot. - -> [!Note] -> - The TurnOffWindowsCopilot policy isn't for the [new Copilot experience](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-copilot-in-windows-for-your-workforce/ba-p/4141999) that's in some [Windows Insider builds](https://blogs.windows.com/windows-insider/2024/05/22/releasing-windows-11-version-24h2-to-the-release-preview-channel/) and that will be gradually rolling out to Windows 11 and Windows 10 devices. +> [!NOTE] +> - The TurnOffWindowsCopilot policy isn't for the [new Copilot experience](https://techcommunity.microsoft.com/blog/windows-itpro-blog/evolving-copilot-in-windows-for-your-workforce/4141999) that's in some [Windows Insider builds](https://blogs.windows.com/windows-insider/2024/05/22/releasing-windows-11-version-24h2-to-the-release-preview-channel/) and that will be gradually rolling out to Windows 11 and Windows 10 devices. +> - This policy also applies to upgrade scenarios to prevent installation of the Copilot app from an image that would have had the Copilot in Windows pane. diff --git a/windows/client-management/mdm/policy-csp-windowsautopilot.md b/windows/client-management/mdm/policy-csp-windowsautopilot.md index 1e3b68c37a..f10f3f5b34 100644 --- a/windows/client-management/mdm/policy-csp-windowsautopilot.md +++ b/windows/client-management/mdm/policy-csp-windowsautopilot.md @@ -1,7 +1,8 @@ --- title: WindowsAutopilot Policy CSP description: Learn more about the WindowsAutopilot Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index ae7bafe0cf..c6e242ce9b 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,7 +1,8 @@ --- title: WindowsConnectionManager Policy CSP description: Learn more about the WindowsConnectionManager Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index bc665f2973..5893ab6810 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,7 +1,8 @@ --- title: WindowsDefenderSecurityCenter Policy CSP description: Learn more about the WindowsDefenderSecurityCenter Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index c84c0bded7..541efe7904 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,7 +1,8 @@ --- title: WindowsInkWorkspace Policy CSP description: Learn more about the WindowsInkWorkspace Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index d9c4d40da1..8988bf7de4 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,7 +1,8 @@ --- title: WindowsLogon Policy CSP description: Learn more about the WindowsLogon Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -349,7 +350,7 @@ This policy setting allows you to control whether users see the first sign-in an | Name | Value | |:--|:--| | Name | EnableFirstLogonAnimation | -| Friendly Name | Show first sign-in animation | +| Friendly Name | Show first sign-in animation | | Location | Computer Configuration | | Path | System > Logon | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | @@ -380,11 +381,11 @@ This policy setting allows you to control whether users see the first sign-in an -This policy controls the configuration under which winlogon sends MPR notifications in the system. +This policy controls whether the user's password is included in the content of MPR notifications sent by winlogon in the system. -- If you enable this setting or don't configure it, winlogon sends MPR notifications if a credential manager is configured. +- If you disable this setting or don't configure it, winlogon sends MPR notifications with empty password fields of the user's authentication info. -- If you disable this setting, winlogon doesn't send MPR notifications. +- If you enable this setting, winlogon sends MPR notifications containing the user's password in the authentication info. @@ -415,7 +416,7 @@ This policy controls the configuration under which winlogon sends MPR notificati | Name | Value | |:--|:--| | Name | EnableMPRNotifications | -| Friendly Name | Enable MPR notifications for the system | +| Friendly Name | Configure the transmission of the user's password in the content of MPR notifications sent by winlogon. | | Location | Computer Configuration | | Path | Windows Components > Windows Logon Options | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 9e4a87efb2..b69ea72761 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,7 +1,8 @@ --- title: WindowsPowerShell Policy CSP description: Learn more about the WindowsPowerShell Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index ffa94e847a..d0946277b5 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -1,7 +1,8 @@ --- title: WindowsSandbox Policy CSP description: Learn more about the WindowsSandbox Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 01/18/2024 # Policy CSP - WindowsSandbox -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -21,7 +20,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4950] and later
    ✅ Windows 10, version 20H2 [10.0.19042.4950] and later
    ✅ Windows 10, version 21H1 [10.0.19043.4950] and later
    ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -56,10 +55,18 @@ Note that there may be security implications of exposing host audio input to the |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: @@ -86,7 +93,7 @@ Note that there may be security implications of exposing host audio input to the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4950] and later
    ✅ Windows 10, version 20H2 [10.0.19042.4950] and later
    ✅ Windows 10, version 21H1 [10.0.19043.4950] and later
    ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -119,10 +126,18 @@ This policy setting enables or disables clipboard sharing with the sandbox. |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: @@ -149,7 +164,7 @@ This policy setting enables or disables clipboard sharing with the sandbox. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -159,8 +174,18 @@ This policy setting enables or disables clipboard sharing with the sandbox. - -Allow mapping folders into Windows Sandbox. + +This policy setting enables or disables mapping folders into sandbox. + +- If you enable this policy setting, mapping folders from the host into Sandbox will be permitted. + +- If you enable this policy setting and disable write to mapped folders, mapping folders from the host into Sandbox will be permitted, but Sandbox will only have permission to read the files. + +- If you disable this policy setting, mapping folders from the host into Sandbox won't be permitted. + +- If you don't configure this policy setting, mapped folders will be enabled. + +Note that there may be security implications of exposing folders from the host into the container. @@ -174,17 +199,30 @@ Allow mapping folders into Windows Sandbox. |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: | Name | Value | |:--|:--| | Name | AllowMappedFolders | -| Path | WindowsSandbox > AT > WindowsComponents > WindowsSandboxCat | +| Friendly Name | Allow mapping folders into Windows Sandbox | +| Location | Computer Configuration | +| Path | Windows Components > Windows Sandbox | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\Sandbox | +| Registry Value Name | AllowMappedFolders | +| ADMX File Name | WindowsSandbox.admx | @@ -199,7 +237,7 @@ Allow mapping folders into Windows Sandbox. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4950] and later
    ✅ Windows 10, version 20H2 [10.0.19042.4950] and later
    ✅ Windows 10, version 21H1 [10.0.19043.4950] and later
    ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -234,10 +272,18 @@ Note that enabling networking can expose untrusted applications to the internal |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: @@ -264,7 +310,7 @@ Note that enabling networking can expose untrusted applications to the internal | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4950] and later
    ✅ Windows 10, version 20H2 [10.0.19042.4950] and later
    ✅ Windows 10, version 21H1 [10.0.19043.4950] and later
    ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -297,10 +343,18 @@ This policy setting enables or disables printer sharing from the host into the S |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: @@ -327,7 +381,7 @@ This policy setting enables or disables printer sharing from the host into the S | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4950] and later
    ✅ Windows 10, version 20H2 [10.0.19042.4950] and later
    ✅ Windows 10, version 21H1 [10.0.19043.4950] and later
    ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -362,10 +416,18 @@ Note that enabling virtualized GPU can potentially increase the attack surface o |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: @@ -392,7 +454,7 @@ Note that enabling virtualized GPU can potentially increase the attack surface o | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.4950] and later
    ✅ Windows 10, version 20H2 [10.0.19042.4950] and later
    ✅ Windows 10, version 21H1 [10.0.19043.4950] and later
    ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -427,10 +489,18 @@ Note that there may be security implications of exposing host video input to the |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: @@ -457,7 +527,7 @@ Note that there may be security implications of exposing host video input to the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -467,8 +537,18 @@ Note that there may be security implications of exposing host video input to the - -Allow Sandbox to write to mapped folders. + +This policy setting enables or disables mapping folders into sandbox. + +- If you enable this policy setting, mapping folders from the host into Sandbox will be permitted. + +- If you enable this policy setting and disable write to mapped folders, mapping folders from the host into Sandbox will be permitted, but Sandbox will only have permission to read the files. + +- If you disable this policy setting, mapping folders from the host into Sandbox won't be permitted. + +- If you don't configure this policy setting, mapped folders will be enabled. + +Note that there may be security implications of exposing folders from the host into the container. @@ -482,18 +562,31 @@ Allow Sandbox to write to mapped folders. |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-1]` | | Default Value | 1 | | Dependency [WindowsSandbox_AllowWriteToMappedFolders_DependencyGroup] | Dependency Type: `DependsOn`
    Dependency URI: `Device/Vendor/MSFT/Policy/Config/WindowsSandbox/AllowMappedFolders`
    Dependency Allowed Value: `[1]`
    Dependency Allowed Value Type: `Range`
    | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + **Group policy mapping**: | Name | Value | |:--|:--| -| Name | AllowWriteToMappedFolders | -| Path | WindowsSandbox > AT > WindowsComponents > WindowsSandboxCat | +| Name | AllowMappedFolders | +| Friendly Name | Allow mapping folders into Windows Sandbox | +| Location | Computer Configuration | +| Path | Windows Components > Windows Sandbox | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\Sandbox | +| Registry Value Name | AllowMappedFolders | +| ADMX File Name | WindowsSandbox.admx | diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 70e8e67fba..9a7729d8ac 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,7 +1,8 @@ --- title: WirelessDisplay Policy CSP description: Learn more about the WirelessDisplay Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/printerprovisioning-csp.md b/windows/client-management/mdm/printerprovisioning-csp.md index 8667239d07..6b09526d28 100644 --- a/windows/client-management/mdm/printerprovisioning-csp.md +++ b/windows/client-management/mdm/printerprovisioning-csp.md @@ -1,7 +1,8 @@ --- title: PrinterProvisioning CSP description: Learn more about the PrinterProvisioning CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/printerprovisioning-ddf-file.md b/windows/client-management/mdm/printerprovisioning-ddf-file.md index e4db037ecb..3929db5f29 100644 --- a/windows/client-management/mdm/printerprovisioning-ddf-file.md +++ b/windows/client-management/mdm/printerprovisioning-ddf-file.md @@ -1,7 +1,8 @@ --- title: PrinterProvisioning DDF file description: View the XML file containing the device description framework (DDF) for the PrinterProvisioning configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index b095998bbd..3d72cde805 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,7 +1,8 @@ --- title: Reboot CSP description: Learn more about the Reboot CSP. -ms.date: 01/18/2024 +ms.date: 02/14/2025 +ms.topic: generated-reference --- @@ -9,8 +10,6 @@ ms.date: 01/18/2024 # Reboot CSP -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - The Reboot configuration service provider is used to configure reboot settings. @@ -122,7 +121,7 @@ The supported operation is Get. -Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. +Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. While it's supported to set either DailyRecurrent or WeeklyRecurrent schedules, it isn't supported to enable both settings simultaneously. A reboot will be scheduled to occur every day at the configured time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule. @@ -161,7 +160,7 @@ Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecur -Value in ISO8601, both the date and time are required. A reboot will be scheduled at the configured date time. Setting a null (empty) date will delete the existing schedule. +Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. Both the date and time are required. A reboot will be scheduled to occur at the specified date and time. Setting a null (empty) date will delete the existing schedule. @@ -189,7 +188,7 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
    ❌ User | ✅ Pro
    ✅ Enterprise
    ✅ Education
    ✅ Windows SE
    ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -200,7 +199,7 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule -Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. +Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. While it's supported to set either DailyRecurrent or WeeklyRecurrent schedules, it isn't supported to enable both settings simultaneously. A reboot will be scheduled to occur every week at the configured day and time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule. diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index ab06e22815..af569e0d56 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -1,7 +1,8 @@ --- title: Reboot DDF file description: View the XML file containing the device description framework (DDF) for the Reboot configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -95,7 +96,7 @@ The following XML file contains the device description framework (DDF) for the R - Value in ISO8601, both the date and time are required. A reboot will be scheduled at the configured date time. Setting a null (empty) date will delete the existing schedule. + Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. Both the date and time are required. A reboot will be scheduled to occur at the specified date and time. Setting a null (empty) date will delete the existing schedule. @@ -122,7 +123,7 @@ The following XML file contains the device description framework (DDF) for the R - Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. While it is supported to set either DailyRecurrent or WeeklyRecurrent schedules, it is not supported to enable both settings simultaneously. A reboot will be scheduled to occur every day at the configured time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule. @@ -149,7 +150,7 @@ The following XML file contains the device description framework (DDF) for the R - Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + Value in ISO8601 date and time format (such as 2025-10-07T10:35:00) is required. While it is supported to set either DailyRecurrent or WeeklyRecurrent schedules, it is not supported to enable both settings simultaneously. A reboot will be scheduled to occur every week at the configured day and time starting at the specified date and time. Setting a null (empty) date will delete the existing schedule. @@ -164,8 +165,8 @@ The following XML file contains the device description framework (DDF) for the R - 99.9.99999 - 9.9 + 10.0.26100 + 1.0 diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index 1c0afff55f..97af6fd97c 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -1,7 +1,8 @@ --- title: RemoteWipe CSP description: Learn more about the RemoteWipe CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 6ec9d27e89..40776b4b16 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -1,7 +1,8 @@ --- title: RemoteWipe DDF file description: View the XML file containing the device description framework (DDF) for the RemoteWipe configuration service provider. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 6445586c10..6bb6c3faf5 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -1,7 +1,8 @@ --- title: RootCATrustedCertificates CSP description: Learn more about the RootCATrustedCertificates CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index 5479190d60..3528cce7c2 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,7 +1,8 @@ --- title: RootCATrustedCertificates DDF file description: View the XML file containing the device description framework (DDF) for the RootCATrustedCertificates configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 172e2ef819..752bd84fea 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,7 +1,8 @@ --- title: SecureAssessment CSP description: Learn more about the SecureAssessment CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index 7d49cb3604..eb02e07a68 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,7 +1,8 @@ --- title: SecureAssessment DDF file description: View the XML file containing the device description framework (DDF) for the SecureAssessment configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index bdff7ac7bd..f78f9cba3b 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -1,7 +1,8 @@ --- title: SharedPC CSP description: Learn more about the SharedPC CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index 4412297df6..353d0ba339 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,7 +1,8 @@ --- title: SharedPC DDF file description: View the XML file containing the device description framework (DDF) for the SharedPC configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 3793140f08..7a65e1a5e3 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -1,7 +1,8 @@ --- title: SUPL CSP description: Learn more about the SUPL CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -289,7 +290,7 @@ Required. The AppID for SUPL is automatically set to "ap0004". This is a read-on -Optional. Determines the full version (X. Y. Z where X, Y and Z are major version, minor version, service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. +Optional. Determines the full version (`X.Y.Z` where X, Y and Z are major version, minor version, service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 0797c3447b..64f70d8fef 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -1,7 +1,8 @@ --- title: SUPL DDF file description: View the XML file containing the device description framework (DDF) for the SUPL configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 663982ef0f..b13fdc33e3 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -1,7 +1,8 @@ --- title: SurfaceHub CSP description: Learn more about the SurfaceHub CSP. -ms.date: 08/16/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index 1193b28214..575f8e582a 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -1,7 +1,8 @@ --- title: SurfaceHub DDF file description: View the XML file containing the device description framework (DDF) for the SurfaceHub configuration service provider. -ms.date: 08/16/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index eba37a1745..4b5c7ff09c 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -48,12 +48,12 @@ items: - name: Protocol expanded: true items: - - name: Overview - href: ../declared-configuration.md - - name: Discovery - href: ../declared-configuration-discovery.md - - name: Enrollment - href: ../declared-configuration-enrollment.md + - name: Overview + href: ../declared-configuration.md + - name: Discovery + href: ../declared-configuration-discovery.md + - name: Enrollment + href: ../declared-configuration-enrollment.md - name: Extensibility href: ../declared-configuration-extensibility.md - name: Resource access @@ -387,7 +387,7 @@ items: href: policy-csp-authentication.md - name: Autoplay href: policy-csp-autoplay.md - - name: BitLocker + - name: Bitlocker href: policy-csp-bitlocker.md - name: BITS href: policy-csp-bits.md @@ -537,6 +537,8 @@ items: href: policy-csp-settingssync.md - name: SmartScreen href: policy-csp-smartscreen.md + - name: SpeakForMe + href: policy-csp-speakforme.md - name: Speech href: policy-csp-speech.md - name: Start @@ -835,10 +837,10 @@ items: items: - name: PassportForWork DDF file href: passportforwork-ddf.md - - name: PDE + - name: Personal Data Encryption href: personaldataencryption-csp.md items: - - name: PDE DDF file + - name: Personal Data Encryption DDF file href: personaldataencryption-ddf-file.md - name: Personalization href: personalization-csp.md diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 58d6463c97..9c7df2dfd8 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -1,7 +1,8 @@ --- title: VPNv2 CSP description: Learn more about the VPNv2 CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -863,11 +864,7 @@ Returns the type of App/Id. This value can be either of the following: PackageFa -False: Don't Bypass for Local traffic. - -True: ByPass VPN Interface for Local Traffic. - -Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed. +Not supported. @@ -5160,11 +5157,7 @@ Returns the type of App/Id. This value can be either of the following: PackageFa -False: Don't Bypass for Local traffic. - -True: ByPass VPN Interface for Local Traffic. - -Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed. +Not supported. diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index abe39e405a..2b6a1f45d4 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -1,7 +1,8 @@ --- title: VPNv2 DDF file description: View the XML file containing the device description framework (DDF) for the VPNv2 configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- @@ -1156,10 +1157,7 @@ The following XML file contains the device description framework (DDF) for the V - False : Do not Bypass for Local traffic - True : ByPass VPN Interface for Local Traffic - - Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed. + Not supported. @@ -4425,10 +4423,7 @@ A device tunnel profile must be deleted before another device tunnel profile can - False : Do not Bypass for Local traffic - True : ByPass VPN Interface for Local Traffic - - Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed. + Not supported. diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index da583b8cd9..33d21ef260 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,7 +1,8 @@ --- title: WiFi CSP description: Learn more about the WiFi CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index a2a8cf4407..5b19466938 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,7 +1,8 @@ --- title: WiFi DDF file description: View the XML file containing the device description framework (DDF) for the WiFi configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 10546d7713..0e493f19d0 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -1,7 +1,8 @@ --- title: WindowsDefenderApplicationGuard CSP description: Learn more about the WindowsDefenderApplicationGuard CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index 06f96f2518..9af969aacd 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,7 +1,8 @@ --- title: WindowsDefenderApplicationGuard DDF file description: View the XML file containing the device description framework (DDF) for the WindowsDefenderApplicationGuard configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 91e5d7b4ea..bef27c7ed9 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -1,7 +1,8 @@ --- title: WindowsLicensing CSP description: Learn more about the WindowsLicensing CSP. -ms.date: 08/06/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index d2abdc9fc4..22e3081e8b 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,7 +1,8 @@ --- title: WindowsLicensing DDF file description: View the XML file containing the device description framework (DDF) for the WindowsLicensing configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 12bac7c750..253819df28 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -1,7 +1,8 @@ --- title: WiredNetwork CSP description: Learn more about the WiredNetwork CSP. -ms.date: 01/18/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mdm/wirednetwork-ddf-file.md b/windows/client-management/mdm/wirednetwork-ddf-file.md index 178bba80f3..9c796c3f69 100644 --- a/windows/client-management/mdm/wirednetwork-ddf-file.md +++ b/windows/client-management/mdm/wirednetwork-ddf-file.md @@ -1,7 +1,8 @@ --- title: WiredNetwork DDF file description: View the XML file containing the device description framework (DDF) for the WiredNetwork configuration service provider. -ms.date: 06/28/2024 +ms.date: 02/13/2025 +ms.topic: generated-reference --- diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index 214a73f052..5c3f785c04 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Mobile device enrollment description: Learn how mobile device enrollment verifies that only authenticated and authorized devices are managed by the enterprise. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 ms.collection: - highpri diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index 053a0dd779..7be08881f7 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -1,7 +1,7 @@ --- title: What's new in MDM enrollment and management description: Discover what's new and breaking changes in mobile device management (MDM) enrollment and management experience across all Windows devices. -ms.topic: conceptual +ms.topic: whats-new ms.localizationpriority: medium ms.date: 07/08/2024 --- diff --git a/windows/client-management/oma-dm-protocol-support.md b/windows/client-management/oma-dm-protocol-support.md index 5caf42c5f0..7095cd64e9 100644 --- a/windows/client-management/oma-dm-protocol-support.md +++ b/windows/client-management/oma-dm-protocol-support.md @@ -1,7 +1,7 @@ --- title: OMA DM protocol support description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index e6c445b43c..16f7ade83e 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -1,7 +1,7 @@ --- title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index e0842698e8..9d21cb1322 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 --- diff --git a/windows/client-management/recall-sensitive-information-filtering.md b/windows/client-management/recall-sensitive-information-filtering.md new file mode 100644 index 0000000000..e6d8c32969 --- /dev/null +++ b/windows/client-management/recall-sensitive-information-filtering.md @@ -0,0 +1,190 @@ +--- +title: Sensitive information filtering in Recall +description: Learn about the types of potentially sensitive information Recall detects. +ms.topic: reference +ms.subservice: windows-copilot +ms.date: 11/22/2024 +ms.author: mstewart +author: mestew +ms.collection: + - windows-copilot + - magic-ai-copilot +appliesto: +- ✅ Copilot+ PCs +--- + + +# Reference for sensitive information filtering in Recall + +This article provides information about the types of potentially sensitive information that [Recall](manage-recall.md) detects when the **Sensitive Information Filtering** setting is enabled. + +## Types of potentially sensitive information + +Types of potentially sensitive information that Recall detects and filters include: + +ABA Routing Number
    +Argentina National Identity (DNI) Number
    +Argentina Unique Tax Identification Key (CUIT/CUIL)
    +Australia Bank Account Number
    +Australia Drivers License Number
    +Australia Tax File Number
    +Austria Driver's License Number
    +Austria Identity Card
    +Austria Social Security Number
    +Austria Tax Identification Number
    +Austria Value Added Tax
    +Azure Document DB Auth Key
    +Azure IAAS Database Connection String and Azure SQL Connection String
    +Azure IoT Connection String
    +Azure Redis Cache Connection String
    +Azure SAS
    +Azure Secrets (Generic)
    +Azure Service Bus Connection String
    +Azure Storage Account Key
    +Belgium Driver's License Number
    +Belgium National Number
    +Belgium Value Added Tax Number
    +Brazil CPF Number
    +Brazil Legal Entity Number (CNPJ)
    +Brazil National ID Card (RG)
    +Bulgaria Driver's License Number
    +Bulgaria Uniform Civil Number
    +Canada Bank Account Number
    +Canada Driver's License Number
    +Canada Social Insurance Number
    +Chile Identity Card Number
    +China Resident Identity Card (PRC) Number
    +Colombia National ID
    +Credit Card Number
    +Croatia Driver's License Number
    +Croatia Identity Card Number
    +Croatia Personal Identification (OIB) Number
    +Cyprus Driver's License Number
    +Cyprus Identity Card
    +Cyprus Tax Identification Number
    +Czech Driver's License Number
    +Czech Personal Identity Number
    +DEA Number
    +Denmark Driver's License Number
    +Denmark Personal Identification Number
    +Ecuador Unique Identification Number
    +Estonia Driver's License Number
    +Estonia Personal Identification Code
    +EU Debit Card Number
    +EU Driver's License Number
    +EU National Id Card
    +EU SSN or Equivalent Number
    +EU Tax File Number
    +Finland Driver's License Number
    +Finnish National ID
    +France CNI
    +France Driver's License Number
    +France INSEE
    +France Tax Identification Number (numéro SPI.)
    +France Value Added Tax Number
    +General Password
    +German Driver's License Number
    +Germany Identity Card Number
    +Germany Tax Identification Number
    +Germany Value Added Tax Number
    +Greece Driver's License Number
    +Greece National ID Card
    +Greece Social Security Number (AMKA)
    +Greek Tax Identification Number
    +Hong Kong Identity Card (HKID) number
    +Hungarian Social Security Number (TAJ)
    +Hungarian Value Added Tax Number
    +Hungary Driver's License Number
    +Hungary Personal Identification Number
    +Hungary Tax Identification Number
    +IBAN
    +India Driver's License Number
    +India GST number
    +India Permanent Account Number
    +India Unique Identification (Aadhaar) number
    +India Voter Id Card
    +Indonesia Drivers License Number
    +Indonesia Identity Card (KTP) Number
    +Ireland Driver's License Number
    +Ireland Personal Public Service (PPS) Number
    +Israel Bank Account Number
    +Israel National ID Number
    +Italy Driver's license Number
    +Italy Fiscal Code
    +Italy Value Added Tax
    +Japan Bank Account Number
    +Japan Driver's License Number
    +Japan Residence Card Number
    +Japan Resident Registration Number
    +Japan Social Insurance Number
    +Japanese My Number – Corporate
    +Japanese My Number – Personal
    +Latvia Driver's License Number
    +Latvia Personal Code
    +Lithuania Driver's License Number
    +Lithuania Personal Code
    +Luxembourg Driver's License Number
    +Luxembourg National Identification Number (Natural persons)
    +Luxembourg National Identification Number (Non-natural persons)
    +Malaysia ID Card Number
    +Malta Driver's License Number
    +Malta Identity Card Number
    +Malta Tax ID Number
    +Mexico Unique Population Registry Code (CURP)
    +Netherlands Citizen's Service (BSN) Number
    +Netherlands Driver's License Number
    +Netherlands Tax Identification Number
    +Netherlands Value Added Tax Number
    +New Zealand Bank Account Number
    +New Zealand Driver License Number
    +New Zealand Inland Revenue Number
    +Newzealand Social Welfare Number
    +Norway Identification Number
    +Philippines National ID
    +Philippines Passport Number
    +Philippines Unified Multi-Purpose ID number
    +Poland Driver's License Number
    +Poland Identity Card
    +Poland National ID (PESEL)
    +Poland Tax Identification Number
    +Polish REGON Number
    +Portugal Citizen Card Number
    +Portugal Driver's License Number
    +Portugal Tax Identification Number
    +Qatari ID Card Number
    +Romania Driver's License Number
    +Romania Personal Numerical Code (CNP)
    +Saudi Arabia National ID
    +Singapore Driving License Number
    +Singapore National Registration Identity Card (NRIC) Number
    +Slovakia Driver's License Number
    +Slovakia Personal Number
    +Slovenia Driver's License Number
    +Slovenia Tax Identification Number
    +Slovenia Unique Master Citizen Number
    +South Africa Identification Number
    +South Korea Driver's License Number
    +South Korea Resident Registration Number
    +Spain DNI
    +Spain Driver's License Number
    +Spain SSN
    +Spain Tax Identification Number
    +Sweden Driver's License Number
    +Sweden National ID
    +Sweden Tax Identification Number
    +SWIFT Code
    +Swiss SSN AHV Number
    +Taiwan Resident Certificate (ARC/TARC)
    +Taiwanese National ID
    +Thai Citizen ID
    +Turkish National Identity
    +U.K. Driver's License Number
    +U.K. Electoral Number
    +U.K. NHS Number
    +U.K. NINO
    +U.K. Unique Taxpayer Reference Number
    +U.S. Bank Account Number
    +U.S. Driver's License Number
    +U.S. Individual Taxpayer Identification Number (ITIN)
    +U.S. Social Security Number
    +UAE Identity Card Number
    diff --git a/windows/client-management/server-requirements-windows-mdm.md b/windows/client-management/server-requirements-windows-mdm.md index 92e09679f4..8931bdcdbf 100644 --- a/windows/client-management/server-requirements-windows-mdm.md +++ b/windows/client-management/server-requirements-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Server requirements for using OMA DM to manage Windows devices description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/structure-of-oma-dm-provisioning-files.md b/windows/client-management/structure-of-oma-dm-provisioning-files.md index a1fcf0777c..2079c53f5a 100644 --- a/windows/client-management/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/structure-of-oma-dm-provisioning-files.md @@ -1,7 +1,7 @@ --- title: Structure of OMA DM provisioning files description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body. -ms.topic: conceptual +ms.topic: how-to ms.date: 07/08/2024 --- diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 4aa913ef53..955dee1921 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -48,10 +48,12 @@ items: href: enterprise-app-management.md - name: Manage updates href: device-update-management.md - - name: Updated Windows and Microsoft Copilot experience + - name: Updated Windows and Microsoft 365 Copilot Chat experience href: manage-windows-copilot.md - name: Manage Recall - href: manage-recall.md + href: manage-recall.md + - name: Reference for sensitive information filtering in Recall + href: recall-sensitive-information-filtering.md - name: Secured-Core PC Configuration Lock href: config-lock.md - name: Certificate renewal diff --git a/windows/client-management/understanding-admx-backed-policies.md b/windows/client-management/understanding-admx-backed-policies.md index f327359fe3..26f9a581c9 100644 --- a/windows/client-management/understanding-admx-backed-policies.md +++ b/windows/client-management/understanding-admx-backed-policies.md @@ -1,7 +1,7 @@ --- title: Understanding ADMX policies description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices. -ms.topic: conceptual +ms.topic: concept-article ms.date: 07/08/2024 --- diff --git a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md index ca347147ab..e404a8bacd 100644 --- a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -1,7 +1,7 @@ --- title: Using PowerShell scripting with the WMI Bridge Provider description: This article covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, and how to invoke methods through the WMI Bridge Provider. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index 363072d68c..eebd880b1e 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -1,7 +1,7 @@ --- title: Win32 and Desktop Bridge app ADMX policy Ingestion description: Ingest ADMX files and set ADMX policies for Win32 and Desktop Bridge apps. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/windows-mdm-enterprise-settings.md b/windows/client-management/windows-mdm-enterprise-settings.md index a9b47a78e9..a86920ff45 100644 --- a/windows/client-management/windows-mdm-enterprise-settings.md +++ b/windows/client-management/windows-mdm-enterprise-settings.md @@ -1,7 +1,7 @@ --- title: Enterprise settings and policy management description: The DMClient manages the interaction between a device and a server. Learn more about the client-server management workflow. -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/client-management/wmi-providers-supported-in-windows.md b/windows/client-management/wmi-providers-supported-in-windows.md index 610f0e36b9..e9a528a68b 100644 --- a/windows/client-management/wmi-providers-supported-in-windows.md +++ b/windows/client-management/wmi-providers-supported-in-windows.md @@ -1,7 +1,7 @@ --- title: WMI providers supported in Windows description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). -ms.topic: conceptual +ms.topic: article ms.date: 07/08/2024 --- diff --git a/windows/configuration/assigned-access/configuration-file.md b/windows/configuration/assigned-access/configuration-file.md index 3d2532b2af..26cb548ff8 100644 --- a/windows/configuration/assigned-access/configuration-file.md +++ b/windows/configuration/assigned-access/configuration-file.md @@ -3,7 +3,7 @@ title: Create an Assigned Access configuration file description: Learn how to create an XML file to configure Assigned Access. ms.topic: how-to zone_pivot_groups: windows-versions-11-10 -ms.date: 03/04/2024 +ms.date: 10/31/2024 appliesto: --- diff --git a/windows/configuration/assigned-access/examples.md b/windows/configuration/assigned-access/examples.md index 3c0c865d64..0970cd2d90 100644 --- a/windows/configuration/assigned-access/examples.md +++ b/windows/configuration/assigned-access/examples.md @@ -1,7 +1,7 @@ --- title: Assigned Access examples description: Practical examples of XML files to configure Assigned Access. -ms.date: 03/04/2024 +ms.date: 10/31/2024 ms.topic: reference zone_pivot_groups: windows-versions-11-10 appliesto: diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-example.png b/windows/configuration/assigned-access/images/restricted-user-experience-example.png new file mode 100644 index 0000000000..e2863c0f06 Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience-example.png differ diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png index 6105c7bdd7..6deca437a7 100644 Binary files a/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png and b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png differ diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md index e8f3ecf20b..198d5e431c 100644 --- a/windows/configuration/assigned-access/index.md +++ b/windows/configuration/assigned-access/index.md @@ -2,7 +2,7 @@ title: Windows kiosks and restricted user experiences description: Learn about the options available in Windows to configure kiosks and restricted user experiences. ms.topic: overview -ms.date: 03/04/2024 +ms.date: 10/31/2024 --- # Windows kiosks and restricted user experiences @@ -43,6 +43,8 @@ Windows offers two different features to configure a kiosk experience: This option loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. This option is sometimes referred to as *multi-app kiosk*. +:::image type="content" source="images/restricted-user-experience-example.png" alt-text="Screenshot of a restricted user experience in Windows 11." border="false"::: + To configure a restricted user experience, you use the **Assigned Access** feature. ## Choose the right experience diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md index 12ed03cf42..9e87bd19a5 100644 --- a/windows/configuration/assigned-access/overview.md +++ b/windows/configuration/assigned-access/overview.md @@ -1,7 +1,7 @@ --- title: What is Assigned Access? description: Learn how to configure a Windows kiosk for single-app and multi-app scenarios with Assigned Access. -ms.date: 06/14/2024 +ms.date: 10/31/2024 ms.topic: overview --- @@ -298,35 +298,6 @@ To change the default time for Assigned Access to resume, add *IdleTimeOut* (DWO The Breakout Sequence of Ctrl + Alt + Del is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence is CTRL + ALT + A, where CTRL + ALT are the modifiers, and A is the key value. To learn more, see [Create an Assigned Access configuration XML file](configuration-file.md). -### Keyboard shortcuts - -The following keyboard shortcuts are blocked for the user accounts with Assigned Access: - -| Keyboard shortcut | Action | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------| -| Ctrl + Shift + Esc | Open Task Manager | -| WIN + , (comma) | Temporarily peek at the desktop | -| WIN + A | Open Action center | -| WIN + Alt + D | Display and hide the date and time on the desktop | -| WIN + Ctrl + F | Find computer objects in Active Directory | -| WIN + D | Display and hide the desktop | -| WIN + E | Open File Explorer | -| WIN + F | Open Feedback Hub | -| WIN + G | Open Game bar when a game is open | -| WIN + I | Open Settings | -| WIN + J | Set focus to a Windows tip when one is available | -| WIN + O | Lock device orientation | -| WIN + Q | Open search | -| WIN + R | Open the Run dialog box | -| WIN + S | Open search | -| WIN + Shift + C | Open Cortana in listening mode | -| WIN + X | Open the Quick Link menu | -| LaunchApp1 | Open the app that is assigned to this key | -| LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator | -| LaunchMail | Open the default mail client | - -For information on how to customize keyboard shortcuts, see [Assigned Access recommendations](recommendations.md#keyboard-shortcuts). - ## Remove Assigned Access Deleting the restricted user experience removes the policy settings associated with the users, but it can't revert all the configurations. For example, the Start menu configuration is maintained. diff --git a/windows/configuration/assigned-access/policy-settings.md b/windows/configuration/assigned-access/policy-settings.md index 0bf8a93e30..41072ae848 100644 --- a/windows/configuration/assigned-access/policy-settings.md +++ b/windows/configuration/assigned-access/policy-settings.md @@ -2,7 +2,7 @@ title: Assigned Access policy settings description: Learn about the policy settings enforced on a device configured with Assigned Access. ms.topic: reference -ms.date: 03/04/2024 +ms.date: 02/25/2025 --- # Assigned Access policy settings @@ -20,6 +20,7 @@ The following policy settings are applied at the device level when you deploy a | Type | Path | Name/Description | |---------|----------------------------------------------------------------------------|---------------------------------------------------------------------------| +| **CSP** | `./Vendor/MSFT/Policy/Config/Settings/AllowOnlineTips` | Allow Online Tips | | **CSP** | `./Vendor/MSFT/Policy/Config/Experience/AllowCortana` | Disable Cortana | | **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderDocuments` | Disable Start documents icon | | **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderDownloads` | Disable Start downloads icon | @@ -39,21 +40,23 @@ The following policy settings are applied at the device level when you deploy a ## User policy settings -The following policy settings are applied to any nonadministrator account when you deploy a restricted user experience: +The following policy settings are applied to targeted user accounts when you deploy a restricted user experience: | Type | Path | Name/Description | |---------|----------------------------------------------------------------------------------|-------------------------------------------------------------------| | **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/DisableContextMenus` | Disable Context Menu for Start menu apps | | **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HidePeopleBar` | Hide People Bar from appearing on taskbar | -| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentlyAddedApps` | Hide recently added apps from appearing on the Start menu | | **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentJumplists` | Hide recent jumplists from appearing on the Start menu/taskbar | +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentlyAddedApps` | Hide recently added apps from appearing on the Start menu | +| **CSP** | User Configuration\Administrative Templates\Windows Components\Windows Copilot | Turn off Windows Copilot | +| **GPO** | User Configuration\Administrative Templates\Desktop | Hide and disable all items on the desktop | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Clear history of recently opened documents on exit | -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Disable showing balloon notifications as toast | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Disable showing balloon notifications as toasts | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning items in Jump Lists | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning programs to the Taskbar | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not display or track items in Jump Lists from remote locations | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide and disable all items on the desktop | -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide the Task View button | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide the TaskView button | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Lock all taskbar settings | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Lock the Taskbar | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from adding or removing toolbars | @@ -69,21 +72,24 @@ The following policy settings are applied to any nonadministrator account when y | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Notification and Action Center | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Quick Settings | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Run menu from Start Menu | -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove the Security and Maintenance icon | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off all balloon notifications | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off feature advertisement balloon notifications | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Hide the TaskView button | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Turn off toast notifications | | **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Change Password | | **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Logoff | | **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Task Manager | +| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Prevent access to drives from My Computer | | **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove *Map network drive* and *Disconnect Network Drive* | | **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove File Explorer's default context menu | +| **GPO** | User Configuration\Administrative Templates\Windows Components\Windows Copilot | Turn off Windows Copilot | +| **GPO** | User Configuration\Administrative Templates\WindowsComponents\File Explorer | Prevent access to drives from My Computer | The following policy settings are applied to the kiosk account when you configure a kiosk experience with Microsoft Edge: | Type | Path | Name/Description | |---------|-----------------------------------------------------------------------------------|--------------------------------------------------------| -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Run only specified Windows applications > `msedge.exe` | +| **GPO** | User Configuration\Administrative Templates\System | Run only specified Windows applications > `msedge.exe` | | **GPO** | User Configuration\Administrative Templates\System | Turn off toast notifications | | **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Default risk level for file attachments > High risk | | **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Inclusion list for low file types > `.pdf;.epub` | @@ -112,3 +118,32 @@ The deny list is used to prevent the user from accessing the apps, which are cur 1. The default rule is to allow all users to launch the desktop programs signed with *Microsoft Certificate* for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. 1. There's a predefined inbox desktop app deny list for the Assigned Access user account, which is updated based on the *desktop app allow list* that you defined in the Assigned Access configuration 1. Enterprise-defined allowed desktop apps are added in the AppLocker allow list + +## Keyboard shortcuts + +The following keyboard shortcuts are blocked for the user accounts with Assigned Access: + +| Keyboard shortcut | Action | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------| +| Ctrl + Shift + Esc | Open Task Manager | +| WIN + , (comma) | Temporarily peek at the desktop | +| WIN + A | Open Action center | +| WIN + Alt + D | Display and hide the date and time on the desktop | +| WIN + Ctrl + F | Find computer objects in Active Directory | +| WIN + D | Display and hide the desktop | +| WIN + E | Open File Explorer | +| WIN + F | Open Feedback Hub | +| WIN + G | Open Game bar when a game is open | +| WIN + I | Open Settings | +| WIN + J | Set focus to a Windows tip when one is available | +| WIN + O | Lock device orientation | +| WIN + Q | Open search | +| WIN + R | Open the Run dialog box | +| WIN + S | Open search | +| WIN + Shift + C | Open Cortana in listening mode | +| WIN + X | Open the Quick Link menu | +| LaunchApp1 | Open the app that is assigned to this key | +| LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator | +| LaunchMail | Open the default mail client | + +For information on how to customize keyboard shortcuts, see [Assigned Access recommendations](recommendations.md#keyboard-shortcuts). diff --git a/windows/configuration/assigned-access/quickstart-kiosk.md b/windows/configuration/assigned-access/quickstart-kiosk.md index 0dd9ff9fa7..b0583377da 100644 --- a/windows/configuration/assigned-access/quickstart-kiosk.md +++ b/windows/configuration/assigned-access/quickstart-kiosk.md @@ -2,7 +2,7 @@ title: "Quickstart: configure a kiosk experience with Assigned Access" description: Learn how to configure a kiosk experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). ms.topic: quickstart -ms.date: 03/04/2024 +ms.date: 10/31/2024 --- # Quickstart: configure a kiosk with Assigned Access diff --git a/windows/configuration/assigned-access/quickstart-restricted-user-experience.md b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md index de5573c281..75d9bb74c1 100644 --- a/windows/configuration/assigned-access/quickstart-restricted-user-experience.md +++ b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md @@ -2,7 +2,7 @@ title: "Quickstart: configure a restricted user experience with Assigned Access" description: Learn how to configure a restricted user experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). ms.topic: quickstart -ms.date: 03/04/2024 +ms.date: 10/31/2024 appliesto: zone_pivot_groups: windows-versions-11-10 --- diff --git a/windows/configuration/assigned-access/recommendations.md b/windows/configuration/assigned-access/recommendations.md index 64b2ce4d5c..10a4e13dcf 100644 --- a/windows/configuration/assigned-access/recommendations.md +++ b/windows/configuration/assigned-access/recommendations.md @@ -2,7 +2,7 @@ title: Assigned Access recommendations description: Learn about the recommended kiosk and restricted user experience configuration options. ms.topic: best-practice -ms.date: 03/11/2024 +ms.date: 10/31/2024 --- # Assigned Access recommendations diff --git a/windows/configuration/assigned-access/shell-launcher/configuration-file.md b/windows/configuration/assigned-access/shell-launcher/configuration-file.md index d63efdb85b..459b26e0a2 100644 --- a/windows/configuration/assigned-access/shell-launcher/configuration-file.md +++ b/windows/configuration/assigned-access/shell-launcher/configuration-file.md @@ -1,7 +1,7 @@ --- title: Create a Shell Launcher configuration file description: Learn how to create an XML file to configure a device with Shell Launcher. -ms.date: 02/12/2024 +ms.date: 10/31/2024 ms.topic: how-to --- diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md index eb3b1a1b04..67b1c7788a 100644 --- a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 02/05/2024 +ms.date: 10/31/2024 ms.topic: include --- diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md index c783de00f6..d6c03611c6 100644 --- a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 02/05/2024 +ms.date: 10/31/2024 ms.topic: include --- diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md index 80e9dd0bb8..085c937378 100644 --- a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 02/05/2024 +ms.date: 10/31/2024 ms.topic: include --- diff --git a/windows/configuration/assigned-access/shell-launcher/index.md b/windows/configuration/assigned-access/shell-launcher/index.md index 4a51fa2143..5ffc4c6801 100644 --- a/windows/configuration/assigned-access/shell-launcher/index.md +++ b/windows/configuration/assigned-access/shell-launcher/index.md @@ -1,7 +1,7 @@ --- title: What is Shell Launcher? description: Learn how to configure devices with Shell Launcher. -ms.date: 06/18/2024 +ms.date: 10/31/2024 ms.topic: overview --- @@ -78,7 +78,7 @@ $shellLauncherConfiguration = @" $namespaceName="root\cimv2\mdm\dmmap" $className="MDM_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration) +$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration) $obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue if($cimSetError) { Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n" @@ -86,6 +86,7 @@ if($cimSetError) { $timeout = New-TimeSpan -Seconds 30 $stopwatch = [System.Diagnostics.Stopwatch]::StartNew() + $eventLogFilterHashTable = @{ LogName='Microsoft-Windows-AssignedAccess/Admin' } do{ $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available diff --git a/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md index f217d88363..c843e767a5 100644 --- a/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md +++ b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md @@ -2,7 +2,7 @@ title: "Quickstart: configure a kiosk experience with Shell Launcher" description: Learn how to configure a kiosk experience with Shell Launcher, using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). ms.topic: quickstart -ms.date: 02/05/2024 +ms.date: 10/31/2024 --- # Quickstart: configure a kiosk experience with Shell Launcher diff --git a/windows/configuration/assigned-access/shell-launcher/xsd.md b/windows/configuration/assigned-access/shell-launcher/xsd.md index ef624ae434..3dcc586570 100644 --- a/windows/configuration/assigned-access/shell-launcher/xsd.md +++ b/windows/configuration/assigned-access/shell-launcher/xsd.md @@ -2,7 +2,7 @@ title: Shell Launcher XML Schema Definition (XSD) description: Shell Launcher XSD reference article. ms.topic: reference -ms.date: 02/15/2024 +ms.date: 10/31/2024 --- # Shell Launcher XML Schema Definition (XSD) diff --git a/windows/configuration/assigned-access/xsd.md b/windows/configuration/assigned-access/xsd.md index 5cd75dccbe..36c51137aa 100644 --- a/windows/configuration/assigned-access/xsd.md +++ b/windows/configuration/assigned-access/xsd.md @@ -2,7 +2,7 @@ title: Assigned Access XML Schema Definition (XSD) description: Assigned Access XSD reference article. ms.topic: reference -ms.date: 04/08/2024 +ms.date: 10/31/2024 --- # Assigned Access XML Schema Definition (XSD) diff --git a/windows/configuration/cellular/provisioning-apn.md b/windows/configuration/cellular/provisioning-apn.md index 8fcf389cf7..860024c72c 100644 --- a/windows/configuration/cellular/provisioning-apn.md +++ b/windows/configuration/cellular/provisioning-apn.md @@ -2,7 +2,7 @@ title: Configure cellular settings description: Learn how to provision cellular settings for devices with built-in modems or plug-in USB modem dongles. ms.topic: concept-article -ms.date: 04/23/2024 +ms.date: 12/05/2024 --- # Configure cellular settings diff --git a/windows/configuration/custom-logon/images/customlogoncad.jpg b/windows/configuration/custom-logon/images/customlogoncad.jpg new file mode 100644 index 0000000000..0f610d3b57 Binary files /dev/null and b/windows/configuration/custom-logon/images/customlogoncad.jpg differ diff --git a/windows/configuration/custom-logon/index.md b/windows/configuration/custom-logon/index.md new file mode 100644 index 0000000000..536cdcb8f9 --- /dev/null +++ b/windows/configuration/custom-logon/index.md @@ -0,0 +1,133 @@ +--- +title: Custom Logon +description: Custom Logon +ms.date: 03/05/2024 +ms.topic: overview +--- + +# Custom Logon + +You can use the Custom Logon feature to suppress Windows UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown. + +Custom Logon settings don't modify the credential behavior of **Winlogon**, so you can use any credential provider that is compatible with Windows 10 to provide a custom sign-in experience for your device. For more information about creating a custom logon experience, see [Winlogon and Credential Providers](/windows/win32/secauthn/winlogon-and-credential-providers). + +## Requirements + +Custom Logon can be enabled on: + +- Windows 10 Enterprise +- Windows 10 IoT Enterprise +- Windows 10 Education +- Windows 11 Enterprise +- Windows 11 IoT Enterprise +- Windows 11 Education + +## Terminology + +**Turn on, enable:** To make the feature available and optionally apply settings to the device. Generally *turn on* is used in the user interface or control panel, whereas *enable* is used for command line. + +**Configure:** To customize the setting or subsettings. + +**Embedded Logon:** This feature is called Embedded Logon in Windows 10, version 1511. + +**Custom Logon:** This feature is called Custom Logon in Windows 10, version 1607 and later. + +## Turn on Custom Logon + +Custom Logon is an optional component and isn't turned on by default in Windows 10. It must be turned on prior to configuring. You can turn on and configure Custom Logon in a customized Windows 10 image (.wim) if Microsoft Windows hasn't been installed. If Windows has already been installed and you're applying a provisioning package to configure Custom Logon, you must first turn on Custom Logon in order for a provisioning package to be successfully applied. + +The Custom Logon feature is available in the Control Panel. You can set Custom Logon by following these steps: + +### Turn on Custom Logon in Control Panel + +1. In the Windows search bar, type **Turn Windows features on or off** and either press **Enter** or tap or select **Turn Windows features on or off** to open the **Windows Features** window. +1. In the **Windows Features** window, expand the **Device Lockdown** node, and select (to turn on) or clear (to turn off) the checkbox for **Custom Logon**. +1. Select **OK**. The **Windows Features** window indicates that Windows is searching for required files and displays a progress bar. Once found, the window indicates that Windows is applying the changes. When completed, the window indicates the requested changes are completed. + +### Turn on Custom Logon using DISM + +1. Open a command prompt with administrator rights. +1. Enable the feature using the following command. + + ```cmd + dism /online /enable-feature /featureName:Client-EmbeddedLogon + ``` + +## Configure Custom Logon + +### Configure Custom Logon settings using Unattend + +You can configure the Unattend settings in the [Microsoft-Windows-Embedded-EmbeddedLogon](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-embeddedlogon) component to add custom logon features to your image during the design or imaging phase. You can manually create an Unattend answer file or use Windows System Image Manager (Windows SIM) to add the appropriate settings to your answer file. For more information about the custom logon settings and XML examples, see the settings in Microsoft-Windows-Embedded-EmbeddedLogon. + +The following example shows how to disable all Welcome screen UI elements and the **Switch user** button. + +```xml + + + 17 + 1 + 1 + 1 + 1 + + +``` + +### Remove buttons from Logon screen + +To remove buttons from the Welcome screen, set the appropriate value for **BrandingNeutral** in the following registry key: + +```text +HKLM\Software\Microsoft\Windows Embedded\EmbeddedLogon +``` + +1. Make sure you have enabled Custom Logon following the instructions in [Turn on Custom Logon](#turn-on-custom-logon). +1. In the Windows search bar, type "Registry Editor" to open the **Registry Editor** window. +1. Use the file navigation in the left pane to access **HKLM\Software\Microsoft\Windows Embedded\EmbeddedLogon**. +1. In the right pane, right click on **BrandingNeutral** and select **Modify**. +1. Select the correct **Base** and enter the value for your desired customizations according to the following table, and click **OK** to apply the changes. + +> [!NOTE] +> Changing the **Base** of **BrandingNeutral** will automatically convert the value field to the selected base. To ensure you are getting the correct value, select the base before entering the value. + +The following table shows the possible values. To disable multiple Logon screen UI elements together, you can select the **Decimal** base when modifying the **BrandingNeutral** value, and combine actions by adding the decimal values of the desired actions and inputting the sum as the value of **BrandingNeutral**. For example, to disable the Power button and the Language button, select the decimal option for the base, then add the decimal values of each, in this case 2 and 4 respectively, and input the total (6) as the value for **BrandingNeutral**. + +| Action |Description| Registry value (Hexadecimal) | Registry value (Decimal)| +|--------|------------|----|---| +| Disable all Logon screen UI elements |Disables the Power, Language, and Ease of Access buttons on the Logon and Ctrl+Alt+Del screens. |`0x1` | 1| +| Disable the Power button |Disables the Power button on the Logon and Ctrl+Alt+Del screens.|`0x2` |2| +| Disable the Language button |Disables the Language button on the Logon and Ctrl+Alt+Del screens.|`0x4` |4| +| Disable the Ease of Access button |Disables the Ease of Access button on the Logon and Ctrl+Alt+Del screens.|`0x8` |8| +| Disable the Switch user button |Disables the Switch User button from the Ctrl+Alt+Del screen, preventing a user from switching accounts. | `0x10` |16| +|Disable the Blocked Shutdown Resolver (BSDR) screen|Disables the Blocked Shutdown Resolver (BSDR) screen so that restarting or shutting down the system causes the OS to immediately force close any open applications that are blocking system shut down. No UI is displayed, and users aren't given a chance to cancel the shutdown process. | `0x20` |32| + +In the following image of the `[ctrl + alt + del]` screen, you can see the Switch user button highlighted by a light green outline, the Language button highlighted by an orange outline, the Ease of Access button highlighted by a red outline, and the power button highlighted by a yellow outline. If you disable these buttons, they're hidden from the UI. + +![custom logon screen](images/customlogoncad.jpg) + +You can remove the Wireless UI option from the Welcome screen by using Group Policy. + +### Remove Wireless UI from Logon screen + +You use the following steps to remove Wireless UI from the Welcome screen + +1. From a command prompt, run gpedit.msc to open the Local Group Policy Editor. +1. In the Local Group Policy Editor, under **Computer Configuration**, expand **Administrative Templates**, expand **System**, and then tap or click **Logon**. +1. Double-tap or click **Do not display network selection UI**. + +## Additional Customizations + +The following table shows additional customizations that can be made using registry keys. + +|Action |Path |Registry Key and Value | +|---------|---------|---------| +|Hide Autologon UI |HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Embedded\EmbeddedLogon |`HideAutoLogonUI = 1`| +|Hide First Logon Animation |HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Embedded\EmbeddedLogon |`HideFirstLogonAnimation = 1` | +|Disable Authentication Animation |HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI |`AnimationDisabled = 1` | +|Disable Lock Screen | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization |`NoLockScreen = 1` | + +## Related articles + +- [Troubleshooting Custom Logon](troubleshoot.md) +- [Unbranded Boot](../unbranded-boot/index.md) +- [Shell Launcher](../shell-launcher/index.md) diff --git a/windows/configuration/custom-logon/troubleshoot.md b/windows/configuration/custom-logon/troubleshoot.md new file mode 100644 index 0000000000..abb65828de --- /dev/null +++ b/windows/configuration/custom-logon/troubleshoot.md @@ -0,0 +1,105 @@ +--- +title: Troubleshooting Custom Logon +description: Troubleshooting Custom Logon +ms.date: 05/02/2017 +ms.topic: troubleshooting +--- + +# Troubleshooting Custom Logon + +This section highlights some common issues that you may encounter when using Custom Logon. + +## When automatic sign-in is enabled, the device asks for a password when resuming from sleep or hibernate + +This can occur when your device is configured to require a password when waking up from a sleep state. + +### To disable password protection on wake-up + +1. If you have write filters enabled on your device, perform the following steps to disable them so that you can save setting changes: + + 1. At an administrator command prompt, type the following command: + + ```cmd + uwfmgr.exe filter disable + ``` + + 1. To restart the device, type the following command: + + ```cmd + uwfmgr.exe restart + ``` + +1. In **Contol Panel**, search for **Power Options** , and then select the Power Options heading. + +1. Under the **Power Options** heading, select **Require a password on wake up**. + +1. On the **Define power buttons and turn on password protection** page, under **Password protection on wakeup**, select **Don't require a password**. + +1. If you have disabled write filters, perform the following steps to enable them again: + + 1. At an administrator command prompt, type the following command: + + ```cmd + uwfmgr.exe filter enable + ``` + + 1. To restart the device, type the following command: + + ```cmd + uwfmgr.exe restart + ``` + +## The device displays a black screen during setup + +Set the **HideAutoLogonUI** and **AnimationDisabled** settings to **0** (zero). The device will then display a default screen during setup. + +## The device displays a black screen when Ctrl+Alt+Del is pressed + +**HideAutoLogonUI** and**ForceAutoLogon** have known issues when used together. To avoid a black screen, we recommend you use Keyboard Filter to block this key combination. + +## The device displays a black screen when Windows key + L is used to lock the device + +**HideAutoLogonUI** and **ForceAutoLogon** have known issues when used together. To avoid a black screen, we recommend you use Keyboard Filter to block this key combination. + +### The device displays a black screen when Notepad is opened, any characters are typed and the current user signs out, or the device is rebooted, or the device is shut down + +**HideAutoLogonUI** and **ForceAutoLogon** have known issues when used together. To avoid a black screen, we recommend you disable the Blocked Shutdown Resolver Screen (BSDR). + +> [!WARNING] +> When the BSDR screen is disabled, restarting, or shutting down the device causes the OS to immediately force close any open applications that are blocking system shutdown. No UI is displayed, and users aren't given a chance to cancel the shutdown process. This can result in lost data if any open applications have unsaved data. + +## The device displays a black screen when the device is suspended and then resumed + +**HideAutoLogonUI** and **ForceAutoLogon** have known issues when used together. To avoid a black screen, we recommend you disable the password protection on wake-up. + +### To disable password protection on wake-up + +1. In **Control Panel**, select **Power Options**. + +1. In the **Power Options** item, select **Require a password on wake up**. + +1. On the **Define power buttons and turn on password protection** page, under **Password protection on wake up**, select **Don't require a password**. + +### The device displays a black screen when a password expiration screen is displayed + +**HideAutoLogonUI** has a known issue. To avoid a black screen, we recommend you set the password to never expire. + +### To set a password to never expire on an individual user account + +1. On your device, open a command prompt with administrator privileges. + +1. Type the following, replacing *<accountname>* with the name of the account you want to remove the password expiration from. + + ```cmd + net accounts /expires:never + ``` + +### To set passwords to never expire on all user accounts + +1. On your device, open a command prompt with administrator privileges. + +1. Type the following + + ```cmd + net accounts /MaxPWAge:unlimited + ``` diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index 32f9c41247..22924a43cc 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -80,12 +80,18 @@ "assigned-access//**/*.yml": "paolomatarazzo", "cellular//**/*.md": "paolomatarazzo", "cellular//**/*.yml": "paolomatarazzo", + "custom-logon//**/*.md": "terrywarwick", + "custom-logon//**/*.yml": "terrywarwick", + "keyboard-filter//**/*.md": "terrywarwick", + "keyboard-filter//**/*.yml": "terrywarwick", "lock-screen//**/*.md": "paolomatarazzo", "lock-screen//**/*.yml": "paolomatarazzo", "provisioning-packages//**/*.md": "vinaypamnani-msft", "provisioning-packages//**/*.yml": "vinaypamnani-msft", "shared-pc//**/*.md": "paolomatarazzo", "shared-pc//**/*.yml": "paolomatarazzo", + "shell-launcher//**/*.md": "terrywarwick", + "shell-launcher//**/*.yml": "terrywarwick", "start//**/*.md": "paolomatarazzo", "start//**/*.yml": "paolomatarazzo", "store//**/*.md": "paolomatarazzo", @@ -94,6 +100,10 @@ "taskbar//**/*.yml": "paolomatarazzo", "tips//**/*.md": "paolomatarazzo", "tips//**/*.yml": "paolomatarazzo", + "unbranded-boot//**/*.md": "terrywarwick", + "unbranded-boot//**/*.yml": "terrywarwick", + "unified-write-filter//**/*.md": "terrywarwick", + "unified-write-filter//**/*.yml": "terrywarwick", "wcd//**/*.md": "vinaypamnani-msft", "wcd//**/*.yml": "vinaypamnani-msft" }, @@ -104,12 +114,18 @@ "assigned-access//**/*.yml": "paoloma", "cellular//**/*.md": "paoloma", "cellular//**/*.yml": "paoloma", + "custom-logon//**/*.md": "twarwick", + "custom-logon//**/*.yml": "twarwick", "lock-screen//**/*.md": "paoloma", + "keyboard-filter//**/*.md": "twarwick", + "keyboard-filter//**/*.yml": "twarwick", "lock-screen//**/*.yml": "paoloma", "provisioning-packages//**/*.md": "vinpa", "provisioning-packages//**/*.yml": "vinpa", "shared-pc//**/*.md": "paoloma", "shared-pc//**/*.yml": "paoloma", + "shell-launcher//**/*.md": "twarwick", + "shell-launcher//**/*.yml": "twarwick", "start//**/*.md": "paoloma", "start//**/*.yml": "paoloma", "store//**/*.md": "paoloma", @@ -118,6 +134,10 @@ "taskbar//**/*.yml": "paoloma", "tips//**/*.md": "paoloma", "tips//**/*.yml": "paoloma", + "unbranded-boot//**/*.md": "twarwick", + "unbranded-boot//**/*.yml": "twarwick", + "unified-write-filter//**/*.md": "twarwick", + "unified-write-filter//**/*.yml": "twarwick", "wcd//**/*.md": "vinpa", "wcd//**/*.yml": "vinpa" }, diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index fa1a297ecf..a1e1606862 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -11,7 +11,7 @@ metadata: author: paolomatarazzo ms.author: paoloma manager: aaroncz - ms.date: 04/25/2024 + ms.date: 12/05/2024 # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/configuration/keyboard-filter/disable-all-blocked-key-combinations.md b/windows/configuration/keyboard-filter/disable-all-blocked-key-combinations.md new file mode 100644 index 0000000000..9a5c32fb35 --- /dev/null +++ b/windows/configuration/keyboard-filter/disable-all-blocked-key-combinations.md @@ -0,0 +1,74 @@ +--- +title: Disable all blocked key combinations +description: Disable all blocked key combinations +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Disable all blocked key combinations + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +The following sample Windows PowerShell script uses the WMI providers to disable all blocked key combinations for Keyboard Filter by using the Windows Management Instrumentation (WMI) providers for Keyboard Filter. The key combination configurations aren't removed, but Keyboard Filter stops blocking any keys. + +## Disable-all-rules.ps1 + +```powershell +# +# Copyright (C) Microsoft. All rights reserved. +# + +<# +.Synopsis + This Windows PowerShell script shows how to enumerate all existing keyboard filter + rules and how to disable them by setting the Enabled property directly. +.Description + For each instance of WEKF_PredefinedKey, WEKF_CustomKey, and WEKF_Scancode, + set the Enabled property to false/0 to disable the filter rule, thus + allowing all key sequences through the filter. +.Parameter ComputerName + Optional parameter to specify the remote computer that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> + +param( + [String]$ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + +Get-WMIObject -class WEKF_PredefinedKey @CommonParams | + foreach { + if ($_.Enabled) { + $_.Enabled = 0; + $_.Put() | Out-Null; + Write-Host Disabled $_.Id + } + } + +Get-WMIObject -class WEKF_CustomKey @CommonParams | + foreach { + if ($_.Enabled) { + $_.Enabled = 0; + $_.Put() | Out-Null; + Write-Host Disabled $_.Id + } + } + +Get-WMIObject -class WEKF_Scancode @CommonParams | + foreach { + if ($_.Enabled) { + $_.Enabled = 0; + $_.Put() | Out-Null; + "Disabled {0}+{1:X4}" -f $_.Modifiers,$_.Scancode + } + } +``` + +## Related articles + +- [Windows PowerShell script samples for keyboard filter](keyboardfilter-powershell-script-samples.md) +- [Keyboard filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) +- [Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/index.md b/windows/configuration/keyboard-filter/index.md new file mode 100644 index 0000000000..6f7d3cc589 --- /dev/null +++ b/windows/configuration/keyboard-filter/index.md @@ -0,0 +1,144 @@ +--- +title: Keyboard Filter +description: Keyboard Filter +ms.date: 01/13/2025 +ms.topic: overview +--- + +# Keyboard Filter + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, a customer can use certain Microsoft Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to alter the operation of a device by locking the screen or using Task Manager to close a running application. This behavior might not be desirable if your device is intended for a dedicated purpose. + +The Keyboard Filter feature works with physical keyboards, the Windows on-screen keyboard, and the touch keyboard. Switching from one language to another might cause the location of suppressed keys on the keyboard layout to change. Keyboard Filter detects these dynamic layout changes and continues to suppress keys correctly. + +> [!NOTE] +> Keyboard filter is not supported in a remote desktop session. + +## Terminology + +- **Turn on, enable:** Make the setting available to the device and optionally apply the settings to the device. Generally *turn on* is used in the user interface or control panel, whereas *enable* is used for command line +- **Configure:** To customize the setting or subsettings +- **Embedded Keyboard Filter:** This feature is called Embedded Keyboard Filter in Windows 10, version 1511 +- **Keyboard Filter:** This feature is called Keyboard Filter in Windows 10, version 1607 and later + +## Turn on Keyboard Filter + +By default, Keyboard Filter isn't turned on. You can turn Keyboard Filter on or off for your device by using the following steps. + +Turning on an off Keyboard Filter requires that you restart your device. Keyboard Filter is automatically enabled after the restart. + +### Turn on Keyboard Filter by using Control Panel + +1. In the Windows search bar, type **Turn Windows features on or off** and either press **Enter** or tap or select **Turn Windows features on or off** to open the **Windows Features** window. +1. In the **Windows Features** window, expand the **Device Lockdown** node, and select (to turn on) or clear (to turn off) the checkbox for **Keyboard Filter**. +1. Select **OK**. The **Windows Features** window indicates that Windows is searching for required files and displays a progress bar. Once found, the window indicates that Windows is applying the changes. When completed, the window indicates the requested changes are completed. +1. Restart your device to apply the changes. + +### Configure Keyboard using Unattend + +1. You can configure the Unattend settings in the [Microsoft-Windows-Embedded-KeyboardFilterService](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-keyboardfilterservice) component to add Keyboard Filter features to your image during the design or imaging phase. +1. You can manually create an Unattend answer file or use Windows System Image Manager (Windows SIM) to add the appropriate settings to your answer file. For more information about the keyboard filter settings and XML examples, see the settings in [Microsoft-Windows-Embedded-KeyboardFilterService](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-keyboardfilterservice). + +### Turn on and configure Keyboard Filter using Windows Configuration Designer + +The Keyboard Filter settings are also available as Windows provisioning settings so you can configure these settings to be applied during the image deployment time or runtime. You can set one or all keyboard filter settings by creating a provisioning package using Windows Configuration Designer and then applying the provisioning package during image deployment time or runtime. + +1. Build a provisioning package in Windows Configuration Designer by following the instructions in [Create a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package), selecting the **Advanced Provisioning** option. + + > [!Note] + > In the **Choose which settings to view and configure** window, choose **Common to all Windows desktop editions**. + +1. On the **Available customizations** page, select **Runtime settings** > **SMISettings**, and then set the desired values for the keyboard filter settings. +1. Once you have finished configuring the settings and building the provisioning package, you can apply the package to the image deployment time or runtime. For more information, see [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package). + +This example uses a Windows image called install.wim, but you can use the same procedure to apply a provisioning package. For more information on DISM, see [What Is Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/what-is-dism). + +### Turn on and configure Keyboard Filter by using DISM + +1. Open a command prompt with administrator privileges. +1. Enable the feature using the following command. + + ```cmd + Dism /online /Enable-Feature /FeatureName:Client-KeyboardFilter + ``` + +1. Once the script completes, restart the device to apply the change. + +## Keyboard Filter features + +Keyboard Filter has the following features: + +- Supports hardware keyboards, the standard Windows on-screen keyboard, and the touch keyboard (TabTip.exe) +- Suppresses key combinations even when they come from multiple keyboards + + For example, if a user presses the Ctrl key and the Alt key on a hardware keyboard, while at the same time pressing Delete on a software keyboard, Keyboard Filter can still detect and suppress the Ctrl+Alt+Delete functionality. + +- Supports numeric keypads and keys designed to access media player and browser functionality +- Can configure a key to breakout of a locked down user session to return to the Welcome screen +- Automatically handles dynamic layout changes +- Can be enabled or disabled for administrator accounts +- Can force disabling of Ease of Access functionality +- Supports x86 and x64 architectures + +## Keyboard scan codes and layouts + +When a key is pressed on a physical keyboard, the keyboard sends a scan code to the keyboard driver. The driver then sends the scan code to the OS and the OS converts the scan code into a virtual key based on the current active layout. The layout defines the mapping of keys on the physical keyboard, and has many variants. A key on a keyboard always sends the same scan code when pressed, however this scan code can map to different virtual keys for different layouts. For example, in the English (United States) keyboard layout, the key to the right of the P key maps to `{`. However, in the Swedish (Sweden) keyboard layout, the same key maps to `Å`. + +Keyboard Filter can block keys either by the scan code or the virtual key. Blocking keys by the scan code is useful for custom keyboards that have special scan codes that don't translate into any single virtual key. Blocking keys by the virtual key is more convenient because it's easier to read and Keyboard Filter suppresses the key correctly even when the location of the key changes because of a layout change. + +When you configure Keyboard Filter to block keys by using the virtual key, you must use the English names for the virtual keys. For more information about the names of the virtual keys, see keyboard filter key names. + +For the Windows on-screen keyboard, keyboard filter converts each keystroke into a scan code based on the layout, and back into a virtual key. This allows keyboard filter to suppress the on-screen keyboard keys in the same manner as physical keyboard keys if they're configured with either scan code or virtual key. + +## Keyboard Filter and ease of access features + +By default, ease of access features are enabled and Keyboard Filter is disabled for administrator accounts. + +If Sticky Keys are enabled, a user can bypass Keyboard Filter in certain situations. You can configure keyboard filter to disable all ease of access features and prevent users from enabling them. + +You can enable ease of access features for administrator accounts, while still disabling them for standard user accounts, by making sure that Keyboard Filter is disabled for administrator accounts. + +## Keyboard Filter configuration + +You can configure the following options for Keyboard Filter: + +- Set/unset predefined key combinations to be suppressed +- Add/remove custom defined key combinations to be suppressed +- Enable/disable keyboard filter for administrator accounts +- Force disabling ease of access features +- Configure a breakout key sequence to break out of a locked down account + +Most configuration changes take effect immediately. Some changes, such as enabling or disabling Keyboard Filter for administrators, don't take effect until the user signs out of the account and then back in. If you change the breakout key scan code, you must restart the device before the change take effect. + +You can configure keyboard filter by using Windows Management Instrumentation (WMI) providers. You can use the Keyboard Filter WMI providers directly in a PowerShell script or in an application. + +For more information about Keyboard Filter WMI providers, see [Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md). + +## Keyboard breakout + +You may need to sign in to a locked down device with a different account in order to service or configure the device. You can configure a breakout key to break out of a locked down account by specifying a key scan code. A user can press this key consecutively five times to switch to the Welcome screen so that you can sign in to a different account. + +The breakout key is set to the scan code for the left Windows logo key by default. You can use the [WEKF_Settings](wekf-settings.md) WMI class to change the breakout key scan code. If you change the breakout key scan code, you must restart the device before the change takes effect. + +## Keyboard Filter considerations + +Starting a device in Safe Mode bypasses keyboard filter. The Keyboard Filter service isn't loaded in Safe Mode, and keys aren't blocked in Safe Mode. + +Keyboard filter can't block the Sleep key. + +Some hardware keys, such as rotation lock, don't have a defined virtual key. You can still block these keys by using the scan code of the key. + +The add (+), multiply (\*), subtract (-), divide (/), and decimal (.) keys have different virtual keys and scan codes on the numeric keypad than on the main keyboard. You must block both keys to block these keys. For example, to block the multiply key, you must add a rule to block "\*" and a rule to block Multiply. + +When locking the screen by using the on-screen keyboard, or a combination of a physical keyboard and the on-screen keyboard, the on-screen keyboard sends an extra Windows logo key keystroke to the OS. If your device is using the Windows 10 shell and you use keyboard filter to block Windows logo key+L, the extra Windows logo key keystroke causes the shell to switch between the **Start** screen and the last active app when a user attempts to lock the device by using the on-screen keyboard, which may be unexpected behavior. + +Some custom keyboard software, such as Microsoft IntelliType Pro, can install Keyboard Filter drivers that prevent Keyboard Filter from being able to block some or all keys, typically extended keys like BrowserHome and Search. + +## In this section + +- [Keyboard Filter key names](keyboardfilter-key-names.md) +- [Predefined key combinations](predefined-key-combinations.md) +- [Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) +- [Windows PowerShell script samples for Keyboard Filter](keyboardfilter-powershell-script-samples.md) \ No newline at end of file diff --git a/windows/configuration/keyboard-filter/keyboardfilter-add-blocked-key-combinations.md b/windows/configuration/keyboard-filter/keyboardfilter-add-blocked-key-combinations.md new file mode 100644 index 0000000000..129b6e271b --- /dev/null +++ b/windows/configuration/keyboard-filter/keyboardfilter-add-blocked-key-combinations.md @@ -0,0 +1,160 @@ +--- +title: Add blocked key combinations +description: Add blocked key combinations +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Add blocked key combinations + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +The following sample Windows PowerShell script uses the Windows Management Instrumentation (WMI) providers for Keyboard Filter to create three functions to configure Keyboard Filter so that Keyboard Filter blocks key combinations. It demonstrates several ways to use each function. + +The first function, `Enable-Predefine-Key`, blocks key combinations that are predefined for Keyboard Filter. + +The second function, `Enable-Custom-Key`, blocks custom key combinations by using the English key names. + +The third function, `Enable-Scancode`, blocks custom key combinations by using the keyboard scan code for the key. + +## Enable-rules.ps1 + +```powershell +# +# Copyright (C) Microsoft. All rights reserved. +# + +<# +.Synopsis + This script shows how to use the built in WMI providers to enable and add + keyboard filter rules through Windows PowerShell on the local computer. +.Parameter ComputerName + Optional parameter to specify a remote machine that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> +param ( + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + +function Enable-Predefined-Key($Id) { + <# + .Synopsis + Toggle on a Predefined Key keyboard filter Rule + .Description + Use Get-WMIObject to enumerate all WEKF_PredefinedKey instances, + filter against key value "Id", and set that instance's "Enabled" + property to 1/true. + .Example + Enable-Predefined-Key "Ctrl+Alt+Del" + Enable CAD filtering +#> + + $predefined = Get-WMIObject -class WEKF_PredefinedKey @CommonParams | + where { + $_.Id -eq "$Id" + }; + + if ($predefined) { + $predefined.Enabled = 1; + $predefined.Put() | Out-Null; + Write-Host Enabled $Id + } else { + Write-Error "$Id is not a valid predefined key" + } +} + + +function Enable-Custom-Key($Id) { + <# + .Synopsis + Toggle on a Custom Key keyboard filter Rule + .Description + Use Get-WMIObject to enumerate all WEKF_CustomKey instances, + filter against key value "Id", and set that instance's "Enabled" + property to 1/true. + + In the case that the Custom instance does not exist, add a new + instance of WEKF_CustomKey using Set-WMIInstance. + .Example + Enable-Custom-Key "Ctrl+V" + Enable filtering of the Ctrl + V sequence. +#> + + $custom = Get-WMIObject -class WEKF_CustomKey @CommonParams | + where { + $_.Id -eq "$Id" + }; + + if ($custom) { +# Rule exists. Just enable it. + $custom.Enabled = 1; + $custom.Put() | Out-Null; + "Enabled Custom Filter $Id."; + + } else { + Set-WMIInstance ` + -class WEKF_CustomKey ` + -argument @{Id="$Id"} ` + @CommonParams | Out-Null + "Added Custom Filter $Id."; + } +} + +function Enable-Scancode($Modifiers, [int]$Code) { + <# + .Synopsis + Toggle on a Scancode keyboard filter Rule + .Description + Use Get-WMIObject to enumerate all WEKF_Scancode instances, + filter against key values of "Modifiers" and "Scancode", and set + that instance's "Enabled" property to 1/true. + + In the case that the Scancode instance does not exist, add a new + instance of WEKF_Scancode using Set-WMIInstance. + .Example + Enable-Scancode "Ctrl" 37 + Enable filtering of the Ctrl + keyboard scancode 37 (base-10) + sequence. +#> + + $scancode = + Get-WMIObject -class WEKF_Scancode @CommonParams | + where { + ($_.Modifiers -eq $Modifiers) -and ($_.Scancode -eq $Code) + } + + if($scancode) { + $scancode.Enabled = 1 + $scancode.Put() | Out-Null + "Enabled Custom Scancode {0}+{1:X4}" -f $Modifiers, $Code + } else { + Set-WMIInstance ` + -class WEKF_Scancode ` + -argument @{Modifiers="$Modifiers"; Scancode=$Code} ` + @CommonParams | Out-Null + + "Added Custom Scancode {0}+{1:X4}" -f $Modifiers, $Code + } +} + +# Some example uses of the functions defined above. +Enable-Predefined-Key "Ctrl+Alt+Del" +Enable-Predefined-Key "Ctrl+Esc" +Enable-Custom-Key "Ctrl+V" +Enable-Custom-Key "Numpad0" +Enable-Custom-Key "Shift+Numpad1" +Enable-Custom-Key "%" +Enable-Scancode "Ctrl" 37 +``` + +## Related topics + +[Windows PowerShell script samples for keyboard filter](keyboardfilter-powershell-script-samples.md) + +[Keyboard filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/keyboardfilter-key-names.md b/windows/configuration/keyboard-filter/keyboardfilter-key-names.md new file mode 100644 index 0000000000..9fe1380150 --- /dev/null +++ b/windows/configuration/keyboard-filter/keyboardfilter-key-names.md @@ -0,0 +1,179 @@ +--- +title: Keyboard Filter key names +description: Keyboard Filter key names +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Keyboard Filter key names + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +You can configure Keyboard Filter to block keys or key combinations. A key combination consists of one or more modifier keys, separated by a plus sign (+), and either a key name or a key scan code. In addition to the keys listed in the following tables, you can use the predefined key combinations names as custom key combinations. However, we recommend using the predefined key settings when enabling or disabling predefined key combinations. + +The key names are grouped as follows: + +- [Modifier keys](#modifier-keys) +- [System keys](#system-keys) +- [Cursor and edit keys](#cursor-and-edit-keys) +- [State keys](#state-keys) +- [OEM keys](#oem-keys) +- [Function keys](#function-keys) +- [Numeric keypad keys](#numeric-keypad-keys) + +## Modifier keys + +You can use the modifier keys listed in the following table when you configure keyboard filter. Multiple modifiers are separated by a plus sign (+). You can also configure Keyboard Filter to block any modifier key even if it's not part of a key combination. + +| Modifier key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `Ctrl` | VK_CONTROL | The Ctrl key | +| `LCtrl` | VK_LCONTROL | The left Ctrl key | +| `RCtrl` | VK_RCONTROL | The right Ctrl key | +| `Control` | VK_CONTROL | The Ctrl key | +| `LControl` | VK_LCONTROL | The left Ctrl key | +| `RControl` | VK_RCONTROL | The right Ctrl key | +| `Alt` | VK_MENU | The Alt key | +| `LAlt` | VK_LMENU | The left Alt key | +| `RAlt` | VK_RMENU | The right Alt key | +| `Shift` | VK_SHIFT | The Shift key | +| `LShift` | VK_LSHIFT | The left Shift key | +| `RShift` | VK_RSHIFT | The right Shift key | +| `Win` | VK_WIN | The Windows logo key | +| `LWin` | VK_LWIN | The left Windows logo key | +| `RWin` | VK_RWIN | The right Windows logo key | +| `Windows` | VK_WIN | The Windows logo key | +| `LWindows` | VK_LWIN | The left Windows logo key | +| `RWindows` | VK_RWIN | The right Windows key | + +## System keys + +| Modifier key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `Ctrl` | VK_CONTROL | The Ctrl key | +| `LCtrl` | VK_LCONTROL | The left Ctrl key | +| `RCtrl` | VK_RCONTROL | The right Ctrl key | +| `Control` | VK_CONTROL | The Ctrl key | +| `LControl` | VK_LCONTROL | The left Ctrl key | +| `RControl` | VK_RCONTROL | The right Ctrl key | +| `Alt` | VK_MENU | The Alt key | +| `LAlt` | VK_LMENU | The left Alt key | +| `RAlt` | VK_RMENU | The right Alt key | +| `Shift` | VK_SHIFT | The Shift key | +| `LShift` | VK_LSHIFT | The left Shift key | +| `RShift` | VK_RSHIFT | The right Shift key | +| `Win` | VK_WIN | The Windows logo key | +| `LWin` | VK_LWIN | The left Windows logo key | +| `RWin` | VK_RWIN | The right Windows logo key | +| `Windows` | VK_WIN | The Windows logo key | +| `LWindows` | VK_LWIN | The left Windows logo key | +| `RWindows` | VK_RWIN | The right Windows logo key | + +## Cursor and edit keys + +| Key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `PageUp` | VK_PRIOR | The Page Up key | +| `Prior` | VK_PRIOR | The Page Up key | +| `PgUp` | VK_PRIOR | The Page Up key | +| `PageDown` | VK_NEXT | The Page Down key | +| `PgDown` | VK_NEXT | The Page Down key | +| `Next` | VK_NEXT | The Page Down key | +| `End` | VK_END | The End key | +| `Home` | VK_HOME | The Home key | +| `Left` | VK_LEFT | The Left Arrow key | +| `Up` | VK_UP | The Up Arrow key | +| `Right` | VK_RIGHT | The Right Arrow key | +| `Down` | VK_DOWN | The Down Arrow key | +| `Insert` | VK_INSERT | The Insert key | +| `Delete` | VK_DELETE | The Delete key | +| `Del` | VK_DELETE | The Delete key | +| `Separator` | VK_SEPARATOR | The Separator key | + +## State keys + +| Key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `NumLock` | VK_NUMLOCK | The Num Lock key | +| `ScrollLock` | VK_SCROLL | The Scroll Lock key | +| `Scroll` | VK_SCROLL | The Scroll Lock key | +| `CapsLock` | VK_CAPITAL | The Caps Lock key | +| `Capital` | VK_CAPITAL | The Caps Lock key | + +## OEM keys + +| Key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `KeypadEqual` | VK_OEM_NEC_EQUAL | The Equals (=) key on the numeric keypad (OEM-specific) | +| `Dictionary` | VK_OEM_FJ_JISHO | The Dictionary key (OEM-specific) | +| `Unregister` | VK_OEM_FJ_MASSHOU | The Unregister Word key (OEM-specific) | +| `Register` | VK_OEM_FJ_TOUROKU | The Register Word key (OEM-specific) | +| `LeftOyayubi` | VK_OEM_FJ_LOYA | The Left OYAYUBI key (OEM-specific) | +| `RightOyayubi` | VK_OEM_FJ_ROYA | The Right OYAYUBI key (OEM-specific) | +| `OemPlus` | VK_OEM_PLUS | For any country/region, the Plus Sign (+) key | +| `OemComma` | VK_OEM_COMMA | For any country/region, the Comma (,) key | +| `OemMinus` | VK_OEM_MINUS | For any country/region, the Minus Sign (-) key | +| `OemPeriod` | VK_OEM_PERIOD | For any country/region, the Period (.) key | +| `Oem1` | VK_OEM_1 | Varies by keyboard | +| `Oem2` | VK_OEM_2 | Varies by keyboard | +| `Oem3` | VK_OEM_3 | Varies by keyboard | +| `Oem4` | VK_OEM_4 | Varies by keyboard | +| `Oem5` | VK_OEM_5 | Varies by keyboard | +| `Oem6` | VK_OEM_6 | Varies by keyboard | +| `Oem7` | VK_OEM_7 | Varies by keyboard | +| `Oem8` | VK_OEM_8 | Varies by keyboard | +| `OemAX` | VK_OEM_AX | The AX key on a Japanese AX keyboard | +| `Oem102` | VK_OEM_102 | Either the angle bracket key or the backslash key on the RT 102-key keyboard | + +## Function keys + +| Key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `F1` | VK_F1 | The F1 key | +| `F2` | VK_F2 | The F2 key | +| `F3` | VK_F3 | The F3 key | +| `F4` | VK_F4 | The F4 key | +| `F5` | VK_F5 | The F5 key | +| `F6` | VK_F6 | The F6 key | +| `F7` | VK_F7 | The F7 key | +| `F8` | VK_F8 | The F8 key | +| `F9` | VK_F9 | The F9 key | +| `F10` | VK_F10 | The F10 key | +| `F11` | VK_F11 | The F11 key | +| `F12` | VK_F12 | The F12 key | +| `F13` | VK_F13 | The F13 key | +| `F14` | VK_F14 | The F14 key | +| `F15` | VK_F15 | The F15 key | +| `F16` | VK_F16 | The F16 key | +| `F17` | VK_F17 | The F17 key | +| `F18` | VK_F18 | The F18 key | +| `F19` | VK_F19 | The F19 key | +| `F20` | VK_F20 | The F20 key | +| `F21` | VK_F21 | The F21 key | +| `F22` | VK_F22 | The F22 key | +| `F23` | VK_F23 | The F23 key | +| `F24` | VK_F24 | The F24 key | + +## Numeric keypad keys + +| Key name | Virtual key | Description | +| ----------------- | ----------- | ----------- | +| `Numpad0` | VK_NUMPAD0 | The 0 key on the numeric keypad | +| `Numpad1` | VK_NUMPAD1 | The 1 key on the numeric keypad | +| `Numpad2` | VK_NUMPAD2 | The 2 key on the numeric keypad | +| `Numpad3` | VK_NUMPAD3 | The 3 key on the numeric keypad | +| `Numpad4` | VK_NUMPAD4 | The 4 key on the numeric keypad | +| `Numpad5` | VK_NUMPAD5 | The 5 key on the numeric keypad | +| `Numpad6` | VK_NUMPAD6 | The 6 key on the numeric keypad | +| `Numpad7` | VK_NUMPAD7 | The 7 key on the numeric keypad | +| `Numpad8` | VK_NUMPAD8 | The 8 key on the numeric keypad | +| `Numpad9` | VK_NUMPAD9 | The 9 key on the numeric keypad | +| `Multiply` | VK_MULTIPLY | The Multiply (*) key on the numeric keypad | +| `Add` | VK_ADD | The Add (+) key on the numeric keypad | +| `Subtract` | VK_SUBTRACT | The Subtract (-) key on the numeric keypad | +| `Decimal` | VK_DECIMAL | The Decimal (.) key on the numeric keypad | +| `Divide` | VK_DIVIDE | The Divide (/) key on the numeric keypad | + +## Related articles + +- [Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/keyboardfilter-list-all-configured-key-combinations.md b/windows/configuration/keyboard-filter/keyboardfilter-list-all-configured-key-combinations.md new file mode 100644 index 0000000000..35788409b1 --- /dev/null +++ b/windows/configuration/keyboard-filter/keyboardfilter-list-all-configured-key-combinations.md @@ -0,0 +1,71 @@ +--- +title: List all configured key combinations +description: List all configured key combinations +ms.date: 01/13/2025 +ms.topic: reference +--- + +# List all configured key combinations + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +The following sample Windows PowerShell script uses the Windows Management Instrumentation (WMI) providers for Keyboard Filter to displays all key combination configurations for Keyboard Filter. + +## List-rules.ps1 + +```powershell +# +# Copyright (C) Microsoft. All rights reserved. +# + +<# +.Synopsis + Enumerate all active keyboard filter rules on the system. +.Description + For each instance of WEKF_PredefinedKey, WEKF_CustomKey, and WEKF_Scancode, + get the Enabled property. If Enabled, then output a short description + of the rule. +.Parameter ComputerName + Optional parameter to specify the remote machine that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> +param ( + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + +write-host Enabled Predefined Keys -foregroundcolor cyan +Get-WMIObject -class WEKF_PredefinedKey @CommonParams | + foreach { + if ($_.Enabled) { + write-host $_.Id + } + } + +write-host Enabled Custom Keys -foregroundcolor cyan +Get-WMIObject -class WEKF_CustomKey @CommonParams | + foreach { + if ($_.Enabled) { + write-host $_.Id + } + } + +write-host Enabled Scancodes -foregroundcolor cyan +Get-WMIObject -class WEKF_Scancode @CommonParams | + foreach { + if ($_.Enabled) { + "{0}+{1:X4}" -f $_.Modifiers, $_.Scancode + } + } +``` + +## Related articles + +[Windows PowerShell script samples for keyboard filter](keyboardfilter-powershell-script-samples.md) + +[Keyboard filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/keyboardfilter-powershell-script-samples.md b/windows/configuration/keyboard-filter/keyboardfilter-powershell-script-samples.md new file mode 100644 index 0000000000..7547ba9614 --- /dev/null +++ b/windows/configuration/keyboard-filter/keyboardfilter-powershell-script-samples.md @@ -0,0 +1,26 @@ +--- +title: Windows PowerShell script samples for Keyboard Filter +description: Windows PowerShell script samples for Keyboard Filter +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Windows PowerShell script samples for Keyboard Filter + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +The list below describes sample Windows PowerShell scripts that demonstrate how to use the Windows Management Instrumentation (WMI) providers for Keyboard Filter. + +| Script | Description | +| ------ | ----------- | +| [Add blocked key combinations](keyboardfilter-add-blocked-key-combinations.md) | Demonstrates how to block key combinations for Keyboard Filter.| +| [Disable all blocked key combinations](disable-all-blocked-key-combinations.md) | Demonstrates how to disable all blocked key combinations for Keyboard Filter. | +| [List all configured key combinations](keyboardfilter-list-all-configured-key-combinations.md) | Demonstrates how to list all defined key combination configurations for Keyboard Filter. | +| [Modify global settings](modify-global-settings.md) | Demonstrates how to modify global settings for Keyboard Filter. | +| [Remove key combination configurations](remove-key-combination-configurations.md) | Demonstrates how to remove a custom defined key combination configuration for Keyboard Filter. | + +## Related articles + +[Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/keyboardfilter-wmi-provider-reference.md b/windows/configuration/keyboard-filter/keyboardfilter-wmi-provider-reference.md new file mode 100644 index 0000000000..eeff8800eb --- /dev/null +++ b/windows/configuration/keyboard-filter/keyboardfilter-wmi-provider-reference.md @@ -0,0 +1,23 @@ +--- +title: Keyboard Filter WMI provider reference +description: Keyboard Filter WMI provider reference +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Keyboard Filter WMI provider reference + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Describes the Windows Management Instrumentation (WMI) provider classes that you use to configure Keyboard Filter during run time. + +| WMI Provider Class | Description | +| ------------------ | ----------- | +| [WEKF_CustomKey](wekf-customkey.md) | Blocks or unblocks custom defined key combinations. | +| [WEKF_PredefinedKey](wekf-predefinedkey.md) | Blocks or unblocks predefined key combinations. | +| [WEKF_Scancode](wekf-scancode.md) | Blocks or unblocks key combinations by using keyboard scan codes. | +| [WEKF_Settings](wekf-settings.md) | Enables or disables settings for Keyboard Filter. | + +## Related topics + +[Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/modify-global-settings.md b/windows/configuration/keyboard-filter/modify-global-settings.md new file mode 100644 index 0000000000..39d26be872 --- /dev/null +++ b/windows/configuration/keyboard-filter/modify-global-settings.md @@ -0,0 +1,172 @@ +--- +title: Modify global settings +description: Modify global settings +ms.date: 01/13/2025 +ms.topic: how-to +--- + +# Modify global settings + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +The following sample Windows PowerShell scripts use the Windows Management Instrumentation (WMI) providers to modify global settings for Keyboard Filter. + +The function **Get-Setting** retrieves the value of a global setting for Keyboard Filter. + +In the first script, the function **Set-DisableKeyboardFilterForAdministrators** modifies the value of the **DisableKeyboardFilterForAdministrators** setting. + +In the second script, the function **Set-ForceOffAccessibility** modifies the value of the **ForceOffAccessibility** setting. + +## Set-DisableKeyboardFilterForAdministrators.ps1 + +```powershell +# +# Copyright (C) Microsoft. All rights reserved. +# + +<# +.Synopsis + This script shows how to enumerate WEKF_Settings to find global settings + that can be set on the keyboard filter. In this specific script, the + global setting to be set is "DisableKeyboardFilterForAdministrators". +.Parameter ComputerName + Optional parameter to specify a remote computer that this script should + manage. If not specified, the script will execute all WMI operations + locally. +.Parameter On + Switch if present that sets "DisableKeyboardFilterForAdministrators" to + true. If not present, sets the setting to false. +#> + +param ( + [Switch] $On = $False, + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"}; +if ($PSBoundParameters.ContainsKey("ComputerName")) { + $CommonParams += @{"ComputerName" = $ComputerName}; +} + +function Get-Setting([String] $Name) { + <# + .Synopsis + Get a WMIObject by name from WEKF_Settings + .Parameter Name + The name of the setting, which is the key for the WEKF_Settings class. +#> + $Entry = Get-WMIObject -class WEKF_Settings @CommonParams | + where { + $_.Name -eq $Name + } + + return $Entry +} + +function Set-DisableKeyboardFilterForAdministrators([Bool] $Value) { + <# + .Synopsis + Set the DisableKeyboardFilterForAdministrators setting to true or + false. + .Description + Set DisableKeyboardFilterForAdministrators to true or false based + on $Value + .Parameter Value + A Boolean value +#> + + $Setting = Get-Setting("DisableKeyboardFilterForAdministrators") + if ($Setting) { + if ($Value) { + $Setting.Value = "true" + } else { + $Setting.Value = "false" + } + $Setting.Put() | Out-Null; + } else { + Write-Error "Unable to find DisableKeyboardFilterForAdministrators setting"; + } +} + +Set-DisableKeyboardFilterForAdministrators $On +``` + +## Set-ForceOffAccessibility.ps1 + +```powershell +# +# Copyright (C) Microsoft. All rights reserved. +# + +<# +.Synopsis + This script shows how to enumerate WEKF_Settings to find global settings + that can be set on the keyboard filter. In this specific script, the + global setting to be set is "ForceOffAccessibility". +.Parameter ComputerName + Optional parameter to specify a remote computer that this script should + manage. If not specified, the script will execute all WMI operations + locally. +.Parameter Enabled + Switch if present that sets "ForceOffAccessibility" to true. If not + present, sets the setting to false. +#> + +param ( + [Switch] $Enabled = $False, + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"}; +if ($PSBoundParameters.ContainsKey("ComputerName")) { + $CommonParams += @{"ComputerName" = $ComputerName}; +} + +function Get-Setting([String] $Name) { + <# + .Synopsis + Get a WMIObject by name from WEKF_Settings + .Parameter Name + The name of the setting, which is the key for the WEKF_Settings class. +#> + $Entry = Get-WMIObject -class WEKF_Settings @CommonParams | + where { + $_.Name -eq $Name + } + + return $Entry +} + +function Set-ForceOffAccessibility([Bool] $Value) { + <# + .Synopsis + Set the ForceOffAccessibility setting to true or false. + .Description + Set ForceOffAccessibility to true or false based on $Value + .Parameter Value + A Boolean value +#> + + $Setting = Get-Setting("ForceOffAccessibility") + if ($Setting) { + if ($Value) { + $Setting.Value = "true" + } else { + $Setting.Value = "false" + } + $Setting.Put() | Out-Null; + } else { + Write-Error "Unable to find ForceOffAccessibility setting"; + } +} + +Set-ForceOffAccessibility $Enabled +``` + +## Related topics + +[Windows PowerShell script samples for keyboard filter](keyboardfilter-powershell-script-samples.md) + +[WEKF_Settings](wekf-settings.md) + +[Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/predefined-key-combinations.md b/windows/configuration/keyboard-filter/predefined-key-combinations.md new file mode 100644 index 0000000000..eb25a41a53 --- /dev/null +++ b/windows/configuration/keyboard-filter/predefined-key-combinations.md @@ -0,0 +1,160 @@ +--- +title: Predefined key combinations +description: Predefined key combinations +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Predefined key combinations + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +This topic lists a set of key combinations that are predefined by a keyboard filter. You can list the value of the WEKF_PredefinedKey.Id to get a complete list of key combinations defined by a keyboard filter. + +You can use the values in the WEKF_PredefinedKey.Id column to configure the Windows Management Instrumentation (WMI) class [WEKF_PredefinedKey](wekf-predefinedkey.md). + +## Accessibility keys + +The following table contains predefined key combinations for accessibility: + +| Key combination | WEKF_PredefinedKey.Id | Blocked behavior | +|:-------------------------------------|:--------------------------|:----------------------------| +| Left Alt + Left Shift + Print Screen | **LShift+LAlt+PrintScrn** | Open High Contrast. | +| Left Alt + Left Shift + Num Lock | **LShift+LAlt+NumLock** | Open Mouse Keys. | +| Windows logo key + U | **Win+U** | Open Ease of Access Center. | + +## Application keys + +The following table contains predefined key combinations for controlling application state: + +| Key combination | WEKF_PredefinedKey.Id | Blocked behavior | +|:----------------------|:----------------------|:-------------------| +| Alt + F4 | **Alt+F4** | Close application. | +| Ctrl + F4 | **Ctrl+F4** | Close window. | +| Windows logo key + F1 | **Win+F1** | Open Windows Help. | + +## Shell keys + +The following table contains predefined key combinations for general UI control: + +| Key combination | WEKF_PredefinedKey.Id | Blocked behavior | +|:---------------------------------------|:----------------------|:-------------------------------------------------------------------------------------------------------------------------------------| +| Alt + Spacebar | **Alt+Space** | Open shortcut menu for the active window. | +| Ctrl + Esc | **Ctrl+Esc** | Open the Start screen. | +| Ctrl + Windows logo key + F | **Ctrl+Win+F** | Open Find Computers. | +| Windows logo key + Break | **Win+Break** | Open System dialog box. | +| Windows logo key + E | **Win+E** | Open Windows Explorer. | +| Windows + F | **Win+F** | Open Search. | +| Windows logo key + P | **Win+P** | Cycle through Presentation Mode. Also blocks the Windows logo key + Shift + P and the Windows logo key + Ctrl + P key combinations. | +| Windows logo key + R | **Win+R** | Open Run dialog box. | +| Alt + Tab | **Alt+Tab** | Switch task. Also blocks the Alt + Shift + Tab key combination. | +| Ctrl + Tab | **Ctrl+Tab** | Switch window. | +| Windows logo key + Tab | **Win+Tab** | Cycle through Microsoft Store apps. Also blocks the Windows logo key + Ctrl + Tab and Windows logo key + Shift + Tab key combinations. | +| Windows logo key + D | **Win+D** | Show desktop. | +| Windows logo key + M | **Win+M** | Minimize all windows. | +| Windows logo key + Home | **Win+Home** | Minimize or restore all inactive windows. | +| Windows logo key + T | **Win+T** | Set focus on taskbar and cycle through programs. | +| Windows logo key + B | **Win+B** | Set focus in the notification area. | +| Windows logo key + Minus Sign | **Win+-** | Zoom out. | +| Windows logo key + Plus Sign | **Win++** | Zoom in. | +| Windows logo key + Esc | **Win+Esc** | Close Magnifier application. | +| Windows logo key + Up Arrow | **Win+Up** | Maximize the active window. | +| Windows logo key + Down Arrow | **Win+Down** | Minimize the active window. | +| Windows logo key + Left Arrow | **Win+Left** | Snap the active window to the left half of screen. | +| Windows logo key + Right Arrow | **Win+Right** | Snap the active window to the right half of screen. | +| Windows logo key + Shift + Up Arrow | **Win+Shift+Up** | Maximize the active window vertically. | +| Windows logo key + Shift + Down Arrow | **Win+Shift+Down** | Minimize the active window. | +| Windows logo key + Shift + Left Arrow | **Win+Shift+Left** | Move the active window to left monitor. | +| Windows logo key + Shift + Right Arrow | **Win+Shift+Right** | Move the active window to right monitor. | +| Windows logo key + Spacebar | **Win+Space** | Switch layout. | +| Windows logo key + O | **Win+O** | Lock device orientation. | +| Windows logo key + Page Up | **Win+PageUp** | Move a Microsoft Store app to the left monitor. | +| Windows logo key + Page Down | **Win+PageDown** | Move a Microsoft Store app to right monitor. | +| Windows logo key + Period | **Win+.** | Snap the current screen to the left or right gutter. Also blocks the Windows logo key + Shift + Period key combination. | +| Windows logo key + C | **Win+C** | Activate Cortana in listening mode (after user has enabled the shortcut through the UI). | +| Windows logo key + I | **Win+I** | Open Settings charm. | +| Windows logo key + K | **Win+K** | Open Connect charm. | +| Windows logo key + H | **Win+H** | Start dictation. | +| Windows logo key + Q | **Win+Q** | Open Search charm. | +| Windows logo key + W | **Win+W** | Open Windows Ink workspace. | +| Windows logo key + Z | **Win+Z** | Open app bar. | +| Windows logo key + / | **Win+/** | Open input method editor (IME). | +| Windows logo key + J | **Win+J** | Swap between snapped and filled applications. | +| Windows logo key + Comma | **Win+,** | Peek at the desktop. | +| Windows logo key + V | **Win+V** | Cycle through toasts in reverse order. | + +## Modifier keys + +The following table contains predefined key combinations for modifier keys (such as Shift and Ctrl): + +| Key combination | WEKF_PredefinedKey.Id | Blocked key | +|:-----------------|:----------------------|:-----------------------| +| Alt | **Alt** | Both Alt keys | +| Application | **Application** | Application key | +| Ctrl | **Ctrl** | Both Ctrl keys | +| Shift | **Shift** | Both Shift keys | +| Windows logo key | **Windows** | Both Windows logo keys | + +## Security keys + +The following table contains predefined key combinations for OS security: + +| Key combination | WEKF_PredefinedKey.Id | Blocked behavior | +|:-----------------------|:----------------------|:----------------------------------| +| Ctrl + Alt + Delete | **Ctrl+Alt+Del** | Open the Windows Security screen. | +| Ctrl + Shift + Esc | **Shift+Ctrl+Esc** | Open Task Manager. | +| Windows logo key + L | **Win+L** | Lock the device. | + +## Extended shell keys + +The following table contains predefined key combinations for extended shell functions (such as automatically opening certain apps): + +| Key combination | WEKF_PredefinedKey.Id | Blocked key | +|:--------------------|:----------------------|:------------------------| +| LaunchMail | **LaunchMail** | Start Mail key | +| LaunchMediaSelect | **LaunchMediaSelect** | Select Media key | +| LaunchApp1 | **LaunchApp1** | Start Application 1 key | +| LaunchApp2 | **LaunchApp2** | Start Application 2 key | + +## Browser keys + +The following table contains predefined key combinations for controlling the browser: + +| Key combination | WEKF_PredefinedKey.Id | Blocked key | +|:-----------------|:----------------------|:---------------------------| +| BrowserBack | **BrowserBack** | Browser Back key | +| BrowserForward | **BrowserForward** | Browser Forward key | +| BrowserRefresh | **BrowserRefresh** | Browser Refresh key | +| BrowserStop | **BrowserStop** | Browser Stop key | +| BrowserSearch | **BrowserSearch** | Browser Search key | +| BrowserFavorites | **BrowserFavorites** | Browser Favorites key | +| BrowserHome | **BrowserHome** | Browser Start and Home key | + +## Media keys + +The following table contains predefined key combinations for controlling media playback: + +| Key combination | WEKF_PredefinedKey.Id | Blocked key | +|:----------------|:----------------------|:---------------------| +| VolumeMute | **VolumeMute** | Volume Mute key | +| VolumeDown | **VolumeDown** | Volume Down key | +| VolumeUp | **VolumeUp** | Volume Up key | +| MediaNext | **MediaNext** | Next Track key | +| MediaPrev | **MediaPrev** | Previous Track key | +| MediaStop | **MediaStop** | Stop Media key | +| MediaPlayPause | **MediaPlayPause** | Play/Pause Media key | + +## Microsoft Surface keyboard keys + +The following table contains predefined key combinations for Microsoft Surface devices: + +| Key combination | WEKF_PredefinedKey.Id | Blocked key | +|:------------------------------|:----------------------|:-------------| +| Left Alt + Windows logo key | **AltWin** | Share key | +| Left Ctrl + Windows logo key | **CtrlWin** | Devices key | +| Left Shift + Windows logo key | **ShiftWin** | Search key | +| F21 | **F21** | Settings key | + +## Related topics + +[Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/remove-key-combination-configurations.md b/windows/configuration/keyboard-filter/remove-key-combination-configurations.md new file mode 100644 index 0000000000..624edc69f4 --- /dev/null +++ b/windows/configuration/keyboard-filter/remove-key-combination-configurations.md @@ -0,0 +1,106 @@ +--- +title: Remove key combination configurations +description: Remove key combination configurations +ms.date: 01/13/2025 +ms.topic: reference +--- + +# Remove key combination configurations + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +The following sample Windows PowerShell script uses the Windows Management Instrumentation (WMI) providers for Keyboard Filter to create two functions to remove custom-defined key combination configurations from Keyboard Filter. It demonstrates several ways to use each function. + +The first function, **Remove-Custom-Key**, removes custom key combination configurations. + +The second function, **Remove-Scancode**, removes custom scan code configurations. + +You can't remove the predefined key combination configurations for Keyboard Filter, but you can disable them. + +## Remove-rules.ps1 + +```powershell +# +# Copyright (C) Microsoft. All rights reserved. +# + +<# +.Synopsis + This script shows how to use the build in WMI providers to remove keyboard filter rules. Rules of type WEKF_PredefinedKey cannot be removed. +.Parameter ComputerName + Optional parameter to specify the remote computer that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> + +param( + [string] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + +function Remove-Custom-Key($Id) { + <# + .Synopsis + Remove an instance of WEKF_CustomKey + .Description + Enumerate all instances of WEKF_CustomKey. When an instance has an + Id that matches $Id, delete it. + .Example + Remove-Custom-Key "Ctrl+V" + + This removes the instance of WEKF_CustomKey with a key Id of "Ctrl+V" +#> + + $customInstance = Get-WMIObject -class WEKF_CustomKey @CommonParams | + where {$_.Id -eq $Id} + + if ($customInstance) { + $customInstance.Delete(); + "Removed Custom Filter $Id."; + } else { + "Custom Filter $Id does not exist."; + } +} + +function Remove-Scancode($Modifiers, [int]$Code) { + <# + .Synopsis + Remove and instance of WEKF_Scancode + .Description + Enumerate all instances of WEKF_Scancode. When an instance has a + matching modifiers and code, delete it. + .Example + Remove-Scancode "Ctrl" 37 + + This removes the instance of WEKF_Scancode with Modifiers="Ctrl" and + Scancode=37. +#> + + $scancodeInstance = Get-WMIObject -class WEKF_Scancode @CommonParams | + where {($_.Modifiers -eq $Modifiers) -and ($_.Scancode -eq $Code)} + + if ($scancodeInstance) { + $scancodeInstance.Delete(); + "Removed Scancode $Modifiers+$Code."; + } else { + "Scancode $Modifiers+$Code does not exist."; + } +} + +# Some example uses of the functions defined above. +Remove-Custom-Key "Ctrl+V" +Remove-Custom-Key "Numpad0" +Remove-Custom-Key "Shift+Numpad1" +Remove-Custom-Key "%" +Remove-Scancode "Ctrl" 37 +``` + +## Related articles + +[Windows PowerShell script samples for keyboard filter](keyboardfilter-powershell-script-samples.md) + +[Keyboard filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard filter](index.md) diff --git a/windows/configuration/keyboard-filter/toc.yml b/windows/configuration/keyboard-filter/toc.yml new file mode 100644 index 0000000000..7c09e1a75c --- /dev/null +++ b/windows/configuration/keyboard-filter/toc.yml @@ -0,0 +1,53 @@ +items: +- name: Keyboard Filter + items: + - name: About keyboard filter + href: index.md + - name: Key Names + href: keyboardfilter-key-names.md + - name: Predefined Key Combinations + href: keyboardfilter-list-all-configured-key-combinations.md + - name: WMI Provider Reference + items: + - name: Overview + href: keyboardfilter-wmi-provider-reference.md + - name: Class WEKF_CustomKey + items: + - name: Overview + href: wekf-customkey.md + - name: Add + href: wekf-customkeyadd.md + - name: Remove + href: wekf-customkeyremove.md + - name: Class WEKF_PredefinedKey + items: + - name: Overview + href: wekf-predefinedkey.md + - name: Disable + href: wekf-predefinedkeydisable.md + - name: Enable + href: wekf-predefinedkeyenable.md + - name: Class WEKF_Scancode + items: + - name: Overview + href: wekf-scancode.md + - name: Add + href: wekf-scancodeadd.md + - name: Remove + href: wekf-scancoderemove.md + - name: Class WEKF-Settings + href: wekf-settings.md + - name: PowerShell script samples + items: + - name: Overview + href: keyboardfilter-powershell-script-samples.md + - name: Add blocked key Combinations + href: keyboardfilter-add-blocked-key-combinations.md + - name: Disable all blocked key Combinations + href: disable-all-blocked-key-combinations.md + - name: List all configured key combinations + href: keyboardfilter-list-all-configured-key-combinations.md + - name: Modify global settings + href: modify-global-settings.md + - name: Remove key combination configurations + href: remove-key-combination-configurations.md \ No newline at end of file diff --git a/windows/configuration/keyboard-filter/wekf-customkey.md b/windows/configuration/keyboard-filter/wekf-customkey.md new file mode 100644 index 0000000000..dcc812049e --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-customkey.md @@ -0,0 +1,128 @@ +--- +title: WEKF_CustomKey +description: WEKF_CustomKey +ms.date: 01/13/2025 +ms.topic: reference +--- + + +# WEKF_CustomKey + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Adds or removes custom-defined key combinations. + +## Syntax + +```powershell +class WEKF_CustomKey { + [Static] uint32 Add( + [In] string CustomKey + ); + [Static] uint32 Remove( + [In] string CustomKey + ); + + [Key] string Id; + [Read, Write] boolean Enabled; +}; +``` + +## Members + +The following tables list any methods and properties that belong to this class. + +### Methods + +| Methods | Description | +|---------|-------------| +| [WEKF_CustomKey.Add](wekf-customkeyadd.md) | Creates a new custom key combination and enables Keyboard Filter to block the new key combination. | +| [WEKF_CustomKey.Remove](wekf-customkeyremove.md) | Removes the specified custom key combination. Keyboard Filter stops blocking the key combination that was removed. | + +### Properties + +| Property | Data type | Qualifiers | Description | +|----------|----------------|------------|--------------| +| **Id** | string | [key] | The name of the custom key combination. | +| **Enabled** | Boolean | [read, write] | Indicates if the key is blocked or unblocked. This property can be one of the following values
    - **true** Indicates that the key is blocked.
    - **false** Indicates that the key isn't blocked. | + +### Remarks + +You can specify key combinations by including the modifier keys in the name. The most common modifier names are >Ctrl, >Shift, >Alt, and >Win. You can't block a combination of non-modifier keys. For example, you can block a key combination of >Ctrl+>Shift+>F, but you can't block a key combination of >A+>D. + +When you block a >Shift-modified key, you must enter the key as >Shift + the unmodified key. For example, to block the >% key on an English keyboard layout, you must specify the key as >Shift+>5. Attempting to block >%, results in Keyboard Filter blocking >5 instead. + +When you specify the key combination to block, you must use the English names for the keys. For a list of the key names you can specify, see Keyboard Filter key names. + +## Example + +The following code demonstrates how to add or enable a custom key combination that Keyboard Filter will block by using the Windows Management Instrumentation (WMI) providers for Keyboard Filter. This example modifies the properties directly and doesn't call any of the methods defined in **WEKF_CustomKey**. + +```powershell +<# +.Synopsis + This script shows how to use the WMI provider to enable and add + Keyboard Filter rules through Windows PowerShell on the local computer. +.Parameter ComputerName + Optional parameter to specify a remote machine that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> +param ( + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + +function Enable-Custom-Key($Id) { + <# + .Synopsis + Toggle on a Custom Key Keyboard Filter Rule + .Description + Use Get-WMIObject to enumerate all WEKF_CustomKey instances, + filter against key value "Id", and set that instance's "Enabled" + property to 1/true. + + In the case that the Custom instance does not exist, add a new + instance of WEKF_CustomKey using Set-WMIInstance. + .Example + Enable-Custom-Key "Ctrl+V" + + Enable filtering of the Ctrl + V sequence. +#> + + $custom = Get-WMIObject -class WEKF_CustomKey @CommonParams | + where { + $_.Id -eq "$Id" + }; + + if ($custom) { +# Rule exists. Just enable it. + $custom.Enabled = 1; + $custom.Put() | Out-Null; + "Enabled Custom Filter $Id."; + + } else { + Set-WMIInstance ` + -class WEKF_CustomKey ` + -argument @{Id="$Id"} ` + @CommonParams | Out-Null + + "Added Custom Filter $Id."; + } +} + + +# Some example uses of the function defined above. + +Enable-Custom-Key "Ctrl+V" +Enable-Custom-Key "Numpad0" +Enable-Custom-Key "Shift+Numpad1" +``` + +## Related articles + +[Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard Filter key names](keyboardfilter-key-names.md) diff --git a/windows/configuration/keyboard-filter/wekf-customkeyadd.md b/windows/configuration/keyboard-filter/wekf-customkeyadd.md new file mode 100644 index 0000000000..a48eeedb72 --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-customkeyadd.md @@ -0,0 +1,94 @@ +--- +title: WEKF_CustomKey.Add +description: WEKF_CustomKey.Add +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_CustomKey.Add + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Creates a new custom key combination and enables Keyboard Filter to block the new key combination. + +## Syntax + +```powershell +[Static] uint32 Add( + [In] string CustomKey +); +``` + +## Parameters + +**CustomKey**
    \[in\] The custom key combination to add. For a list of valid key names, see [Keyboard Filter key names](keyboardfilter-key-names.md). + +## Return Value + +Returns an HRESULT value that indicates a [WMI Non-Error Constant](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI Error Constant](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +**WEKF_CustomKey.Add** creates a new **WEKF_CustomKey** object and sets the **Enabled** property of the new object to **true**, and the **Id** property to *CustomKey*. + +If a **WEKF_CustomKey** object already exists with the **Id** property equal to *CustomKey*, then **WEKF_CustomKey.Add** returns an error code and doesn't create a new object or modify any properties of the existing object. If the existing **WEKF_CustomKey** object has the **Enabled** property set to **false**, Keyboard Filter does not block the custom key combination. + +## Example + +The following code demonstrates how to add or enable a custom key that Keyboard Filter will block by using the Windows Management Instrumentation (WMI) providers for Keyboard Filter. + +```powershell +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Create a handle to the class instance so we can call the static methods +$classCustomKey = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WEKF_CustomKey" + +# Create a function to add or enable a key combination for Keyboard Filter to block +function Enable-Custom-Key($KeyId) { + +# Check to see if the custom key object already exists + $objCustomKey = Get-WMIObject -namespace $NAMESPACE -class WEKF_CustomKey | + where {$_.Id -eq "$KeyId"}; + + if ($objCustomKey) { + +# The custom key already exists, so just enable it + $objCustomKey.Enabled = 1; + $objCustomKey.Put() | Out-Null; + "Enabled ${KeyId}."; + + } else { + +# Create a new custom key object by calling the static Add method + $retval = $classCustomKey.Add($KeyId); + +# Check the return value to verify that the Add is successful + if ($retval.ReturnValue -eq 0) { + "Added ${KeyID}." + } else { + "Unknown Error: " + "{0:x0}" -f $retval.ReturnValue + } + } +} + +# Enable Keyboard Filter to block several custom keys + +Enable-Custom-Key "Ctrl+v" +Enable-Custom-Key "Ctrl+v" +Enable-Custom-Key "Shift+4" +Enable-Custom-Key "Ctrl+Alt+w" + +# List all the currently existing custom keys + +$objCustomKeyList = get-WMIObject -namespace $NAMESPACE -class WEKF_CustomKey +foreach ($objCustomKeyItem in $objCustomKeyList) { + "Custom key: " + $objCustomKeyItem.Id + " enabled: " + $objCustomKeyItem.Enabled + } +``` + +## Related articles + +- [WEKF_CustomKey](wekf-customkey.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-customkeyremove.md b/windows/configuration/keyboard-filter/wekf-customkeyremove.md new file mode 100644 index 0000000000..26b1d35bdc --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-customkeyremove.md @@ -0,0 +1,86 @@ +--- +title: WEKF_CustomKey.Remove +description: WEKF_CustomKey.Remove +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_CustomKey.Remove + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Removes a custom key combination, causing Keyboard Filter to stop blocking the removed key combination. + +## Syntax + +```powershell +[Static] uint32 Remove( + [In] string CustomKey +); +``` + +## Parameters + +**CustomKey**
    \[in\] The custom key combination to remove. + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +**WEKF_CustomKey.Remove** removes an existing **WEKF_CustomKey** object. If the object doesn't exist, **WEKF_CustomKey.Remove** returns an error with the value 0x8007007B. + +Because this method is static, you can't call it on an object instance, but must instead call it at the class level. + +## Example + +The following code demonstrates how to remove a custom key from Keyboard Filter so it's no longer blocked by using the Windows Management Instrumentation (WMI) providers for Keyboard Filter. + +```powershell +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Create a handle to the class instance so we can call the static methods +$classCustomKey = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WEKF_CustomKey" + +# Create a function to remove a key combination +function Remove-Custom-Key($KeyId) { + +# Call the static Remove() method on the class reference + $retval = $classCustomKey.Remove($KeyId) + +# Check the return value for status + if ($retval.ReturnValue -eq 0) { + +# Custom key combination removed successfully + "Removed ${KeyID}." + } elseif ($retval.ReturnValue -eq 2147942523) { + +# No object exists with the specified custom key + "Failed to remove ${KeyID}. No object found." + } else { + +# Unknown error, report error code in hexadecimal + "Failed to remove ${KeyID}. Unknown Error: " + "{0:x0}" -f $retval.ReturnValue + } +} + + +# Example of removing a custom key so that Keyboard Filter stops blocking it +Remove-Custom-Key "Ctrl+Alt+w" + +# Example of removing all custom keys that have the Enabled property set to false +$objDisabledCustomKeys = Get-WmiObject -Namespace $NAMESPACE -Class WEKF_CustomKey; + +foreach ($objCustomKey in $objDisabledCustomKeys) { + if (!$objCustomKey.Enabled) { + Remove-Custom-Key($objCustomKey.Id); + } +} +``` + +## Related topics + +- [WEKF_CustomKey](wekf-customkey.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-predefinedkey.md b/windows/configuration/keyboard-filter/wekf-predefinedkey.md new file mode 100644 index 0000000000..dd5de7d93a --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-predefinedkey.md @@ -0,0 +1,112 @@ +--- +title: WEKF_PredefinedKey +description: WEKF_PredefinedKey +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_PredefinedKey + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +This class blocks or unblocks predefined key combinations, such as Ctrl+Alt+Delete. + +## Syntax + +```powershell +class WEKF_PredefinedKey { + [Static] uint32 Enable ( + [In] string PredefinedKey + ); + [Static] uint32 Disable ( + [In] string PredefinedKey + ); + + [Key] string Id; + [Read, Write] boolean Enabled; +}; +``` + +## Members + +The following tables list any constructors, methods, fields, and properties that belong to this class. + +### Methods + +| Methods | Description | +|:-----------------------------------------------------------|:---------------------------------------| +| [WEKF_PredefinedKey.Enable](wekf-predefinedkeyenable.md) | Blocks the specified predefined key. | +| [WEKF_PredefinedKey.Disable](wekf-predefinedkeydisable.md) | Unblocks the specified predefined key. | + +### Properties + +| Property | Data type | Qualifiers | Description | +|:------------|:----------|:--------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Id** | string | [key] | The name of the predefined key combination. | +| **Enabled** | Boolean | [read, write] | Indicates whether the key is blocked or unblocked. To indicate that the key is blocked, specify **true**. To indicate that the key isn't blocked, specify **false**. | + +### Remarks + +All accounts have read access to the **WEKF_PRedefinedKey** class, but only administrator accounts can modify the class. + +For a list of predefined key combinations for Keyboard Filter, see [Predefined key combinations](predefined-key-combinations.md). + +## Example + +The following sample Windows PowerShell script blocks the Ctrl+Alt+Delete and the Ctrl+Esc key combinations when the Keyboard Filter service is running. + +```powershell +<# +.Synopsis + This script shows how to use the built in WMI providers to enable and add + Keyboard Filter rules through Windows PowerShell on the local computer. +.Parameter ComputerName + Optional parameter to specify a remote machine that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> +param ( + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + +function Enable-Predefined-Key($Id) { + <# + .Synposis + Toggle on a Predefined Key Keyboard Filter Rule + .Description + Use Get-WMIObject to enumerate all WEKF_PredefinedKey instances, + filter against key value "Id", and set that instance's "Enabled" + property to 1/true. + .Example + Enable-Predefined-Key "Ctrl+Alt+Delete" + + Enable CAD filtering +#> + + $predefined = Get-WMIObject -class WEKF_PredefinedKey @CommonParams | + where { + $_.Id -eq "$Id" + }; + + if ($predefined) { + $predefined.Enabled = 1; + $predefined.Put() | Out-Null; + Write-Host Enabled $Id + } else { + Write-Error $Id is not a valid predefined key + } +} + +# Some example uses of the function defined above. + +Enable-Predefined-Key "Ctrl+Alt+Delete" +Enable-Predefined-Key "Ctrl+Esc" +``` + +## Related articles + +- [Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-predefinedkeydisable.md b/windows/configuration/keyboard-filter/wekf-predefinedkeydisable.md new file mode 100644 index 0000000000..b49d3383f0 --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-predefinedkeydisable.md @@ -0,0 +1,34 @@ +--- +title: WEKF_PredefinedKey.Disable +description: WEKF_PredefinedKey.Disable +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_PredefinedKey.Disable + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Unblocks the specified predefined key combination. + +## Syntax + +```powershell +[Static] uint32 Disable( + [In] string PredefinedKey +); +``` + +## Parameters + +**PredefinedKey**
    \[in\] The predefined key combination to unblock. For a list of predefined keys, see [Predefined key combinations](predefined-key-combinations.md). + +## Return Value + +Returns an HRESULT value that indicates [WMI Non-error constant](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error constant](/windows/win32/wmisdk/wmi-error-constants). + + +## Related articles + +- [WEKF_PredefinedKey](wekf-predefinedkey.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-predefinedkeyenable.md b/windows/configuration/keyboard-filter/wekf-predefinedkeyenable.md new file mode 100644 index 0000000000..a674afda86 --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-predefinedkeyenable.md @@ -0,0 +1,33 @@ +--- +title: WEKF_PredefinedKey.Enable +description: WEKF_PredefinedKey.Enable +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_PredefinedKey.Enable + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +This method blocks the specified predefined key combination. + +## Syntax + +```powershell +[Static] uint32 Enable( + [In] string PredefinedKey +); +``` + +## Parameters + +**PredefinedKey**
    The predefined key combination to block. For a list of predefined keys, see [Predefined key combinations](predefined-key-combinations.md). + +## Return Value + +Returns an HRESULT value that indicates [WMI non-error constant](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error constant](/windows/win32/wmisdk/wmi-error-constants). + +## Related articles + +- [WEKF_PredefinedKey](wekf-predefinedkey.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-scancode.md b/windows/configuration/keyboard-filter/wekf-scancode.md new file mode 100644 index 0000000000..8cfb7b0f6e --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-scancode.md @@ -0,0 +1,126 @@ +--- +title: WEKF_Scancode +description: WEKF_Scancode +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_Scancode + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Blocks or unblocks key combinations by using the keyboard scan code, which is an integer number that is generated whenever a key is pressed or released. + +## Syntax + +```powershell +class WEKF_Scancode { + [Static] uint32 Add( + [In] string Modifiers, + [In] uint16 scancode + ); + [Static] uint32 Remove( + [In] string Modifiers, + [In] uint16 Scancode + ); + + [Key] string Modifiers; + [Key] uint16 Scancode; + [Read, Write] boolean Enabled; +} +``` + +## Members + +The following tables list any constructors, methods, fields, and properties that belong to this class. + +### Methods + +| Methods | Description | +|---------|-------------| +| [WEKF_Scancode.Add](wekf-scancodeadd.md) | Adds a new custom scan code combination and enables Keyboard Filter to block the new scan code combination. | +| [WEKF_Scancode.Remove](wekf-scancoderemove.md) | Removes the specified custom scan code combination. Keyboard Filter stops blocking the scan code combination that was removed. | + +### Properties + +| Property | Data type | Qualifiers | Description | +|----------|----------------|------------|-------------| +| **Modifiers** | string | [key] | The modifier keys that are part of the key combination to block. | +| **Scancode** | uint16 | [key] | The scan code part of the key combination to block. | +| **Enabled** | Boolean | [read, write] | Indicates whether the scan code is blocked or unblocked. This property can be one of the following values:
    - **true** Indicates that the scan code is blocked.
    - **false** Indicates that the scan code isn't blocked. | + +### Remarks + +Scan codes are generated by the keyboard whenever a key is pressed. The same physical key will always generate the same scan code, regardless of which keyboard layout is currently being used by the system. + +You can specify key combinations by including the modifier keys in the *Modifiers* parameter of the **Add** method or by modifying the **Modifiers** property. The most common modifier names are >Ctrl, >Shift, >Alt, and >Win. + +## Example + +The following code demonstrates how to add or enable a keyboard scan code that Keyboard Filter will block by using the Windows Management Instrumentation (WMI) providers for Keyboard Filter. This example modifies the properties directly, and doesn't call any of the methods defined in **WEKF_Scancode**. + +```powershell +<# +.Synopsis + This script shows how to use the WMI provider to enable and add + Keyboard Filter rules through Windows Powershell on the local computer. +.Parameter ComputerName + Optional parameter to specify a remote machine that this script should + manage. If not specified, the script will execute all WMI operations + locally. +#> +param ( + [String] $ComputerName +) + +$CommonParams = @{"namespace"="root\standardcimv2\embedded"} +$CommonParams += $PSBoundParameters + + +function Enable-Scancode($Modifiers, [int]$Code) { + <# + .Synopsis + Toggle on a Scancode Keyboard Filter Rule + .Description + Use Get-WMIObject to enumerate all WEKF_Scancode instances, + filter against key values of "Modifiers" and "Scancode", and set + that instance's "Enabled" property to 1/true. + + In the case that the Scancode instance does not exist, add a new + instance of WEKF_Scancode using Set-WMIInstance. + .Example + Enable-Predefined-Key "Ctrl+V" + + Enable filtering of the Ctrl + V sequence. +#> + + $scancode = + Get-WMIObject -class WEKF_Scancode @CommonParams | + where { + ($_.Modifiers -eq $Modifiers) -and ($_.Scancode -eq $Code) + } + + if($scancode) { + $scancode.Enabled = 1 + $scancode.Put() | Out-Null + "Enabled Custom Scancode {0}+{1:X4}" -f $Modifiers, $Code + } else { + Set-WMIInstance ` + -class WEKF_Scancode ` + -argument @{Modifiers="$Modifiers"; Scancode=$Code} ` + @CommonParams | Out-Null + + "Added Custom Scancode {0}+{1:X4}" -f $Modifiers, $Code + } +} + +# Some example uses of the function defined above. + +Enable-Scancode "Ctrl" 37 +``` + +## Related articles + +[Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-scancodeadd.md b/windows/configuration/keyboard-filter/wekf-scancodeadd.md new file mode 100644 index 0000000000..cd4b70efe8 --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-scancodeadd.md @@ -0,0 +1,42 @@ +--- +title: WEKF_Scancode.Add +description: WEKF_Scancode.Add +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_Scancode.Add + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +This method adds a new custom scan code combination and enables Keyboard Filter to block the new combination. + +## Syntax + +```powershell +[Static] uint32 Add( + [In] string Modifiers, + [In] uint16 Scancode +); +``` + +## Parameters + +**Modifers**
    The modifier keys that are part of the key combination to block. + +**Scancode**
    The hardware scan code of the key to block. + +## Return Value + +Returns an HRESULT value that indicates [WMI non-error constant](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error constant](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +**WEKF_Scancode.Add** creates a new **WEKF_Scancode** object and sets the **Enabled** property of the new object to **true**. + +If a **WEKF_Scancode** object already exists with same *Modifiers* and *Scancode* properties, then **WEKF_Scancode.Add** returns an error code and doesn't create a new object or modify any properties of the existing object. If the existing **WEKF_Scancode** object has the **Enabled** property set to **false**, Keyboard Filter doesn't block the scan code. + +## Related articles + +- [WEKF_Scancode](wekf-scancode.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-scancoderemove.md b/windows/configuration/keyboard-filter/wekf-scancoderemove.md new file mode 100644 index 0000000000..18bc6d3514 --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-scancoderemove.md @@ -0,0 +1,42 @@ +--- +title: WEKF_Scancode.Remove +description: WEKF_Scancode.Remove +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_Scancode.Remove + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +This method removes a custom scan code key combination, causing Keyboard Filter to stop blocking the removed combination. + +## Syntax + +```powershell +[Static] uint32 Remove( + [In] string Modifiers, + [In] uint16 Scancode +); +``` + +## Parameters + +**Modifiers**
    The modifier keys of the combination to remove. + +**Scancode**
    The scan code of the combination to remove. + +## Return Value + +Returns an HRESULT value that indicates [WMI non-error constant](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error constant](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +**WEKF_Scancode.Remove** removes an existing **WEKF_Scancode** object. If the object doesn't exist, **WEKF_Scancode.Remove** returns an error with the value 0x8007007B. + +Because this method is static, you can't call it on an object instance, but must instead call it at the class level. + +## Related articles + +- [WEKF_Scancode](wekf-scancode.md) +- [Keyboard Filter](index.md) diff --git a/windows/configuration/keyboard-filter/wekf-settings.md b/windows/configuration/keyboard-filter/wekf-settings.md new file mode 100644 index 0000000000..df43feb21e --- /dev/null +++ b/windows/configuration/keyboard-filter/wekf-settings.md @@ -0,0 +1,95 @@ +--- +title: WEKF_Settings +description: WEKF_Settings +ms.date: 01/13/2025 +ms.topic: reference +--- + +# WEKF_Settings + +[!INCLUDE [supported-os-enterprise-plus](../../../includes/iot/supported-os-enterprise-plus.md)] + +Enables or disables settings for Keyboard Filter. + +## Syntax + +```powershell +class WEKF_Settings { + [Key] string Name; + [Read, Write] string Value; +}; +``` + +## Members + +The following tables list any methods and properties that belong to this class. + +### Properties + +| Property | Data type | Qualifiers | Description | +|----------|----------------|------------|-------------| +| **Name** | string | [key] | Indicates the name of the Keyboard Filter setting that this object represents. See the Remarks section for a list of valid setting names. | +| **Value** | string | [read, write] | Represents the value of the **Name** setting. The value isn't case-sensitive.
    See the Remarks section for a list of valid values for each setting. | + +### Remarks + +You must be signed in to an administrator account to make any changes to this class. + +Each **WEKF_Settings** object represents a single Keyboard Filter setting. You can enumerate across all **WEKF_Settings** objects to see the value of all Keyboard Filter settings. + +The following table lists all settings available for Keyboard Filter. + +| Setting name | Description | +|--------------|-------------| +| **DisableKeyboardFilterForAdministrators** | This setting specifies whether Keyboard Filter is enabled or disabled for administrator accounts. Set to **true** to disable Keyboard Filter for administrator accounts; otherwise, set to **false**. Set to **true** by default. | +| **ForceOffAccessibility** | This setting specifies whether Keyboard Filter blocks users from enabling Ease of Access features. Set to **true** to force disabling the Ease of Access features. Set to **false** to allow enabling the Ease of Access features. Set to **false** by default.
    Changing this setting to **false** doesn't automatically enable Ease of Access features; you must manually enable them. | +| **BreakoutKeyScanCode** | This setting specifies the scan code of the key that enables a user to break out of an account that is locked down with Keyboard Filter. A user can press this key consecutively five times to switch to the Welcome screen.
    By default, the BreakoutKeyScanCode is set to the scan code for the left Windows logo key. | + +One instance of the **WEKF_Settings** class exists for each valid setting. + +Changes to the **DisableKeyboardFilterForAdministrator** setting are applied when an administrator account signs in, and applies to all applications run during the user session. If a user without an administrator account runs an application as an administrator, Keyboard Filter is still enabled, regardless of the **DisableKeyboardFilterForAdministrator** setting. + +Changes to the **BreakoutKeyScanCode** setting don't take effect until you restart the device. + +If the **BreakoutKeyScanCode** is set to the scan code for either the left Windows logo key or the right Windows logo key, both Windows Logo keys will work as the breakout key. + +The **BreakoutKeyScanCode** setting only applies to accounts where Keyboard Filter is active. If the scan code is set to a value that doesn't map to any key, such as 0 (zero), then you must use another method to access the Welcome screen if you need to service the device, such as remotely connecting, or restarting the device if automatic sign-in isn't enabled. + +> [!IMPORTANT] +> On some devices, if the breakout key is pressed too rapidly, the key presses may not register. We recommend that you include a slight pause between each breakout key press. + +> [!WARNING] +> When setting the **BreakoutKeyScanCode**, be sure to use the scan code of the key, and not the virtual key value. + +### Example + +The following Windows PowerShell script demonstrates how to use this class to modify the breakout mode key for Keyboard Filter. This example sets the **BreakoutKeyScanCode** setting to the scan code for the Home key on a standard keyboard. + +```powershell +#---Define variables--- + +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Define the decimal scan code of the Home key + +$HomeKeyScanCode = 71 + +# Get the BreakoutKeyScanCode setting from WEKF_Settings + +$BreakoutMode = get-wmiobject -class wekf_settings -namespace $NAMESPACE | where {$_.name -eq "BreakoutKeyScanCode"} + +# Set the breakout key to the Home key. + +$BreakoutMode.value = $HomeKeyScanCode + +# Push the change into the WMI configuration. You must restart your device before this change takes effect. + +$BreakoutMode.put() +``` + +## Related articles + +[Keyboard Filter WMI provider reference](keyboardfilter-wmi-provider-reference.md) + +[Keyboard Filter](index.md) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index 3ffeaa9b73..97c7612c30 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -12,7 +12,7 @@ You can install multiple Universal Windows Platform (UWP) apps and Windows deskt When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#add-a-windows-desktop-application-using-advanced-editor). > [!IMPORTANT] -> If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise. Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to add Microsoft 365 Apps to Windows devices with Microsoft Intune.](/intune/apps-add-office365) +> If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise. Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to add Microsoft 365 Apps to Windows devices with Microsoft Intune.](/mem/intune/apps/apps-add-office365) ## Settings for UWP apps diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md index ec61311214..6c82ea8c13 100644 --- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md +++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md @@ -1,7 +1,7 @@ --- title: How provisioning works in Windows description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings. -ms.topic: conceptual +ms.topic: article ms.date: 07/09/2024 --- diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index a226b877f3..14273f9e99 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -2,7 +2,7 @@ title: Provisioning packages overview description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages are and what they do. ms.reviewer: kevinsheehan -ms.topic: conceptual +ms.topic: install-set-up-deploy ms.date: 07/08/2024 --- diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md index d8292d3413..26ceb503e8 100644 --- a/windows/configuration/provisioning-packages/provisioning-powershell.md +++ b/windows/configuration/provisioning-packages/provisioning-powershell.md @@ -1,7 +1,7 @@ --- title: PowerShell cmdlets for provisioning packages in Windows description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows devices. -ms.topic: conceptual +ms.topic: article ms.date: 07/09/2024 --- diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md index a4f68379ee..b203b2e332 100644 --- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md +++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md @@ -1,7 +1,7 @@ --- title: Settings changed when you uninstall a provisioning package description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows desktop client devices. -ms.topic: conceptual +ms.topic: install-set-up-deploy ms.date: 07/09/2024 --- diff --git a/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md b/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md index 15c139b82e..4d13b9b87e 100644 --- a/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md +++ b/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md @@ -1,7 +1,7 @@ --- title: Configure a shared or guest Windows device description: Description of how to configured Shared PC mode, which is a Windows feature that optimizes devices for shared use scenarios. -ms.date: 09/06/2024 +ms.date: 10/31/2024 ms.topic: how-to --- diff --git a/windows/configuration/shared-pc/shared-devices-concepts.md b/windows/configuration/shared-pc/shared-devices-concepts.md index fdb4b3ed52..84659c4325 100644 --- a/windows/configuration/shared-pc/shared-devices-concepts.md +++ b/windows/configuration/shared-pc/shared-devices-concepts.md @@ -1,7 +1,7 @@ --- title: Manage multi-user and guest Windows devices description: options to optimize Windows devices used in shared scenarios, such touchdown spaces in an enterprise, temporary customer use in retail or shared devices in a school. -ms.date: 02/06/2024 +ms.date: 10/31/2024 ms.topic: concept-article --- diff --git a/windows/configuration/shared-pc/shared-pc-technical.md b/windows/configuration/shared-pc/shared-pc-technical.md index 62edc9d451..dbd8ff2fd7 100644 --- a/windows/configuration/shared-pc/shared-pc-technical.md +++ b/windows/configuration/shared-pc/shared-pc-technical.md @@ -1,7 +1,7 @@ --- title: Shared PC technical reference description: List of policies and settings applied by the Shared PC options. -ms.date: 02/06/2024 +ms.date: 10/31/2024 ms.topic: reference --- diff --git a/windows/configuration/shell-launcher/browser-support.md b/windows/configuration/shell-launcher/browser-support.md new file mode 100644 index 0000000000..1c3b383033 --- /dev/null +++ b/windows/configuration/shell-launcher/browser-support.md @@ -0,0 +1,47 @@ +--- +title: Browser Support +ms.date: 03/30/2023 +ms.topic: concept-article +description: Learn about browser support in Kiosk Mode +--- + +# Browser Support + +Today, you can use two browsers, Internet Explorer 11 and [Microsoft Edge](/deployedge/microsoft-edge-configure-kiosk-mode) to create an assigned access single-app or multi-app kiosk experience. + +## Microsoft Edge Kiosk Mode + +> Available for LTSC starting in [Windows 10 IoT Enterprise 2021 LTSC](/windows/iot/iot-enterprise/whats-new/Windows-10-IoT-Enterprise-LTSC-2021) + +[Microsoft Edge kiosk mode](/deployedge/microsoft-edge-configure-kiosk-mode) offers two lockdown experiences of the browser so organizations can create, manage, and provide the best experience for their customers. The following lockdown experiences are available: + +* Digital/Interactive Signage experience - Displays a specific site in full-screen mode. +* Public-Browsing experience - Runs a limited multi-tab version of Microsoft Edge. + +Both experiences are running a Microsoft Edge InPrivate session, which protects user data. + +## Internet Explorer 11 + +[Internet Explorer 11](/internet-explorer/internet-explorer) is considered a legacy browser, in subsequent releases. + +In anticipation of that, you can use [Internet Explorer (IE) mode](/deployedge/edge-ie-mode) on Microsoft Edge. IE mode allows you to run legacy web apps and modern web apps in a single browser. + +> [!NOTE] +> For in-support Windows 10 IoT Enterprise [Semi-Annual Channel (SAC) releases](/lifecycle/products/windows-10-iot-enterprise), Internet Explorer 11 will reach end of support on June 15, 2022. +> +> Internet Explorer 11 follows the Long-Term-Servicing-Channel (LTSC) Lifecycle for [Windows 10 IoT Enterprise LTSC](/lifecycle/products/?terms=Windows%2010%20IoT%20Enterprise%20LTSC) products. + +## Supported Versions + +| Browser | Internet Explorer 11 | Microsoft Edge Legacy | Microsoft Edge | +|--|--|--|--| +| OS Release | [IE11 App](/internet-explorer/internet-explorer) | [Edge Browser - Legacy](/deployedge/microsoft-edge-kiosk-mode-transition-plan) | [New Edge Browser](/deployedge/microsoft-edge-configure-kiosk-mode) | +| Windows 10 IoT Enterprise LTSC 2019 | [Follows OS Release Support Lifecycle](/lifecycle/products/windows-10-iot-enterprise-ltsc-2019) | No browser security updates after March, 9, 2021 (removed where applicable). In-box engine supported until OS end of service | Microsoft Edge and WebView2 Runtime not in-box (requires app migration from EdgeHTML) | +| Windows 10 IoT Enterprise, version 21H2 | End of support June 15, 2022 | Removed & replaced with New Microsoft Edge Browser in May 2021 Update | Included in-box or installed with May 2021 Update | +| Windows 10 IoT Enterprise LTSC 2021 | [Follows OS Release Support Lifecycle](/lifecycle/products/windows-10-iot-enterprise-ltsc-2021) | Not included | Microsoft Edge included in-box and follows [Modern Lifecycle Policy](/lifecycle/policies/modern) | +| Windows 11 IoT Enterprise | N/A | N/A | Microsoft Edge included in-box and follows [Modern Lifecycle Policy](/lifecycle/policies/modern) | + +## Additional Resources + +* [Configure Microsoft Edge kiosk mode](/deployedge/microsoft-edge-configure-kiosk-mode) +* [Plan your kiosk mode transition](/deployedge/microsoft-edge-kiosk-mode-transition-plan) diff --git a/windows/configuration/shell-launcher/index.md b/windows/configuration/shell-launcher/index.md new file mode 100644 index 0000000000..50eeb99ef6 --- /dev/null +++ b/windows/configuration/shell-launcher/index.md @@ -0,0 +1,344 @@ +--- +title: Shell Launcher +description: Shell Launcher +ms.date: 06/07/2018 +ms.topic: overview +--- + +# Shell Launcher + +Using Shell Launcher, you can configure a kiosk device to use almost any application or executable as your custom shell. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. + +You can also configure Shell Launcher to launch different shell applications for different users or user groups. + +There are a few exceptions to the applications and executables you can use as a custom shell: + +- You can't use the following executable as a custom shell: `C:\\Windows\\System32\\Eshell.exe`. Using Eshell.exe as the default shell will result in a blank screen after user signs in. +- You can't use a Universal Windows app as a custom shell. +- You can't use a custom shell to launch Universal Windows apps, for example, the Settings app. +- You can't use an application that launches a different process and exits as a custom shell. For example, you can't specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher isn't aware of the newly created wordpad.exe process, Shell Launcher takes action based on the exit code of **Write.exe**, and restart the custom shell. +- You can't prevent the system from shutting down. For Shell Launcher V1 and V2, you can't block the session ending by returning FALSE upon receiving the [WM_QUERYENDSESSION](/windows/win32/shutdown/wm-queryendsession) message in a graphical application or returning FALSE in the [handler routine](/windows/console/handlerroutine) that is added through the [SetConsoleCtrlHandler](/windows/console/setconsolectrlhandler) function in a console application. + +> [!NOTE] +> You cannot configure both Shell Launcher and assigned access on the same system. +> +> Use **Shell Launcher V2**, you can specify a Universal Windows app as a custom shell. Check [Use Shell Launcher to create a Windows 10 kiosk](/windows/configuration/kiosk-shelllauncher) for the differences between Shell Launcher v1 and Shell Launcher V2. + +Shell Launcher processes the **Run** and **RunOnce** registry keys before starting the custom shell, so your custom shell doesn't need to handle the automatic startup of other applications and services. + +Shell Launcher also handles the behavior of the system when your custom shell exits. You can configure the shell exit behavior if the default behavior doesn't meet your needs. + +Methods of controlling access to other desktop applications and system components can be used in addition to using the Shell Launcher such as, [Group Policy](https://www.microsoft.com/download/details.aspx?id=25250), [AppLocker](/windows/iot/iot-enterprise/customize/application-control#applocker), and [Mobile Device Management](/windows/client-management/mdm/) + +> [!NOTE] +> +> In Shell Launcher v1, available in Windows 10, you can only specify a Windows desktop application as the replacement shell. In Shell Launcher v2, available in Windows 10, version 1809 and above, you can also specify a UWP app as the replacement shell. +> +> To use Shell Launcher v2 in version 1809, you need to install the [KB4551853 update](https://support.microsoft.com/topic/may-12-2020-kb4551853-os-build-17763-1217-c2ea33f7-4506-dd13-2739-d9c7bb80b26d). + +## Differences between Shell Launcher v1 and Shell Launcher v2 + +Shell Launcher v1 replaces ```explorer.exe```, the default shell, with ```eshell.exe```, which can launch a Windows desktop application. +Shell Launcher v2 replaces ```explorer.exe``` with ```customshellhost.exe```. This new executable file can launch a Windows desktop application or a UWP app. +In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers more enhancements: + +- You can use a custom Windows desktop application that can then launch UWP apps, such as Settings and Touch Keyboard. +- From a custom UWP shell, you can launch secondary views and run on multiple monitors. +- The custom shell app runs in full screen, and can run other apps in full screen on user's demand. +For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/microsoft/Windows-IoT-Samples/tree/master/samples/ShellLauncher/ShellLauncherV2). + +## Requirements + +Windows 10 Enterprise or Windows 10 Education. + +## Terminology + +- **Turn on, enable:** To make the setting available to the device and optionally apply the settings to the device. +- **Configure:** To customize the setting or subsettings. +- **Embedded Shell Launcher:** This feature is called Embedded Shell Launcher in Windows 10, version 1511. +- **Custom Shell Launcher:** This feature is called Shell Launcher in Windows 10, version 1607 and later. + +## Turn on Shell Launcher + +Shell Launcher is an optional component and isn't turned on by default in Windows 10. It must be turned on prior to configuring. You can turn on and configure Shell Launcher in a customized Windows 10 image (.wim) if Microsoft Windows hasn't been installed. If Windows has already been installed, you must turn on Shell Launcher before applying a provisioning package to configure Shell Launcher. + +### Enable Shell Launcher using Control Panel + +1. In the **Search the web and Windows** field, type **Programs and Features** and either press **Enter** or tap or select **Programs and Features** to open it. +1. In the **Programs and Features** window, select **Turn Windows features on or off**. +1. In the **Windows Features** window, expand the **Device Lockdown** node, select or clear the checkbox for **Shell Launcher**, and then select **OK.** +1. The **Windows Features** window indicates that Windows is searching for required files and displays a progress bar. Once found, the window indicates that Windows is applying the changes. When completed, the window indicates the requested changes are completed. +1. Select **Close** to close the **Windows Features** window. + +> [!NOTE] +> Turning on Shell Launcher does not require a device restart. + +### Enable Shell Launcher by calling WESL_UserSetting + +1. Enable or disable Shell Launcher by calling the WESL_UserSetting.SetEnabled function in the Windows Management Instrumentation (WMI) class WESL_UserSetting. +1. If you enable or disable Shell Launcher using WESL_UserSetting, the changes don't affect any sessions that are currently signed in; you must sign out and sign back in. + +This example uses a Windows image called install.wim, but you can use the same procedure to apply a provisioning package (for more information on DISM, see [What Is Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/what-is-dism). + +### Enable Shell Launcher using DISM + +1. Open a command prompt with administrator privileges. +1. Copy install.wim to a temporary folder on hard drive (in the following steps, we assume it's called C:\\wim). +1. Create a new directory. + + ```CMD + md c:\wim + ``` + +1. Mount the image. + + ```CMD + dism /mount-wim /wimfile:c:\bootmedia\sources\install.wim /index:1 /MountDir:c:\wim + ``` + +1. Enable the feature. + + ```CMD + dism /image:c:\wim /enable-feature /all /featureName:Client-EmbeddedShellLauncher + ``` + +1. Commit the change. + + ```CMD + dism /unmount-wim /MountDir:c:\wim /Commit + ``` + +### Enable Shell Launcher using Windows Configuration Designer + +The Shell Launcher settings are also available as Windows provisioning settings so you can configure these settings to be applied during the image runtime. You can set one or all Shell Launcher settings by creating a provisioning package using Windows Configuration Designer and then applying the provisioning package during image deployment time or runtime. If Windows hasn't been installed and you're using Windows Configuration Designer to create installation media with settings for Shell Launcher included in the image or you're applying a provisioning package during setup, you must enable Shell Launcher on the installation media with DISM in order for a provisioning package to successfully apply. + +Use the following steps to create a provisioning package that contains the ShellLauncher settings. + +1. Build a provisioning package in Windows Configuration Designer by following the instructions in [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package). +1. In the **Available customizations** page, select **Runtime settings** > **SMISettings** > **ShellLauncher**. +1. Set the value of **Enable** to **ENABLE**. More options to configure Shell Launcher appears, and you can set the values as desired. +1. Once you have finished configuring the settings and creating the provisioning package, you can apply the package to the image deployment time or runtime. See the [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) for more information. The process for applying the package to a Windows 10 Enterprise image is the same. + +## Configure Shell Launcher + +There are two ways you can configure Shell Launcher: + +1. In Windows 10, version 1803, you can configure Shell Launcher using the **ShellLauncher** node of the Assigned Access Configuration Service Provider (CSP). See [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp) for details. Configuring Shell Launcher using this method also automatically enables Shell Launcher on the device, if the device supports it. +1. Use the Shell Launcher WMI providers directly in a PowerShell script or application. + +You can configure the following options for Shell Launcher: + +- Enable or disable Shell Launcher. +- Specify a shell configuration for a specific user or group. +- Remove a shell configuration for a specific user or group. +- Change the default shell configuration. +- Get information on a shell configuration for a specific user or group. + +Any changes don't take effect until a user signs in. + +## Launch different shells for different user accounts + +By default, Shell Launcher runs the default shell, which is specified when you create the OS image at design time. The default shell is set to Cmd.exe, but you can specify any executable file to be the default shell. + +You can configure Shell Launcher to launch a different shell for specific users or groups if you don't want to run the default shell. For example, you might configure a device to run a custom application shell for guest accounts, but run the standard Windows Explorer shell for administrator accounts in order to service the device. + +If you use the WMI providers to configure Shell Launcher for a user or group at run time, you must use the security identifier (SID) for that user or group; you can't use the user name or group name. + +For more information about common security identifiers, see [Well-known SIDs](/windows/win32/secauthz/well-known-sids). + +When the current signed in account belongs to two or more groups that have different configurations defined for each group, Shell Launcher uses the first configuration it finds. The search order isn't defined, so we recommend that you avoid assigning a user to multiple groups with different Shell Launcher configurations. + +## Perform an action when the shell exits + +When a custom shell exits, Shell Launcher can perform one of four actions: + +|Action|Description| +|:---:|:---| +|0|Restart the shell.| +|1|Restart the device.| +|2|Shut down the device.| +|3|Do nothing.| + +> [!IMPORTANT] +> Make sure that your shell application does not automatically exit and is not automatically closed by any features such as Dialog Filter, as this can lead to an infinite cycle of exiting and restarting, unless the return code action is set to do nothing. + +### Default return code action + +You can define a default return code action for Shell Launcher with the DefaultReturnCodeAction setting. If you don't change the initial value, the default return code action is set to 0 (zero), which indicates that Shell Launcher restarts the shell when the shell exits. + +### Map the exit code to a Shell Launcher action + +Shell Launcher can take a specific action based on the exit code returned by the shell. For any given exit code returned by the shell, you can configure the action that Shell Launcher takes by mapping that exit code to one of the shell exit actions. + +If the exit code doesn't match a defined value, Shell Launcher performs the default return code action. + +For example, your shell might return exit code values of -1, 0, 1, or 255 depending on how the shell exits. You can configure Shell Launcher to: + +- restart the device (1) when the shell returns an exit code of value -1 +- restart the shell (0) when the shell returns an exit code of value 0 +- do nothing (3) when the shell returns an exit code of value 1 +- shut down the device (2) when the shell returns an exit code of value 255 + +Your custom return code action mapping would look like this: + +|Exit code|Action| +|:----:|----| +|-1|1 (restart the device)| +|0|0 (restart the shell)| +|1|3 (do nothing)| +|255|2 (shut down the device)| + +## Set your custom shell + +Modify the following PowerShell script as appropriate and run the script on the device. + +```PowerShell +# Check if shell launcher license is enabled +function Check-ShellLauncherLicenseEnabled +{ + [string]$source = @" +using System; +using System.Runtime.InteropServices; + +static class CheckShellLauncherLicense +{ + const int S_OK = 0; + + public static bool IsShellLauncherLicenseEnabled() + { + int enabled = 0; + + if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) { + enabled = 0; + } + return (enabled != 0); + } + + static class NativeMethods + { + [DllImport("Slc.dll")] + internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value); + } + +} +"@ + + $type = Add-Type -TypeDefinition $source -PassThru + + return $type[0]::IsShellLauncherLicenseEnabled() +} + +[bool]$result = $false + +$result = Check-ShellLauncherLicenseEnabled +"`nShell Launcher license enabled is set to " + $result +if (-not($result)) +{ + "`nThis device doesn't have required license to use Shell Launcher" + exit +} + +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Create a handle to the class instance so we can call the static methods. +try { + $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" + } catch [Exception] { + write-host $_.Exception.Message; + write-host "Make sure Shell Launcher feature is enabled" + exit + } + + +# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. + +$Admins_SID = "S-1-5-32-544" + +# Create a function to retrieve the SID for a user account on a machine. + +function Get-UsernameSID($AccountName) { + + $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName) + $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) + + return $NTUserSID.Value +} + +# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. + +$Cashier_SID = Get-UsernameSID("Cashier") + +# Define actions to take when the shell program exits. + +$restart_shell = 0 +$restart_device = 1 +$shutdown_device = 2 +$do_nothing = 3 + +# Examples. You can change these examples to use the program that you want to use as the shell. + +# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed. + +$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device) + +# Display the default shell to verify that it was added correctly. + +$DefaultShellObject = $ShellLauncherClass.GetDefaultShell() + +"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction + +# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed. + +$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell) + +# Set Explorer as the shell for administrators. + +$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe") + +# View all the custom shells defined. + +"`nCurrent settings for custom shells:" +Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction + +# Enable Shell Launcher + +$ShellLauncherClass.SetEnabled($TRUE) + +$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() + +"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled + +# Remove the new custom shells. + +$ShellLauncherClass.RemoveCustomShell($Admins_SID) + +$ShellLauncherClass.RemoveCustomShell($Cashier_SID) + +# Disable Shell Launcher + +$ShellLauncherClass.SetEnabled($FALSE) + +$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() + +"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled +``` + +> [!NOTE] +> The previous script includes examples of multiple configuration options, including removing a custom shell and disabling Shell Launcher. It is not intended to be run as-is. + +## Shell Launcher user rights + +A custom shell is launched with the same level of user rights as the account that is signed in. This means that a user with administrator rights can perform any system action that requires administrator rights, including launching other applications with administrator rights, while a user without administrator rights can't. + +> [!WARNING] +> If your shell application requires administrator rights and needs to be elevated, and User Account Control (UAC) is present on your device, you must disable UAC in order for Shell Launcher to launch the shell application. + +## Related articles + +- [Unbranded Boot](../unbranded-boot/index.md) +- [Custom Logon](../custom-logon/index.md) +- [Use Shell Launcher to create a Windows 10 Kiosk](/windows/configuration/kiosk-shelllauncher) +- [Launch different shells for different user accounts](/windows-hardware/customize/enterprise/shell-launcher#launch-different-shells-for-different-user-accounts) +- [Perform an action when the shell exits](/windows-hardware/customize/enterprise/shell-launcher#perform-an-action-when-the-shell-exits) +- [Shell Launcher user rights](/windows-hardware/customize/enterprise/shell-launcher#shell-launcher-user-rights) diff --git a/windows/configuration/shell-launcher/kiosk-mode.md b/windows/configuration/shell-launcher/kiosk-mode.md new file mode 100644 index 0000000000..d5285fa51d --- /dev/null +++ b/windows/configuration/shell-launcher/kiosk-mode.md @@ -0,0 +1,61 @@ +--- +title: Kiosk Mode +ms.date: 01/18/2024 +ms.topic: overview +description: Learn about Kiosk Mode in Windows IoT Enterprise. +--- + +# Kiosk mode + +Windows IoT Enterprise allows you to build fixed purpose devices such as ATM machines, point-of-sale terminals, medical devices, digital signs, or kiosks. Kiosk mode helps you create a dedicated and locked down user experience on these fixed purpose devices. Windows IoT Enterprise offers a set of different locked-down experiences for public or specialized use: [assigned access single-app kiosks](single-app-kiosk.md), [assigned access multi-app kiosks](multi-app-kiosk.md), or [shell launcher](index.md). + +Kiosk configurations are based upon either [assigned access](../assigned-access/overview.md) or [shell launcher](index.md). There are several kiosk configuration methods that you can choose from, depending on your answers to the following questions. + +> [!NOTE] +> +> A benefit of using an assigned access kiosk mode is [these policies](/windows/configuration/kiosk-policies) are automatically applied to the device to optimize the lock-down experience. + +## Which type of app will your kiosk run? + +Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](/windows/configuration/setup-digital-signage), select a digital sign player as your kiosk app. Check out the [Guidelines for Kiosk Apps](/windows/configuration/guidelines-for-assigned-access-app). + +## Which type of kiosk do you need? + +If you want your kiosk to run a single app for anyone to see or use, consider an [assigned-access single-app kiosk](/windows/configuration/shell-launcher/single-app-kiosk) that runs either a [Universal Windows Platform (UWP) app](/windows/configuration/kiosk-methods#uwp) or a [Windows desktop application](/windows/configuration/kiosk-methods#classic). + +For a kiosk that people can sign in to with their accounts or that runs more than one app, consider an [assigned access multi-app kiosk](/windows/configuration/kiosk-methods#desktop). + +## Which type of user account will be the kiosk account? + +The kiosk account can be a local standard user account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use an assigned access multi-app kiosk configuration. The assigned access single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. + +## Kiosk capabilities for Windows 10 IoT Enterprise + +| Mode | Features | Description | Customer Usage | +|------|----------|------------ |-----------------| +| Assigned access | Single-app kiosk (UWP) | Auto launches a UWP app in full screen and prevents access to other system functions, while monitoring the lifecycle of the kiosk app. Only supports one single-app kiosk profile under one account per device. | Digital signs & single function devices +| Assigned access | Single-app kiosk (Microsoft Edge) | Auto launches Microsoft Edge and prevents access to other system functions, while monitoring the lifecycle of browser. Only supports one single-app kiosk profile under one account per device. | Public browsing kiosks & digital signs | +| Assigned access | Multi-app kiosk (Restricted User Experience) | Windows 10: Always auto launches a restricted Start menu in full screen with the list of allowed app tiles.
    Windows 11: Presents the familiar Windows desktop experience with a restricted set of apps. | Frontline Worker shared devices | +| Shell launcher | Shell launcher | Auto launches an app that the customer specifies and monitors the lifecycle of this app. App can be used as a "shell" if desired. No default lockdown policies like hotkey blocking are enforced in Shell Launcher. | Fixed purpose devices with a custom shell experience | + +## How to configure your device for kiosk mode? + +Visit the following documentation to set up a kiosk according to your scenario: + +* [Configure kiosks and digital signs](/windows/configuration/kiosk-methods) +* [Set up a single-app kiosk](/windows/configuration/kiosk-single-app) +* [Set up a multi-app kiosk](/windows/configuration/lock-down-windows-10-to-specific-apps) +* [Configure Microsoft Edge kiosk mode](/deployedge/microsoft-edge-configure-kiosk-mode) + +## Additional Resources + +* [Find the Application User Model ID of an installed app](/windows/configuration/find-the-application-user-model-id-of-an-installed-app) +* [Validate your kiosk configuration](/windows/configuration/kiosk-validate) +* [Guidelines for choosing an app for assigned access (kiosk mode)](/windows/configuration/guidelines-for-assigned-access-app) +* [Policies enforced on kiosk devices](/windows/configuration/kiosk-policies) +* [Assigned access XML reference](/windows/configuration/kiosk-xml) +* [Use AppLocker to create a Windows 10 kiosk](/windows/configuration/lock-down-windows-10-applocker) +* [Use Shell Launcher to create a Windows 10 kiosk](/windows/configuration/kiosk-shelllauncher) +* [Use MDM Bridge WMI Provider to create a Windows 10 kiosk](/windows/configuration/kiosk-mdm-bridge) +* [Troubleshoot kiosk mode issues](/windows/configuration/kiosk-troubleshoot) +* [Plan your kiosk mode transition to Microsoft Edge](/deployedge/microsoft-edge-kiosk-mode-transition-plan) diff --git a/windows/configuration/shell-launcher/multi-app-kiosk.md b/windows/configuration/shell-launcher/multi-app-kiosk.md new file mode 100644 index 0000000000..b77d2fd604 --- /dev/null +++ b/windows/configuration/shell-launcher/multi-app-kiosk.md @@ -0,0 +1,39 @@ +--- +title: Multi-App Kiosk +ms.date: 08/16/2023 +ms.topic: concept-article +description: Learn about the Multi-App Kiosk in Windows IoT Enterprise. +--- + +# Assigned access multi-app kiosk + +An assigned access multi-app kiosk runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. Here's a [guide](/windows/configuration/lock-down-windows-10-to-specific-apps) on how to set up a multi-app kiosk. + +> [!NOTE] +> Multi-app kiosk mode isn't available for Windows 11 IoT Enterprise, version 21H2, or 22H2. Refer to [What's new for subsequent releases](/windows/iot/iot-enterprise/whats-new/release-history#windows-11-iot-enterprise) for information about its return. +> +> **Update** - [Multi-app kiosk mode is now available in Windows 11](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/multi-app-kiosk-mode-now-available-in-windows-11/ba-p/3845558)., version 22H2 as part of the Windows continuous innovation releases. To learn how you can take advantage of features introduced via Windows continuous innovation, see more about how you can access this feature in Windows 11 IoT Enterprise, version 22H2, see [Delivering continuous innovation in Windows 11](https://support.microsoft.com/windows/delivering-continuous-innovation-in-windows-11-b0aa0a27-ea9a-4365-9224-cb155e517f12). + +## Benefits of using a multi-app kiosk + +The benefit of a kiosk that runs multiple specified apps is to provide an easy-to-understand experience for individuals by showing them only the things they need to use, and removing the things they don't need to access. + +A multi-app kiosk is appropriate for devices that are shared by multiple people. Each user can authenticate with the device and receive a customized lockdown experience based on the configuration. + +## Configuring your multi-app kiosk + +* [Configure a kiosk in Microsoft Intune](/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-in-microsoft-intune) +* [Configure a kiosk using a provisioning package](/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package) + +> [!NOTE] +> +> When you configure a multi-app kiosk, [specific policies](/windows/configuration/kiosk-policies) are enforced that affects all nonadministrator users on the device. + +## More Resources + +* [New features and improvements](/windows/configuration/lock-down-windows-10-to-specific-apps) +* [Set up a multi-app kiosk](/windows/configuration/lock-down-windows-10-to-specific-apps) +* [Kiosk apps for assigned access: Best practices](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access) +* [Guidelines for choosing an app for assigned access](/windows/configuration/guidelines-for-assigned-access-app) +* [Configure kiosks and digital signs](/windows/configuration/kiosk-methods) +* [More kiosk methods and reference information](/windows/configuration/kiosk-additional-reference) diff --git a/windows/configuration/shell-launcher/single-app-kiosk.md b/windows/configuration/shell-launcher/single-app-kiosk.md new file mode 100644 index 0000000000..541fb49a2e --- /dev/null +++ b/windows/configuration/shell-launcher/single-app-kiosk.md @@ -0,0 +1,38 @@ +--- +title: Assigned access Single-App Kiosk +ms.date: 03/30/2023 +ms.topic: concept-article +description: Learn about the Single-App Kiosk in Windows IoT Enterprise. +--- + +# Assigned access single-app kiosk + +A single-app kiosk uses the assigned access feature to run a single app above the lock screen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk can't do anything on the device outside of the kiosk app. + +> [!NOTE] +> +> Assigned access single-app kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. + +## Benefits of using a single-app kiosk + +A single-app kiosk is ideal for public use. Using [shell launcher](./index.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk runs above the lock screen, and users have access to only this app and nothing else on the system. This experience is often used for public-facing kiosk machines. Check out [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions) for more information. + +## Configuring your single-app kiosks + +You have several options for configuring your single-app kiosk. + +* [Settings App](/windows/configuration/kiosk-single-app#local) +* [PowerShell](/windows/configuration/kiosk-single-app#powershell) +* [Kiosk Wizard in Windows Configuration Designer](/windows/configuration/kiosk-single-app#wizard) +* [Microsoft Intune or other MDM providers](/windows/configuration/kiosk-single-app#mdm) + +> [!TIP] +> You can also configure a kiosk account and app for single-app kiosk within [XML in a provisioning package](/windows/configuration/lock-down-windows-10-to-specific-apps) by using a [kiosk profile](/windows/configuration/lock-down-windows-10-to-specific-apps#profile). + +## Additional Resources + +* [Set up a single-app kiosk](/windows/configuration/kiosk-single-app) +* [Guidelines for choosing an app for assigned access](/windows/configuration/guidelines-for-assigned-access-app) +* [Kiosk apps for assigned access: Best practices](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access) +* [Configure kiosks and digital signs](/windows/configuration/kiosk-methods) +* [More kiosk methods and reference information](/windows/configuration/kiosk-additional-reference) diff --git a/windows/configuration/shell-launcher/toc.yml b/windows/configuration/shell-launcher/toc.yml new file mode 100644 index 0000000000..07c18e4e82 --- /dev/null +++ b/windows/configuration/shell-launcher/toc.yml @@ -0,0 +1,25 @@ + +items: +- name: Shell Launcher + items: + - name: Overview + href: index.md + - name: WMI Provider Reference + items: + - name: Class WESL_UserSetting + href: wesl-usersetting.md + - name: GetCustomShell + href: wesl-usersettinggetcustomshell.md + - name: GetDefaultShell + href: wesl-usersettinggetdefaultshell.md + - name: IsEnabled + href: wesl-usersettingisenabled.md + - name: RemoveCustomShell + href: wesl-usersettingremovecustomshell.md + - name: SetCustomShell + href: wesl-usersettingsetcustomshell.md + - name: SetDefaultShell + href: wesl-usersettingsetdefaultshell.md + - name: SetEnabled + href: wesl-usersettingsetenabled.md + diff --git a/windows/configuration/shell-launcher/wedl-assignedaccess.md b/windows/configuration/shell-launcher/wedl-assignedaccess.md new file mode 100644 index 0000000000..acdd00a9df --- /dev/null +++ b/windows/configuration/shell-launcher/wedl-assignedaccess.md @@ -0,0 +1,133 @@ +--- +title: WEDL_AssignedAccess +description: WEDL_AssignedAccess +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WEDL_AssignedAccess + +This Windows Management Instrumentation (WMI) provider class configures settings for assigned access. + +[!INCLUDE [shell-launcher](../../../includes/licensing/assigned-access.md)] + +## Syntax + +```powershell +class WEDL_AssignedAccess { + [Key] string UserSID; + [Read, Write] string AppUserModelId; + [Read] sint32 Status; +}; +``` + +## Members + +The following tables list any methods and properties that belong to this class. + +### Methods + +This class contains no methods. + +### Properties + +| Property | Data type | Qualifiers | Description | +|----------|----------------|------------|-------------| +| **UserSID** | string | [key] | The security identifier (SID) for the user account that you want to use as the assigned access account. | +| **AppUserModelId** | string | [read, write] | The Application User Model ID (AUMID) of the Windows app to launch for the assigned access account. | +| **Status** | Boolean | none | Indicates the current status of the assigned access configuration | + +| Value | Description | +|:-----:|-------------| +| 0 | A valid account is configured, but no Windows app is specified. Assigned access is not enabled. | +| 1 | Assigned access is enabled. | +| 0x100 | UserSID error: cannot find the account. | +| 0x103 | UserSID error: the account profile does not exist. | +| 0x200 | AppUserModelID error: cannot find the Windows app. | +| 0x201 | Task Scheduler error: Could not schedule task. Make sure that the Task Scheduler service is running. | +| 0xffffffff | Unspecified error.| + +### Remarks + +Changes to assigned access do not affect any sessions that are currently signed in; you must sign out and sign back in. + +## Example + +The following Windows PowerShell script demonstrates how to use this class to set up an assigned access account. + +```powershell +# +#---Define variables--- +# + +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Define the assigned access account. +# To use a different account, change $AssignedAccessAccount to a user account that is present on your device. + +$AssignedAccessAccount = "KioskAccount" + +# Define the Windows app to launch, in this example, use the Application Model User ID (AUMID) for Windows Calculator. +# To use a different Windows app, change $AppAUMID to the AUMID of the Windows app to launch. +# The Windows app must be installed for the account. + +$AppAUMID = "Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" + +# +#---Define helper functions--- +# + +function Get-UsernameSID($AccountName) { + +# This function retrieves the SID for a user account on a machine. +# This function does not check to verify that the user account actually exists. + + $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName) + $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) + + return $NTUserSID.Value +} + +# +#---Set up the new assigned access account--- +# + +# Get the SID for the assigned access account. + +$AssignedAccessUserSID = Get-UsernameSID($AssignedAccessAccount) + +# Check to see if an assigned access account is already set up, and if so, clear it. + +$AssignedAccessConfig = get-WMIObject -namespace $NAMESPACE -computer $COMPUTER -class WEDL_AssignedAccess + +if ($AssignedAccessConfig) { + +# Configuration already exists. Delete it so that we can create a new one, since only one assigned access account can be set up at a time. + + $AssignedAccessConfig.delete(); + +} + +# Configure assigned access to launch the specified Windows app for the specified account. + +Set-WmiInstance -class WEDL_AssignedAccess -ComputerName $COMPUTER -Namespace $NAMESPACE -Arguments @{ + UserSID = $AssignedAccessUserSID; + AppUserModelId = $AppAUMID + } | Out-Null; + +# Confirm that the settings were created properly. + +$AssignedAccessConfig = get-WMIObject -namespace $NAMESPACE -computer $COMPUTER -class WEDL_AssignedAccess + +if ($AssignedAccessConfig) { + + "Set up assigned access for the " + $AssignedAccessAccount + " account." + " UserSID = " + $AssignedAccessConfig.UserSid + " AppModelId = " + $AssignedAccessConfig.AppUserModelId + +} else { + + "Could not set up assigned access account." +} +``` diff --git a/windows/configuration/shell-launcher/wesl-usersetting.md b/windows/configuration/shell-launcher/wesl-usersetting.md new file mode 100644 index 0000000000..ce3019dbf0 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersetting.md @@ -0,0 +1,162 @@ +--- +title: WESL_UserSetting +description: WESL_UserSetting +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting + +This class configures which application Shell Launcher starts based on the security identifier (SID) of the signed in user, and also configures the set of return codes and return actions that Shell Launcher performs when the application exits. + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +class WESL_UserSetting { + [read, write, Required] string Sid; + [read, write, Required] string Shell; + [read, write] Sint32 CustomReturnCodes[]; + [read, write] Sint32 CustomReturnCodesAction[]; + [read, write] sint32 DefaultAction; + + [Static] uint32 SetCustomShell( + [In, Required] string Sid, + [In, Required] string Shell, + [In] sint32 CustomReturnCodes[], + [In] sint32 CustomReturnCodesAction[], + [In] sint32 DefaultAction + ); + [Static] uint32 GetCustomShell( + [In, Required] string Sid, + [Out, Required] string Shell, + [Out, Required] sint32 CustomReturnCodes[], + [Out, Required] sint32 CustomReturnCodesAction[], + [Out, Required] sint32 DefaultAction + ); + [Static] uint32 RemoveCustomShell( + [In, Required] string Sid + ); + [Static] uint32 GetDefaultShell( + [Out, Required] string Shell, + [Out, Required] sint32 DefaultAction + ); + [Static] uint32 SetDefaultShell( + [In, Required] string Shell, + [In, Required] sint32 DefaultAction + ); + [Static] uint32 IsEnabled( + [Out, Required] boolean Enabled + ); + [Static] uint32 SetEnabled( + [In, Required] boolean Enabled); + ); +}; +``` + +## Members + +The following tables list any methods and properties that belong to this class. + +### Methods + +| Methods | Description | +|---------|-------------| +| [WESL_UserSetting.SetCustomShell](wesl-usersettingsetcustomshell.md) | Configures Shell Launcher for a specific user or group, based on SID. | +| [WESL_UserSetting.GetCustomShell](wesl-usersettinggetcustomshell.md) | Retrieves the Shell Launcher configuration for a specific user or group, based on the SID. | +| [WESL_UserSetting.RemoveCustomShell](wesl-usersettingremovecustomshell.md) | Removes a Shell Launcher configuration for a specific user or group, based on the SID. | +| [WESL_UserSetting.GetDefaultShell](wesl-usersettinggetdefaultshell.md) | Retrieves the default Shell Launcher configuration. | +| [WESL_UserSetting.SetDefaultShell](wesl-usersettingsetdefaultshell.md) | Sets the default Shell Launcher configuration. | +| [WESL_UserSetting.IsEnabled](wesl-usersettingisenabled.md) | Retrieves a value that indicates if Shell Launcher is enabled or disabled. | +| [WESL_UserSetting.SetEnabled](wesl-usersettingsetenabled.md) | Enables or disables Shell Launcher. | + +### Properties + +| Property | Data type | Qualifiers | Description | +|----------|----------------|------------|-------------| +| **Sid** | string | [read, write, required] | User or group SID. | +| **shell** | string | [read, write, required] | The application to start as the shell.
    The **shell** property can be a filename in the *Path* environment variable, or it can contain a fully qualified path to the application. You can also use environment variables in the path.
    Any spaces in the **shell** property must be part of a quote-delimited string. | +| **CustomReturnCodes** | Sint32[] |[read, write] | An array of custom return codes that can be returned by the shell. | +| **CustomReturnCodesAction** | Sint32[] | [read, write] | An array of custom return code actions that determine what action Shell Launcher takes when the shell exits. The custom actions map to the array of **CustomReturnCodes**.
    The possible actions are:
    0 - Restart the shell.
    1 - Restart the device.
    2 - Shut down the device.
    3 - Do nothing. | +| **DefaultAction** | Sint32 | [read, write] | The default action Shell Launcher takes when the shell exits.
    The possible actions are defined as follows:
    0 - Restart the shell.
    1 - Restart the device.
    2 - Shut down the device.
    3 - Do nothing. | + +### Remarks + +Only one **WESL_UserSetting** instance exists on a device with Shell Launcher. + +Shell Launcher uses the custom configuration defined for the SID of the user currently signed in, if one exists. Otherwise, Shell Launcher uses a custom configuration defined for a group SID that the user is a member of, if any exist. If multiple group custom configurations for the user exist, Shell Launcher uses the first valid configuration it finds. The search order is not defined. + +If there is no custom configuration for the user's SID or any group SIDs that the user is a member of, Shell Launcher uses the default configuration. + +You can find the SID for a user and any groups that the user is a member of by using the [whoami](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771299(v=ws.10)) command-line tool. + +## Example + +The following Windows PowerShell script demonstrates how to add and remove custom shell configurations for Shell Launcher by using the Windows Management Instrumentation (WMI) providers for Shell Launcher. + +```powershell +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Create a handle to the class instance so we can call the static methods. +$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" + + +# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. + +$Admins_SID = "S-1-5-32-544" + +# Create a function to retrieve the SID for a user account on a machine. + +function Get-UsernameSID($AccountName) { + + $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName) + $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) + + return $NTUserSID.Value + +} + +# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. + +$Cashier_SID = Get-UsernameSID("Cashier") + +# Define actions to take when the shell program exits. + +$restart_shell = 0 +$restart_device = 1 +$shutdown_device = 2 +$do_nothing = 3 + +# Examples + +# Set the command prompt as the default shell, and restart the device if it's closed. + +$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device) + +# Display the default shell to verify that it was added correctly. + +$DefaultShellObject = $ShellLauncherClass.GetDefaultShell() + +"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction + +# Set Internet Explorer as the shell for "Cashier", and restart the machine if it's closed. + +$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell) + +# Set Explorer as the shell for administrators. + +$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe") + +# View all the custom shells defined. + +"`nCurrent settings for custom shells:" +Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction + +# Remove the new custom shells. + +$ShellLauncherClass.RemoveCustomShell($Admins_SID) + +$ShellLauncherClass.RemoveCustomShell($Cashier_SID) +``` diff --git a/windows/configuration/shell-launcher/wesl-usersettinggetcustomshell.md b/windows/configuration/shell-launcher/wesl-usersettinggetcustomshell.md new file mode 100644 index 0000000000..6be4813c8c --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettinggetcustomshell.md @@ -0,0 +1,64 @@ +--- +title: WESL_UserSetting.GetCustomShell +description: WESL_UserSetting.GetCustomShell +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.GetCustomShell + +This method retrieves the Shell Launcher configuration for a specific user or group, based on the security identifier (SID). + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 GetCustomShell ( + [In, Required] string Sid, + [Out, Required] string Shell, + [Out, Required] sint32 CustomReturnCodes[], + [Out, Required] sint32 CustomReturnCodesAction[], + [Out, Required] sint32 DefaultAction +); +``` + +## Parameters + +**Sid**
    \[in, required\] A string containing the security identifier (SID) of the user or group that Shell Launcher is configured for. + +**Shell**
    \[out, required\] The application or executable that Shell Launcher starts as the shell. + +**CustomReturnCodes**
    \[out, required\] An array of custom return codes returned by the shell application. + +**CustomReturnCodesAction**
    \[out, required\] An array of custom return code actions that determine the action that Shell Launcher takes when the shell application exits. The custom actions map to the array of *CustomReturnCodes*. + +The possible actions are defined in the following table: + +| Value | Description | +|:-----:|-------------| +| 0 | Restart the shell. | +| 1 | Restart the device. | +| 2 | Shut down the device. | +| 3 | Do nothing. | + +**DefaultAction**
    \[out, required\] The default action that Shell Launcher takes when the shell application exits. + +The possible actions are defined in the following table: + +| Value | Description | +|:------:|-------------| +| 0 | Restart the shell. | +| 1 | Restart the device. | +| 2 | Shut down the device. | +| 3 | Do nothing. | + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +Shell Launcher uses the *CustomReturnCodes* and *CustomReturnCodesAction* arrays to determine the system behavior when the shell application exits, based on the return value of the application. + +If the return value does not exist in *CustomReturnCodes*, or if the corresponding action defined in *CustomReturnCodesAction* is not a valid value, Shell Launcher uses *DefaultAction* to determine system behavior. If *DefaultAction* is not defined, or is not a valid value, Shell Launcher restarts the shell application. diff --git a/windows/configuration/shell-launcher/wesl-usersettinggetdefaultshell.md b/windows/configuration/shell-launcher/wesl-usersettinggetdefaultshell.md new file mode 100644 index 0000000000..c32948ad15 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettinggetdefaultshell.md @@ -0,0 +1,44 @@ +--- +title: WESL_UserSetting.GetDefaultShell +description: WESL_UserSetting.GetDefaultShell +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.GetDefaultShell + +This method retrieves the default Shell Launcher configuration. + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 GetDefaultShell ( + [Out, Required] string Shell, + [Out, Required] sint32 DefaultAction +); +``` + +## Parameters + +**Shell**
    \[out, required\] The application or executable that Shell Launcher starts as the shell. + +**DefaultAction**
    \[out, required\] The default action Shell Launcher takes when the shell application exits. + +The possible actions are defined in the following table: + +| Value | Description | +|:-----:|-------------| +| 0 | Restart the shell. | +| 1 | Restart the device. | +| 2 | Shut down the device. | +| 3 | Do nothing. | + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +Shell Launcher uses the default configuration when the security identifier (SID) of the user who is currently signed in does not match any custom defined Shell Launcher configurations. diff --git a/windows/configuration/shell-launcher/wesl-usersettingisenabled.md b/windows/configuration/shell-launcher/wesl-usersettingisenabled.md new file mode 100644 index 0000000000..1125bb1d92 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettingisenabled.md @@ -0,0 +1,28 @@ +--- +title: WESL_UserSetting.IsEnabled +description: WESL_UserSetting.IsEnabled +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.IsEnabled + +This method retrieves a value that indicates if Shell Launcher is enabled or disabled. + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 IsEnabled( + [Out, Required] boolean Enabled +); +``` + +## Parameters + +**Enabled**
    \[out, required\] A Boolean value that indicates if Shell Launcher is enabled. + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). diff --git a/windows/configuration/shell-launcher/wesl-usersettingremovecustomshell.md b/windows/configuration/shell-launcher/wesl-usersettingremovecustomshell.md new file mode 100644 index 0000000000..e5058577a9 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettingremovecustomshell.md @@ -0,0 +1,32 @@ +--- +title: WESL_UserSetting.RemoveCustomShell +description: WESL_UserSetting.RemoveCustomShell +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.RemoveCustomShell + +This method removes a Shell Launcher configuration for a specific user or group, based on the security identifier (SID). + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 RemoveCustomShell ( + [In, Required] string Sid +); +``` + +## Parameters + +**Sid**
    \[in, required\] A string containing the security identifier (SID) of the user or group that Shell Launcher is configured for. + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +You must restart your device for the changes to take effect. diff --git a/windows/configuration/shell-launcher/wesl-usersettingsetcustomshell.md b/windows/configuration/shell-launcher/wesl-usersettingsetcustomshell.md new file mode 100644 index 0000000000..5b788c9295 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettingsetcustomshell.md @@ -0,0 +1,64 @@ +--- +title: WESL_UserSetting.SetCustomShell +description: WESL_UserSetting.SetCustomShell +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.SetCustomShell + +This method configures Shell Launcher for a specific user or group, based on the security identifier (SID). + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 SetCustomShell ( + [In, Required] string Sid, + [In, Required] string Shell, + [In] sint32 CustomReturnCodes[], + [In] sint32 CustomReturnCodesAction[], + [In] sint32 DefaultAction +); +``` + +## Parameters + +**Sid**
    \[in, required\] A string containing the security identifier (SID) of the user or group that Shell Launcher is being configured for. + +**Shell**
    \[in, required\] The application or executable that Shell Launcher starts as the shell. + +**CustomReturnCodes**
    \[in\] An array of custom return codes that can be returned by the shell application. + +**CustomReturnCodesAction**
    \[in\] An array of custom return code actions that determine the action that Shell Launcher takes when the shell application exits. The custom actions map to the array of *CustomReturnCodes*. + +The possible actions are defined in the following table: + +| Value | Description | +|:-----:|-------------| +| 0 | Restart the shell. | +| 1 | Restart the device. | +| 2 | Shut down the device. | +| 3 | Do nothing. | + +**DefaultAction**
    \[In\] The default action that Shell Launcher takes when the shell application exits. + +The possible actions are defined in the following table: + +| Value | Description | +|:-----:|-------------| +| 0 | Restart the shell.| +| 1 | Restart the device. | +| 2 | Shut down the device. | +| 3 | Do nothing. | + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +Shell Launcher uses the *CustomReturnCodes* and *CustomReturnCodesAction* arrays to determine the system behavior when the shell application exits, based on the return value of the shell application. + +If the return value does not exist in *CustomReturnCodes*, or if the corresponding action defined in *CustomReturnCodesAction* is not a valid value, Shell Launcher uses *DefaultAction* to determine system behavior. If *DefaultAction* is not defined, or is not a valid value, Shell Launcher restarts the shell application. diff --git a/windows/configuration/shell-launcher/wesl-usersettingsetdefaultshell.md b/windows/configuration/shell-launcher/wesl-usersettingsetdefaultshell.md new file mode 100644 index 0000000000..d829d7d717 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettingsetdefaultshell.md @@ -0,0 +1,44 @@ +--- +title: WESL_UserSetting.SetDefaultShell +description: WESL_UserSetting.SetDefaultShell +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.SetDefaultShell + +This method sets the default Shell Launcher configuration. + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 SetDefaultShell ( + [In, Required] string Shell, + [In, Required] sint32 DefaultAction +); +``` + +## Parameters + +**Shell**
    \[in, required\] The application or executable that Shell Launcher starts as the shell. + +**DefaultAction**
    \[in, required\] The default action that Shell Launcher takes when the *Shell* application exits. + +The possible actions are defined in the following table: + +| Value | Description | +|:-------:|-------------| +| 0 | Restart the shell. | +| 1 | Restart the device. | +| 2 | Shut down the device. | +| 3 | Do nothing. | + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +Shell Launcher uses the default configuration when the security identifier (SID) of the user who is currently signed in does not match any custom defined Shell Launcher configurations. diff --git a/windows/configuration/shell-launcher/wesl-usersettingsetenabled.md b/windows/configuration/shell-launcher/wesl-usersettingsetenabled.md new file mode 100644 index 0000000000..64d952bf88 --- /dev/null +++ b/windows/configuration/shell-launcher/wesl-usersettingsetenabled.md @@ -0,0 +1,34 @@ +--- +title: WESL_UserSetting.SetEnabled +description: WESL_UserSetting.SetEnabled +ms.date: 02/25/2025 +ms.topic: reference +--- + +# WESL_UserSetting.SetEnabled + +This method enables or disables Shell Launcher. + +[!INCLUDE [shell-launcher](../../../includes/licensing/shell-launcher.md)] + +## Syntax + +```powershell +[Static] uint32 SetEnabled( + [In, Required] boolean Enabled +); +``` + +## Parameters + +**Enabled**
    \[in, required\] A Boolean value that indicates whether to enable or disable Shell Launcher. + +## Return Value + +Returns an HRESULT value that indicates [WMI status](/windows/win32/wmisdk/wmi-non-error-constants) or a [WMI error](/windows/win32/wmisdk/wmi-error-constants). + +## Remarks + +This method enables or disables Shell Launcher by modifying the **Shell** value in the registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`. If Unified Write Filter (UWF) is enabled, you may need to disable UWF or commit this registry key by using [UWF_RegistryFilter.CommitRegistry](../unified-write-filter/uwf-registryfiltercommitregistry.md) in order to enable or disable Shell Launcher. + +Enabling or disabling Shell Launcher does not take effect until a user signs in. diff --git a/windows/configuration/start/includes/disable-account-notifications.md b/windows/configuration/start/includes/disable-account-notifications.md new file mode 100644 index 0000000000..02d3427ef9 --- /dev/null +++ b/windows/configuration/start/includes/disable-account-notifications.md @@ -0,0 +1,25 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 11/04/2024 +ms.topic: include +--- + +### Disable Account Notifications + +This policy controls the notifications to Microsoft account (MSA) and local users in the Start's user tile: + +- When enabled, Windows doesn't send account related notifications for local and MSA users to the user tile in Start +- Wen disabled or not configured, Windows sends account related notifications for local and MSA users to the user tile in Start + +Notifications include getting users to: + +- reauthenticate +- back up their device +- manage cloud storage quotas +- manage their Microsoft 365 or XBOX subscription + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Notifications/`[DisableAccountNotifications](/windows/client-management/mdm/policy-csp-notifications#disableaccountnotifications) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Windows Components** > **Account Notifications** > **Turn off account notifications in Start** | diff --git a/windows/configuration/start/includes/hide-recently-added-apps.md b/windows/configuration/start/includes/hide-recently-added-apps.md index 43c642e888..8dac911b1b 100644 --- a/windows/configuration/start/includes/hide-recently-added-apps.md +++ b/windows/configuration/start/includes/hide-recently-added-apps.md @@ -1,15 +1,16 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 04/10/2024 +ms.date: 02/25/2025 ms.topic: include --- ### Hide recently added apps -With this policy setting, you can prevent the Start menu from displaying a list of recently installed applications. +With this policy setting, you can prevent the Start menu from displaying a list of recently installed applications: -If you enable this policy, the Start menu doesn't display the **Recently added** list. The corresponding setting is also disabled in Settings. +- If **enabled**, the Start menu doesn't display the **Recently added** list. The corresponding option in Settings can't be configured (grayed out) +- If **disabled** or **not configured**, the Start menu displays the **Recently added** list. The corresponding option in Settings can be configured | | Path | |--|--| diff --git a/windows/configuration/start/index.md b/windows/configuration/start/index.md index 0627e33663..2294ebe5cc 100644 --- a/windows/configuration/start/index.md +++ b/windows/configuration/start/index.md @@ -1,8 +1,8 @@ --- -title: Configure the Start menu +title: Configure The Windows Start Menu With Policy Settings description: Learn how to configure the Windows Start menu to provide quick access to the tools and applications that users need most. ms.topic: overview -ms.date: 04/10/2024 +ms.date: 12/02/2024 zone_pivot_groups: windows-versions-11-10 ms.collection: - essentials-manage diff --git a/windows/configuration/start/layout.md b/windows/configuration/start/layout.md index 30baa389a1..af0a608300 100644 --- a/windows/configuration/start/layout.md +++ b/windows/configuration/start/layout.md @@ -1,8 +1,8 @@ --- -title: Customize the Start layout +title: Customize The Start Layout For Managed Windows Devices description: Learn how to customize the Windows Start layout, export its configuration, and deploy the customization to other devices. ms.topic: how-to -ms.date: 04/10/2024 +ms.date: 12/02/2024 zone_pivot_groups: windows-versions-11-10 appliesto: --- @@ -304,10 +304,10 @@ Column="2"/> You can use the `start:SecondaryTile` tag to pin a web link through a Microsoft Edge secondary tile. This method doesn't require more actions compared to the method of using legacy `.url` shortcuts (through the `start:DesktopApplicationTile` tag). -The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile: +The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile. Ensure to replace `<--Microsoft Edge AUMID-->` with the AUMID of Microsoft Edge (learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md)): ```XML -Windows 10 --- diff --git a/windows/configuration/store/find-aumid.md b/windows/configuration/store/find-aumid.md index 2e19c3355e..39b513db4c 100644 --- a/windows/configuration/store/find-aumid.md +++ b/windows/configuration/store/find-aumid.md @@ -2,7 +2,9 @@ title: Find the Application User Model ID of an installed app description: Learn how to find the Application User Model ID (AUMID) of the applications installed on a Windows device. ms.topic: how-to -ms.date: 02/06/2024 +ms.date: 10/31/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 --- # Find the Application User Model ID of an installed app @@ -90,6 +92,8 @@ Get-AppAUMID -AppName Word Get-AppAUMID ``` +::: zone pivot="windows-10" + # [:::image type="icon" source="../images/icons/explorer.svg"::: **Explorer**](#tab/explorer) To get the names and AUMIDs for all apps installed for the current user, perform the following steps: @@ -99,7 +103,7 @@ To get the names and AUMIDs for all apps installed for the current user, perform 1. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to c 1. Change the **View** setting from **Tiles** to **Details** -:::image type="content" source="images/aumid-file-explorer.png" alt-text="Screenshot of the File Explorer showing the AUMID details." border="false"::: +::: zone-end # [:::image type="icon" source="../images/icons/registry.svg"::: **Registry**](#tab/registry) diff --git a/windows/configuration/store/images/aumid-file-explorer.png b/windows/configuration/store/images/aumid-file-explorer.png deleted file mode 100644 index 0361cd9bfe..0000000000 Binary files a/windows/configuration/store/images/aumid-file-explorer.png and /dev/null differ diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md index 09c92aea0f..b6b7609319 100644 --- a/windows/configuration/store/index.md +++ b/windows/configuration/store/index.md @@ -1,8 +1,8 @@ --- -title: Configure access to the Microsoft Store app +title: Configure Access To The Microsoft Store App For Windows Devices description: Learn how to configure access to the Microsoft Store app. ms.topic: how-to -ms.date: 03/13/2024 +ms.date: 12/02/2024 --- # Configure access to the Microsoft Store app diff --git a/windows/configuration/taskbar/includes/show-notification-bell-icon.md b/windows/configuration/taskbar/includes/show-notification-bell-icon.md new file mode 100644 index 0000000000..e6b888ea52 --- /dev/null +++ b/windows/configuration/taskbar/includes/show-notification-bell-icon.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/25/2025 +ms.topic: include +--- + +### Show notification bell icon + +This policy setting allows you to show the notification bell icon in the system tray: + +- If you enable this policy setting, the notification icon is always displayed +- If you disable or don't configure this policy setting, the notification icon is only displayed when there's a special status (for example, when *do not disturb* is turned on) + +> [!NOTE] +> A reboot is required for this policy setting to take effect. + +| | Path | +|--|--| +| **CSP** |- `./User/Vendor/MSFT/Policy/Config/Start/`[AlwaysShowNotificationIcon](/windows/client-management/mdm/policy-csp-start#AlwaysShowNotificationIcon) | +| **GPO** |- **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | + + + +1. Select the Microsoft Connected Cache for Enterprise resource. When prompted, choose the subscription, resource group, and location for the resource. Then enter a name for the resource, then select Review + Create. + +1. After a few moments, you'll see a "Validation successful" message, indicating you can move onto the next step and select Create. + +1. The creation of the resource might take a few minutes. After a successful creation, you'll see a page stating the deployment is complete. Select **Go to resource** to create cache nodes. + + +# [Azure CLI](#tab/cli) + +### Prerequisites + +* An Azure CLI environment: + + * Use the Bash environment in [Azure Cloud Shell](/azure/cloud-shell/get-started/classic). + + * Or, if you prefer to run CLI reference commands locally, [install the Azure CLI](/cli/azure/install-azure-cli) + + * Sign in to the Azure CLI by using the [az login](/cli/azure/reference-index#az-login) command. + + * Run [az version](/cli/azure/reference-index#az-version) to find the version and dependent libraries that are installed. To upgrade to the latest version, run [az upgrade](/cli/azure/reference-index#az-upgrade). + + * Install Azure CLI extension **mcc** by following the instructions [here](/cli/azure/azure-cli-extensions-overview#how-to-install-extensions). + + * Resource group under which a Connected Cache resource can be created. Use the [az group create](/cli/azure/group#az-group-create) command to create a new Resource group if you don't already have one. + +#### Create Connected Cache Azure resource + +Replace the following placeholders with your own information: +* *\*: Name of an existing resource group in your subscription. +* *\*: A name for your Microsoft Connected Cache for Enterprise resource. +* *\*: The Azure region where your Microsoft Connected Cache will be located. + +```azurecli-interactive +az mcc ent resource create --mcc-resource-name --resource-group --location +``` + +--- + +## Create Connected Cache cache node + +# [Azure portal](#tab/portal) + + 1. Open Azure portal and navigate to the Microsoft Connected Cache for Enterprise resource that you created.
    + 1. Under Cache Node Management, select **Cache Nodes** then **Create Cache Node**.
    + + 1. Provide a name for your cache node and select the host OS you plan to deploy the cache node on, then select **Create**. Note, cache node names have to be unique under the Microsoft Connected Cache resource. + + The creation of the cache node might take a few minutes. Select **Refresh** to see your recently created cache node. +Once the cache node state changes to **Not Configured**, you can now configure your cache node.
    +For more information about different cache node states, see [Cache node states](#cache-node-states). + + +# [Azure CLI](#tab/cli) + +Use the following command to create a new cache node if you don't already have one. + +Replace the following placeholders with your own information: +* *\*: Name of existing resource group in your subscription. +* *\*: Name of the Microsoft Connected Cache for Enterprise resource. +* *\*: A name for your Microsoft Connected Cache node. +* *\*: The OS on which cache node will be provisioned. + Accepted values: `windows`, `linux` + +```azurecli-interactive +az mcc ent node create --cache-node-name --mcc-resource-name --resource-group --host-os +``` + +
    + +>[!NOTE] +>To ensure cache node has been created successfully, run the following command before continuing with cache node configuration. +>```azurecli-interactive +>az mcc ent node show --cache-node-name --mcc-resource-name --resource-group +>``` +>In the output look for **cacheNodeState**. If ***cacheNodeState = Not Configured***, you can continue with cache node configuration. +>If ***cacheNodeState = Registration in Progress***, then the cache node is still in process of being created. Wait a couple of minutes and run the command again. +>To know more about different cache node state, see [Cache node states](#cache-node-states). + +--- + +## Configure Connected Cache node + +# [Azure portal](#tab/portal) +Enter required values to configure your cache node. For more information about the definitions of each field, review the [Configuration fields](#general-configuration-fields) at the bottom of this article. +Don't forget to select save after adding configuration information. + + +# [Azure CLI](#tab/cli) + +### Configure Linux-hosted Connected Cache node +Use the following command to configure cache node for deployment to a **Linux** host machine. + +Replace the following placeholders with your own information: + +* *\*: Name of the resource group in your subscription. +* *\*: Name of your Microsoft Connected Cache for Enterprise resource. +* *\*: Name for your Microsoft Connected Cache node. +* *\*: The cache drive path. You can add up to nine cache drives. +* *\*: The size of cache drive. Must be at least 50 Gb. +* *\*: If proxy needs to be enabled or not.
    + Accepted values: `enabled`, `disabled`
    + Proxy should be set to enabled if the cache node will need to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache cache node to your host machine. +* *\*: The proxy host name or ip address. Required if proxy is set to enabled. +* *\*: Proxy port number. Required if proxy is set to enabled. +* *\*: Update ring the cache node should have.
    + Accepted values: `slow`, `fast`.
    + If update ring is set to slow, you must provide the day of week, time of day and week of month the cache node should be updated. +* *\*: The day of the week cache node should be updated. Week starts from Monday.
    + Accepted values: 1,2,3,4,5,6,7 +* *\*: The time of day cache node should be updated in 24 hour format (hh:mm) +* *\*: The week of month cache node should be updated.
    + Accepted values: 1,2,3,4 + +```azurecli-interactive +az mcc ent node update --cache-node-name --mcc-resource-name --resource-group +--cache-drive "[{physical-path:,size-in-gb:},{,size-in-gb:}...]"> --proxy --proxy-host <"proxy host name"> --proxy-port --auto-update-day --auto-update-time