From dafbfa07a6e957c0f2c6da844055fb4072bd6c42 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Tue, 29 Aug 2023 17:41:54 -0400
Subject: [PATCH 1/3] August CSP Updates
---
.../mdm/accountmanagement-csp.md | 315 ++++++++++++---
.../mdm/accountmanagement-ddf.md | 369 ++++++++++--------
.../mdm/clouddesktop-ddf-file.md | 6 +-
windows/client-management/mdm/defender-csp.md | 79 +++-
windows/client-management/mdm/defender-ddf.md | 74 +++-
windows/client-management/mdm/euiccs-csp.md | 38 +-
.../client-management/mdm/euiccs-ddf-file.md | 38 +-
.../mdm/policies-in-policy-csp-admx-backed.md | 7 +-
...in-policy-csp-supported-by-group-policy.md | 7 +-
...-in-policy-csp-supported-by-surface-hub.md | 3 +-
.../policy-configuration-service-provider.md | 4 +-
.../mdm/policy-csp-cryptography.md | 6 +-
.../mdm/policy-csp-fileexplorer.md | 6 +-
.../mdm/policy-csp-filesystem.md | 135 +++++++
.../mdm/policy-csp-mixedreality.md | 106 ++++-
.../client-management/mdm/policy-csp-start.md | 66 +++-
.../mdm/policy-csp-windowsai.md | 95 +++++
windows/client-management/mdm/toc.yml | 4 +
18 files changed, 1070 insertions(+), 288 deletions(-)
create mode 100644 windows/client-management/mdm/policy-csp-filesystem.md
create mode 100644 windows/client-management/mdm/policy-csp-windowsai.md
diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md
index 9863ad1ccf..4fdc019a91 100644
--- a/windows/client-management/mdm/accountmanagement-csp.md
+++ b/windows/client-management/mdm/accountmanagement-csp.md
@@ -1,81 +1,304 @@
---
title: AccountManagement CSP
-description: Learn about the AccountManagement CSP, which is used to configure settings in the Account Manager service.
+description: Learn more about the AccountManagement CSP.
+author: vinaypamnani-msft
+manager: aaroncz
ms.author: vinpa
-ms.topic: reference
+ms.date: 08/29/2023
+ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
-author: vinaypamnani-msft
-ms.date: 03/23/2018
-ms.reviewer:
-manager: aaroncz
+ms.topic: reference
---
+
+
+
# AccountManagement CSP
-AccountManagement CSP is used to configure setting in the Account Manager service in Windows Holographic for Business edition. Added in Windows 10, version 1803.
+
+
+AccountManagement CSP is used to configure setting in the Account Manager service in Windows Holographic for Business edition.
> [!NOTE]
> The AccountManagement CSP is only supported in Windows Holographic for Business edition.
+
-The following syntax shows the AccountManagement configuration service provider in tree format.
+
+The following list shows the AccountManagement configuration service provider nodes:
-```console
-./Vendor/MSFT
-AccountManagement
-----UserProfileManagement
---------EnableProfileManager
---------DeletionPolicy
---------StorageCapacityStartDeletion
---------StorageCapacityStopDeletion
---------ProfileInactivityThreshold
+- ./Device/Vendor/MSFT/AccountManagement
+ - [UserProfileManagement](#userprofilemanagement)
+ - [DeletionPolicy](#userprofilemanagementdeletionpolicy)
+ - [EnableProfileManager](#userprofilemanagementenableprofilemanager)
+ - [ProfileInactivityThreshold](#userprofilemanagementprofileinactivitythreshold)
+ - [StorageCapacityStartDeletion](#userprofilemanagementstoragecapacitystartdeletion)
+ - [StorageCapacityStopDeletion](#userprofilemanagementstoragecapacitystopdeletion)
+
+
+
+## UserProfileManagement
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
+
+
+
+```Device
+./Device/Vendor/MSFT/AccountManagement/UserProfileManagement
```
+
-**./Vendor/MSFT/AccountManagement**
-Root node for the AccountManagement configuration service provider.
+
+
+
-**UserProfileManagement**
-Interior node.
+
+
+
-**UserProfileManagement/EnableProfileManager**
-Enable profile lifetime management for shared or communal device scenarios. Default value is false.
+
+**Description framework properties**:
-Supported operations are Add, Get, Replace, and Delete.
+| Property name | Property value |
+|:--|:--|
+| Format | `node` |
+| Access Type | Get |
+
-Value type is bool.
+
+
+
-**UserProfileManagement/DeletionPolicy**
-Configures when profiles will be deleted. Default value is 1.
+
-Valid values:
+
+### UserProfileManagement/DeletionPolicy
-- 0 - delete immediately when the device returns to a state with no currently active users
-- 1 - delete at storage capacity threshold
-- 2 - delete at both storage capacity threshold and profile inactivity threshold
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
+
-Supported operations are Add, Get, Replace, and Delete.
+
+```Device
+./Device/Vendor/MSFT/AccountManagement/UserProfileManagement/DeletionPolicy
+```
+
-Value type is integer.
+
+
+Configures when profiles will be deleted. Allowed values: 0 (delete immediately upon device returning to a state with no currently active users); 1 (delete at storage capacity threshold); 2 (delete at both storage capacity threshold and profile inactivity threshold).
+
-**UserProfileManagement/StorageCapacityStartDeletion**
-Start deleting profiles when available storage capacity falls below this threshold, given as percent of total storage available for profiles. Profiles that have been inactive the longest will be deleted first. Default value is 25.
+
+
+
-Supported operations are Add, Get, Replace, and Delete.
+
+**Description framework properties**:
-Value type is integer.
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 1 |
+
-**UserProfileManagement/StorageCapacityStopDeletion**
-Stop deleting profiles when available storage capacity is brought up to this threshold, given as percent of total storage available for profiles. Default value is 50.
+
+**Allowed values**:
-Supported operations are Add, Get, Replace, and Delete.
+| Value | Description |
+|:--|:--|
+| 0 | Delete immediately upon device returning to a state with no currently active users). |
+| 1 (Default) | Delete at storage capacity threshold. |
+| 2 | Delete at both storage capacity threshold and profile inactivity threshold. |
+
-Value type is integer.
+
+
+
-**UserProfileManagement/ProfileInactivityThreshold**
-Start deleting profiles when they haven't been logged on during the specified period, given as number of days. Default value is 30.
+
-Supported operations are Add, Get, Replace, and Delete. Value type is integer.
+
+### UserProfileManagement/EnableProfileManager
-## Related topics
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
+
-[Configuration service provider reference](index.yml)
+
+```Device
+./Device/Vendor/MSFT/AccountManagement/UserProfileManagement/EnableProfileManager
+```
+
+
+
+
+Enable profile lifetime mangement for shared or communal device scenarios.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `bool` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | false |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false (Default) | False. |
+| true | True. |
+
+
+
+
+
+
+
+
+
+### UserProfileManagement/ProfileInactivityThreshold
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
+
+
+
+```Device
+./Device/Vendor/MSFT/AccountManagement/UserProfileManagement/ProfileInactivityThreshold
+```
+
+
+
+
+Start deleting profiles when they haven't been logged-on during the specified period, given as number of days.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 30 |
+
+
+
+
+
+
+
+
+
+### UserProfileManagement/StorageCapacityStartDeletion
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
+
+
+
+```Device
+./Device/Vendor/MSFT/AccountManagement/UserProfileManagement/StorageCapacityStartDeletion
+```
+
+
+
+
+Start deleting profiles when available storage capacity falls below this threshold, given as percent of total storage available for profiles. Profiles that have been inactive the longest will be deleted first.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 25 |
+
+
+
+
+
+
+
+
+
+### UserProfileManagement/StorageCapacityStopDeletion
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
+
+
+
+```Device
+./Device/Vendor/MSFT/AccountManagement/UserProfileManagement/StorageCapacityStopDeletion
+```
+
+
+
+
+Stop deleting profiles when available storage capacity is brought up to this threshold, given as percent of total storage available for profiles.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 50 |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+## Related articles
+
+[Configuration service provider reference](configuration-service-provider-reference.md)
diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md
index c6ec83beff..7589b07ab4 100644
--- a/windows/client-management/mdm/accountmanagement-ddf.md
+++ b/windows/client-management/mdm/accountmanagement-ddf.md
@@ -1,203 +1,232 @@
---
title: AccountManagement DDF file
-description: View the OMA DM device description framework (DDF) for the AccountManagement configuration service provider. This file is used to configure settings.
+description: View the XML file containing the device description framework (DDF) for the AccountManagement configuration service provider.
+author: vinaypamnani-msft
+manager: aaroncz
ms.author: vinpa
-ms.topic: reference
+ms.date: 08/29/2023
+ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
-author: vinaypamnani-msft
-ms.date: 03/23/2018
-ms.reviewer:
-manager: aaroncz
+ms.topic: reference
---
+
+
# AccountManagement DDF file
-This topic shows the OMA DM device description framework (DDF) for the **AccountManagement** configuration service provider.
-
-The XML below is for Windows 10, version 1803.
+The following XML file contains the device description framework (DDF) for the AccountManagement configuration service provider.
```xml
-]>
+]>
1.2
+
+
+
+ AccountManagement
+ ./Device/Vendor/MSFT
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 10.0.19041
+ 1.0
+ 0x88;
+
+
+
+ UserProfileManagement
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
- AccountManagement
- ./Device/Vendor/MSFT
+ EnableProfileManager
+
+
+
+ false
+ Enable profile lifetime mangement for shared or communal device scenarios.
-
+
-
+
-
+
+ Enable profile manager
- com.microsoft/1.0/MDM/AccountManagement
+
+
+
+
+ false
+ False
+
+
+ true
+ True
+
+
+
+
+
+ DeletionPolicy
+
+
+
+
+
+
+
+ 1
+ Configures when profiles will be deleted. Allowed values: 0 (delete immediately upon device returning to a state with no currently active users); 1 (delete at storage capacity threshold); 2 (delete at both storage capacity threshold and profile inactivity threshold).
+
+
+
+
+
+
+
+
+
+ Profile deletion policy
+
+
+
+
+
+ 0
+ Delete immediately upon device returning to a state with no currently active users)
+
+
+ 1
+ Delete at storage capacity threshold
+
+
+ 2
+ Delete at both storage capacity threshold and profile inactivity threshold
+
+
+
+
+
+ StorageCapacityStartDeletion
+
+
+
+
+
+
+
+ 25
+ Start deleting profiles when available storage capacity falls below this threshold, given as percent of total storage available for profiles. Profiles that have been inactive the longest will be deleted first.
+
+
+
+
+
+
+
+
+
+ Storage capacity threshold to start profile deletion
+
+
-
- UserProfileManagement
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- EnableProfileManager
-
-
-
-
-
-
-
- false
- Enable profile lifetime management for shared or communal device scenarios.
-
-
-
-
-
-
-
-
-
- Enable profile manager
-
- text/plain
-
-
-
-
- DeletionPolicy
-
-
-
-
-
-
-
- 1
- Configures when profiles will be deleted. Allowed values: 0 (delete immediately upon device returning to a state with no currently active users); 1 (delete at storage capacity threshold); 2 (delete at both storage capacity threshold and profile inactivity threshold).
-
-
-
-
-
-
-
-
-
- Profile deletion policy
-
- text/plain
-
-
-
-
- StorageCapacityStartDeletion
-
-
-
-
-
-
-
- 25
- Start deleting profiles when available storage capacity falls below this threshold, given as percent of total storage available for profiles. Profiles that have been inactive the longest will be deleted first.
-
-
-
-
-
-
-
-
-
- Storage capacity threshold to start profile deletion
-
- text/plain
-
-
-
-
- StorageCapacityStopDeletion
-
-
-
-
-
-
-
- 50
- Stop deleting profiles when available storage capacity is brought up to this threshold, given as percent of total storage available for profiles.
-
-
-
-
-
-
-
-
-
- Storage capacity threshold to stop profile deletion
-
- text/plain
-
-
-
-
- ProfileInactivityThreshold
-
-
-
-
-
-
-
- 30
- Start deleting profiles when they have not been logged on during the specified period, given as number of days.
-
-
-
-
-
-
-
-
-
- Profile inactive threshold
-
- text/plain
-
-
-
-
+
+ StorageCapacityStopDeletion
+
+
+
+
+
+
+
+ 50
+ Stop deleting profiles when available storage capacity is brought up to this threshold, given as percent of total storage available for profiles.
+
+
+
+
+
+
+
+
+
+ Storage capacity threshold to stop profile deletion
+
+
+
+
+
+
+ ProfileInactivityThreshold
+
+
+
+
+
+
+
+ 30
+ Start deleting profiles when they have not been logged on during the specified period, given as number of days.
+
+
+
+
+
+
+
+
+
+ Profile inactive threshold
+
+
+
+
+
+
+
```
-## Related topics
+## Related articles
-[AccountManagement configuration service provider](accountmanagement-csp.md)
\ No newline at end of file
+[AccountManagement configuration service provider reference](accountmanagement-csp.md)
diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md
index d2884cb925..8128e3e6e5 100644
--- a/windows/client-management/mdm/clouddesktop-ddf-file.md
+++ b/windows/client-management/mdm/clouddesktop-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 07/25/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -47,7 +47,7 @@ The following XML file contains the device description framework (DDF) for the C
22631.2050
1.0
- 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF;
+ 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD;
@@ -60,7 +60,7 @@ The following XML file contains the device description framework (DDF) for the C
false
- Setting this node to "true" configures boot to cloud for Shared PC mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. For enabling boot to cloud shared pc feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned.
+ Setting this node to "true" configures boot to cloud for Shared PC mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. For enabling Boot to Cloud Shared PC feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned.
diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md
index f526723268..fb4186237a 100644
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the Defender CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -57,6 +57,7 @@ The following list shows the Defender configuration service provider nodes:
- [DisableInboundConnectionFiltering](#configurationdisableinboundconnectionfiltering)
- [DisableLocalAdminMerge](#configurationdisablelocaladminmerge)
- [DisableNetworkProtectionPerfTelemetry](#configurationdisablenetworkprotectionperftelemetry)
+ - [DisableQuicParsing](#configurationdisablequicparsing)
- [DisableRdpParsing](#configurationdisablerdpparsing)
- [DisableSmtpParsing](#configurationdisablesmtpparsing)
- [DisableSshParsing](#configurationdisablesshparsing)
@@ -492,7 +493,7 @@ Define the retention period in days of how much time the evidence data will be k
-Defines the maximum data duplication quota in MB that can be collected. When the quota is reached the filter will stop duplicating any data until the service manages to dispatch the existing collected data, thus decreasing the quota again below the maximum.
+Defines the maximum data duplication quota in MB that can be collected. When the quota is reached the filter will stop duplicating any data until the service manages to dispatch the existing collected data, thus decreasing the quota again below the maximum. The valid interval is [5-5000] MB. By default, the maximum quota will be 500 MB.
@@ -504,8 +505,10 @@ Defines the maximum data duplication quota in MB that can be collected. When the
| Property name | Property value |
|:--|:--|
-| Format | `chr` (string) |
+| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Range: `[5-5000]` |
+| Default Value | 500 |
@@ -570,7 +573,7 @@ Define data duplication remote location for device control.
-Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If set to 0, aggressive quick scans will be disabled. By default, the value is set to 25 days.
+Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 25 days when enabled.
@@ -584,7 +587,7 @@ Configure how many days can pass before an aggressive quick scan is triggered. T
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
-| Allowed Values | Range: `[0,7-60]` |
+| Allowed Values | Range: `[7-60]` |
| Default Value | 25 |
@@ -989,10 +992,20 @@ Defines whether the cache maintenance idle task will perform the cache maintenan
| Property name | Property value |
|:--|:--|
-| Format | `chr` (string) |
+| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 1 | Cache maintenance is disabled. |
+| 0 (Default) | Cache maintenance is enabled (default). |
+
+
@@ -1489,6 +1502,55 @@ This setting disables the gathering and send of performance telemetry from Netwo
+
+### Configuration/DisableQuicParsing
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
+
+
+
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/DisableQuicParsing
+```
+
+
+
+
+This setting disables QUIC Parsing for Network Protection.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 1 | QUIC parsing is disabled. |
+| 0 (Default) | QUIC parsing is enabled. |
+
+
+
+
+
+
+
+
### Configuration/DisableRdpParsing
@@ -1916,6 +1978,7 @@ Allows an administrator to explicitly disable network packet inspection made by
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `|`) |
@@ -2203,7 +2266,7 @@ Setting to control automatic remediation for Sense scans.
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
-| Default Value | 0 |
+| Default Value | 0x0 |
@@ -2211,6 +2274,7 @@ Setting to control automatic remediation for Sense scans.
| Flag | Description |
|:--|:--|
+| 0x0 (Default) | Passive Remediation is turned off (default). |
| 0x1 | PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation. |
| 0x2 | PASSIVE_REMEDIATION_FLAG_RTP_AUDIT: Passive Remediation Realtime Protection Audit. |
| 0x4 | PASSIVE_REMEDIATION_FLAG_RTP_REMEDIATION: Passive Remediation Realtime Protection Remediation. |
@@ -2494,6 +2558,7 @@ Defines what are the devices primary ids that should be secured by Defender Devi
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `|`) |
diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md
index 00b7d76777..22e2b101f9 100644
--- a/windows/client-management/mdm/defender-ddf.md
+++ b/windows/client-management/mdm/defender-ddf.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/02/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -1060,6 +1060,7 @@ The following XML file contains the device description framework (DDF) for the D
1.3
+
@@ -2194,7 +2195,7 @@ The following XML file contains the device description framework (DDF) for the D
25
- Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If set to 0, aggressive quick scans will be disabled. By default, the value is set to 25 days.
+ Configure how many days can pass before an aggressive quick scan is triggered. The valid interval is [7-60] days. If not configured, aggressive quick scans will be disabled. By default, the value is set to 25 days when enabled.
@@ -2212,7 +2213,7 @@ The following XML file contains the device description framework (DDF) for the D
1.3
- [0,7-60]
+ [7-60]
@@ -2333,6 +2334,7 @@ The following XML file contains the device description framework (DDF) for the D
1.3
+
@@ -2345,9 +2347,10 @@ The following XML file contains the device description framework (DDF) for the D
- Defines the maximum data duplication quota in MB that can be collected. When the quota is reached the filter will stop duplicating any data until the service manages to dispatch the existing collected data, thus decreasing the quota again below the maximum.
+ 500
+ Defines the maximum data duplication quota in MB that can be collected. When the quota is reached the filter will stop duplicating any data until the service manages to dispatch the existing collected data, thus decreasing the quota again below the maximum. The valid interval is [5-5000] MB. By default, the maximum quota will be 500 MB.
-
+
@@ -2362,7 +2365,8 @@ The following XML file contains the device description framework (DDF) for the D
10.0.17763
1.3
-
+
+ [5-5000]
@@ -2487,7 +2491,7 @@ The following XML file contains the device description framework (DDF) for the D
- 0
+ 0x0
Setting to control automatic remediation for Sense scans.
@@ -2506,6 +2510,10 @@ The following XML file contains the device description framework (DDF) for the D
1.3
+
+ 0x0
+ Passive Remediation is turned off (default)
+
0x1
PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation
@@ -2603,6 +2611,45 @@ The following XML file contains the device description framework (DDF) for the D
+
+ DisableQuicParsing
+
+
+
+
+
+
+
+ 0
+ This setting disables QUIC Parsing for Network Protection.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 10.0.14393
+ 1.3
+
+
+
+ 1
+ QUIC parsing is disabled
+
+
+ 0
+ QUIC parsing is enabled
+
+
+
+
AllowSwitchToAsyncInspection
@@ -2729,9 +2776,10 @@ The following XML file contains the device description framework (DDF) for the D
+ 0
Defines whether the cache maintenance idle task will perform the cache maintenance or not.
-
+
@@ -2746,7 +2794,15 @@ The following XML file contains the device description framework (DDF) for the D
10.0.17763
1.3
-
+
+
+ 1
+ Cache maintenance is disabled
+
+
+ 0
+ Cache maintenance is enabled (default)
+
diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md
index 4ff3f47d51..3933d2fb17 100644
--- a/windows/client-management/mdm/euiccs-csp.md
+++ b/windows/client-management/mdm/euiccs-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the eUICCs CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -108,7 +108,7 @@ Represents information associated with an eUICC. There is one subtree for each k
-Actions that can be performed on the eUICC as a whole (when it's active).
+Actions that can be performed on the eUICC as a whole.
@@ -147,7 +147,7 @@ Actions that can be performed on the eUICC as a whole (when it's active).
-An EXECUTE on this node triggers the LPA to perform an eUICC Memory Reset.
+This triggers an eUICC Memory Reset, which erases all the eSIM profiles in the eUICC.
@@ -226,7 +226,7 @@ Status of most recent operation, as an HRESULT. S_OK indicates success, S_FALSE
-Represents default SM-DP+ discovery requests.
+Represents servers used for bulk provisioning and eSIM discovery.
@@ -265,7 +265,7 @@ Represents default SM-DP+ discovery requests.
-Node representing the discovery operation for a server name. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.
+Node representing a bulk download/discovery server. The node name is the fully qualified domain name of the server that will be used. Creation of this subtree triggers a discovery request.
@@ -353,7 +353,7 @@ Indicates whether the discovered profile must be enabled automatically after ins
-Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA.
+Current state of the discovery operation for this server (Requested = 1, Executing = 2, Completed = 3, Failed = 4).
@@ -393,7 +393,7 @@ Current state of the discovery operation for the parent ServerName (Requested =
-Indicates whether the server is a discovery server. Optional, default value is false.
+Indicates whether the server is a discovery server or if it's used for bulk download. A discovery server is used every time a user requests a profile discovery operation. Optional, default value is false.
@@ -442,7 +442,7 @@ Indicates whether the server is a discovery server. Optional, default value is f
-The EID.
+The unique eUICC identifier (EID).
@@ -560,7 +560,7 @@ Device policies associated with the eUICC as a whole (not per-profile).
-Determines whether the local user interface of the LUI is available (true if available, false otherwise). Initially populated by the LPA when the eUICC tree is created, can be queried and changed by the MDM server.
+Determines whether or not the user can make changes to the eSIM through the user interface.
@@ -609,7 +609,7 @@ Determines whether the local user interface of the LUI is available (true if ava
-Indicates whether the download of a profile with PPR1 is allowed. If the eUICC has already a profile (regardless of its origin and policy rules associated with it), then the download of a profile with PPR1 isn't allowed.
+Indicates whether the download of a profile with Profile Policy Rule 1 (PPR1) is allowed. If the eUICC has already a profile (regardless of its origin and policy rules associated with it), then the download of a profile with PPR1 isn't allowed.
@@ -648,7 +648,7 @@ Indicates whether the download of a profile with PPR1 is allowed. If the eUICC h
-Indicates whether the eUICC has already a profile with PPR1.
+Indicates whether the eUICC has already a profile with Profile Policy Rule 1 (PPR1).
@@ -687,7 +687,7 @@ Indicates whether the eUICC has already a profile with PPR1.
-Represents all enterprise-owned profiles.
+Represents all enterprise-owned eSIM profiles.
@@ -726,7 +726,7 @@ Represents all enterprise-owned profiles.
-Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).
+Node representing an enterprise-owned eSIM profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).
@@ -806,7 +806,7 @@ Detailed error if the profile download and install procedure failed (None = 0, C
-Indicates whether this profile is enabled. Can be set by the MDM when the ICCID subtree is created. Can also be queried and updated by the CSP.
+Indicates whether this eSIM profile is enabled. Can be set by both the MDM and the CSP.
@@ -854,7 +854,7 @@ Indicates whether this profile is enabled. Can be set by the MDM when the ICCID
-Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created.
+Matching ID (activation code token) for eSIM profile download. Must be set by the MDM when the ICCID subtree is created.
@@ -894,7 +894,7 @@ Matching ID (activation code token) for profile download. Must be set by the MDM
-This profile policy rule indicates whether disabling of this profile isn't allowed (true if not allowed, false otherwise).
+Profile Policy Rule 1 (PPR1) indicates whether disabling of this profile isn't allowed (true if not allowed, false otherwise).
@@ -933,7 +933,7 @@ This profile policy rule indicates whether disabling of this profile isn't allow
-This profile policy rule indicates whether deletion of this profile isn't allowed (true if not allowed, false otherwise).
+Profile Policy Rule 2 (PPR2) indicates whether deletion of this profile isn't allowed (true if not allowed, false otherwise).
@@ -972,7 +972,7 @@ This profile policy rule indicates whether deletion of this profile isn't allowe
-Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created.
+Fully qualified domain name of the server that can download this eSIM profile. Must be set by the MDM when the ICCID subtree is created.
@@ -1011,7 +1011,7 @@ Fully qualified domain name of the SM-DP+ that can download this profile. Must b
-Current state of the profile (Installing = 1, Installed = 2, Deleting = 3, Error = 4). Queried by the CSP and only updated by the LPA.
+Current state of the eSIM profile (Installing = 1, Installed = 2, Deleting = 3, Error = 4).
diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md
index d1293442b4..5a070577f7 100644
--- a/windows/client-management/mdm/euiccs-ddf-file.md
+++ b/windows/client-management/mdm/euiccs-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 06/02/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -84,7 +84,7 @@ The following XML file contains the device description framework (DDF) for the e
- The EID.
+ The unique eUICC identifier (EID).
@@ -129,7 +129,7 @@ The following XML file contains the device description framework (DDF) for the e
- Indicates whether the download of a profile with PPR1 is allowed. If the eUICC has already a profile (regardless of its origin and policy rules associated with it), then the download of a profile with PPR1 is not allowed.
+ Indicates whether the download of a profile with Profile Policy Rule 1 (PPR1) is allowed. If the eUICC has already a profile (regardless of its origin and policy rules associated with it), then the download of a profile with PPR1 is not allowed.
@@ -150,7 +150,7 @@ The following XML file contains the device description framework (DDF) for the e
- Indicates whether the eUICC has already a profile with PPR1.
+ Indicates whether the eUICC has already a profile with Profile Policy Rule 1 (PPR1).
@@ -171,7 +171,7 @@ The following XML file contains the device description framework (DDF) for the e
- Represents default SM-DP+ discovery requests.
+ Represents servers used for bulk provisioning and eSIM discovery.
@@ -199,7 +199,7 @@ The following XML file contains the device description framework (DDF) for the e
- Node representing the discovery operation for a server name. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.
+ Node representing a bulk download/discovery server. The node name is the fully qualified domain name of the server that will be used. Creation of this subtree triggers a discovery request.
@@ -224,7 +224,7 @@ The following XML file contains the device description framework (DDF) for the e
1
- Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA.
+ Current state of the discovery operation for this server (Requested = 1, Executing = 2, Completed = 3, Failed = 4).
@@ -281,7 +281,7 @@ The following XML file contains the device description framework (DDF) for the e
false
- Indicates whether the server is a discovery server. Optional, default value is false.
+ Indicates whether the server is a discovery server or if it is used for bulk download. A discovery server is used every time a user requests a profile discovery operation. Optional, default value is false.
@@ -318,7 +318,7 @@ The following XML file contains the device description framework (DDF) for the e
- Represents all enterprise-owned profiles.
+ Represents all enterprise-owned eSIM profiles.
@@ -342,7 +342,7 @@ The following XML file contains the device description framework (DDF) for the e
- Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).
+ Node representing an enterprise-owned eSIM profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).
@@ -368,7 +368,7 @@ The following XML file contains the device description framework (DDF) for the e
- Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created.
+ Fully qualified domain name of the server that can download this eSIM profile. Must be set by the MDM when the ICCID subtree is created.
@@ -396,7 +396,7 @@ The following XML file contains the device description framework (DDF) for the e
- Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created.
+ Matching ID (activation code token) for eSIM profile download. Must be set by the MDM when the ICCID subtree is created.
@@ -424,7 +424,7 @@ The following XML file contains the device description framework (DDF) for the e
1
- Current state of the profile (Installing = 1, Installed = 2, Deleting = 3, Error = 4). Queried by the CSP and only updated by the LPA.
+ Current state of the eSIM profile (Installing = 1, Installed = 2, Deleting = 3, Error = 4).
@@ -447,7 +447,7 @@ The following XML file contains the device description framework (DDF) for the e
- Indicates whether this profile is enabled. Can be set by the MDM when the ICCID subtree is created. Can also be queried and updated by the CSP.
+ Indicates whether this eSIM profile is enabled. Can be set by both the MDM and the CSP.
@@ -482,7 +482,7 @@ The following XML file contains the device description framework (DDF) for the e
- This profile policy rule indicates whether disabling of this profile is not allowed (true if not allowed, false otherwise).
+ Profile Policy Rule 1 (PPR1) indicates whether disabling of this profile is not allowed (true if not allowed, false otherwise).
@@ -503,7 +503,7 @@ The following XML file contains the device description framework (DDF) for the e
- This profile policy rule indicates whether deletion of this profile is not allowed (true if not allowed, false otherwise).
+ Profile Policy Rule 2 (PPR2) indicates whether deletion of this profile is not allowed (true if not allowed, false otherwise).
@@ -570,7 +570,7 @@ The following XML file contains the device description framework (DDF) for the e
true
- Determines whether the local user interface of the LUI is available (true if available, false otherwise). Initially populated by the LPA when the eUICC tree is created, can be queried and changed by the MDM server.
+ Determines whether or not the user can make changes to the eSIM through the user interface.
@@ -602,7 +602,7 @@ The following XML file contains the device description framework (DDF) for the e
- Actions that can be performed on the eUICC as a whole (when it is active).
+ Actions that can be performed on the eUICC as a whole.
@@ -622,7 +622,7 @@ The following XML file contains the device description framework (DDF) for the e
- An EXECUTE on this node triggers the LPA to perform an eUICC Memory Reset.
+ This triggers an eUICC Memory Reset, which erases all the eSIM profiles in the eUICC.
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index b1d980b61f..d949612f72 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/07/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -2182,6 +2182,11 @@ This article lists the ADMX-backed policies in Policy CSP.
- [TurnOffDataExecutionPreventionForExplorer](policy-csp-fileexplorer.md)
- [TurnOffHeapTerminationOnCorruption](policy-csp-fileexplorer.md)
+## FileSystem
+
+- [EnableDevDrive](policy-csp-filesystem.md)
+- [DevDriveAttachPolicy](policy-csp-filesystem.md)
+
## InternetExplorer
- [AddSearchProvider](policy-csp-internetexplorer.md)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
index 28d800cc4a..5f25eb4ff5 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
@@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -634,6 +634,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
- [HideRecommendedSection](policy-csp-start.md)
- [HideRecommendedPersonalizedSites](policy-csp-start.md)
- [HideTaskViewButton](policy-csp-start.md)
+- [HideCopilotButton](policy-csp-start.md)
- [DisableControlCenter](policy-csp-start.md)
- [SimplifyQuickSettings](policy-csp-start.md)
- [DisableEditingQuickSettings](policy-csp-start.md)
@@ -836,6 +837,10 @@ This article lists the policies in Policy CSP that have a group policy mapping.
- [AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md)
- [AllowInternetSharing](policy-csp-wifi.md)
+## WindowsAI
+
+- [TurnOffWindowsCopilot](policy-csp-windowsai.md)
+
## WindowsDefenderSecurityCenter
- [CompanyName](policy-csp-windowsdefendersecuritycenter.md)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index ac553b2f8e..f0e33b1fda 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Windows 10 Team
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -263,6 +263,7 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
## Start
+- [HideCopilotButton](policy-csp-start.md#hidecopilotbutton)
- [HideRecommendedPersonalizedSites](policy-csp-start.md#hiderecommendedpersonalizedsites)
- [StartLayout](policy-csp-start.md#startlayout)
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index 27e164c141..f7695f6a8a 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -4,7 +4,7 @@ description: Learn more about the Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -1118,6 +1118,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f
- [ExploitGuard](policy-csp-exploitguard.md)
- [FederatedAuthentication](policy-csp-federatedauthentication.md)
- [FileExplorer](policy-csp-fileexplorer.md)
+- [FileSystem](policy-csp-filesystem.md)
- [Games](policy-csp-games.md)
- [Handwriting](policy-csp-handwriting.md)
- [HumanPresence](policy-csp-humanpresence.md)
@@ -1175,6 +1176,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f
- [VirtualizationBasedTechnology](policy-csp-virtualizationbasedtechnology.md)
- [WebThreatDefense](policy-csp-webthreatdefense.md)
- [Wifi](policy-csp-wifi.md)
+- [WindowsAI](policy-csp-windowsai.md)
- [WindowsAutopilot](policy-csp-windowsautopilot.md)
- [WindowsConnectionManager](policy-csp-windowsconnectionmanager.md)
- [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md)
diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md
index 26ad80a56b..a5874803b9 100644
--- a/windows/client-management/mdm/policy-csp-cryptography.md
+++ b/windows/client-management/mdm/policy-csp-cryptography.md
@@ -4,7 +4,7 @@ description: Learn more about the Cryptography Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -228,7 +228,6 @@ Override minimal enabled TLS version for client role. Last write wins.
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
-| Default Value | 1.0 |
@@ -268,7 +267,6 @@ Override minimal enabled TLS version for server role. Last write wins.
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
-| Default Value | 1.0 |
@@ -308,7 +306,6 @@ Override minimal enabled TLS version for client role. Last write wins.
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
-| Default Value | 1.0 |
@@ -348,7 +345,6 @@ Override minimal enabled TLS version for server role. Last write wins.
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
-| Default Value | 1.0 |
diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md
index 3be567246d..8c51b03f44 100644
--- a/windows/client-management/mdm/policy-csp-fileexplorer.md
+++ b/windows/client-management/mdm/policy-csp-fileexplorer.md
@@ -4,7 +4,7 @@ description: Learn more about the FileExplorer Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -167,8 +167,8 @@ Turning off files from Office.com will prevent File Explorer from requesting rec
| Value | Description |
|:--|:--|
-| 0 (Default) | File Explorer will request cloud file metadata and display it in the Quick access view. |
-| 1 | File Explorer won't request cloud file metadata or display it in the Quick access view. |
+| 0 (Default) | File Explorer will request cloud file metadata and display it in the homepage and other views. |
+| 1 | File Explorer won't request cloud file metadata or display it in the homepage or other views. |
diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md
new file mode 100644
index 0000000000..98bb86e6a8
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-filesystem.md
@@ -0,0 +1,135 @@
+---
+title: FileSystem Policy CSP
+description: Learn more about the FileSystem Area in Policy CSP.
+author: vinaypamnani-msft
+manager: aaroncz
+ms.author: vinpa
+ms.date: 08/29/2023
+ms.localizationpriority: medium
+ms.prod: windows-client
+ms.technology: itpro-manage
+ms.topic: reference
+---
+
+
+
+
+# Policy CSP - FileSystem
+
+[!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)]
+
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
+
+
+
+
+
+## DevDriveAttachPolicy
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/FileSystem/DevDriveAttachPolicy
+```
+
+
+
+
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+
+[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | DevDriveAttachPolicy |
+| ADMX File Name | filtermanager.admx |
+
+
+
+
+
+
+
+
+
+## EnableDevDrive
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/FileSystem/EnableDevDrive
+```
+
+
+
+
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+
+[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | EnableDevDrive |
+| ADMX File Name | refs.admx |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+## Related articles
+
+[Policy configuration service provider](policy-configuration-service-provider.md)
diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md
index 00d0c1acb3..ecefad6b6c 100644
--- a/windows/client-management/mdm/policy-csp-mixedreality.md
+++ b/windows/client-management/mdm/policy-csp-mixedreality.md
@@ -4,7 +4,7 @@ description: Learn more about the MixedReality Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -490,6 +490,110 @@ The following XML string is an example of the value for this policy:
+
+## ConfigureSharedAccount
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview |
+
+
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/MixedReality/ConfigureSharedAccount
+```
+
+
+
+
+This policy specifies the configuration for Shared Accounts on the device. Shared Accounts are AAD accounts that are deployed to the device by an IT admin and can be used by anyone with physical access to the device. These accounts excel in deployments where the HoloLens device is used like a tool shared between multiple people and it doesn't matter which account is used to access AAD resources. Because these accounts can be signed in without requiring the user to provide credentials, you should ensure that these devices are physically secure, with access granted only to authorized personnel. You should also lock down these accounts to only have access to the required resources.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `chr` (string) |
+| Access Type | Add, Delete, Get, Replace |
+
+
+
+**Allowed values**:
+
+
+
+ Expand to see schema XML
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+
+
+
+
+
+
+
+
+
## DisallowNetworkConnectivityPassivePolling
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md
index 1bab3b26fb..c3738fcb56 100644
--- a/windows/client-management/mdm/policy-csp-start.md
+++ b/windows/client-management/mdm/policy-csp-start.md
@@ -4,7 +4,7 @@ description: Learn more about the Start Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/29/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -974,6 +974,68 @@ Enabling this policy hides "Change account settings" from appearing in the user
+
+## HideCopilotButton
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/Start/HideCopilotButton
+```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/Start/HideCopilotButton
+```
+
+
+
+
+This policy setting allows you to hide the Copilot button on the Taskbar. If you enable this policy setting, the Copilot button will be hidden and the Settings toggle will be disabled.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Copilot button shown. |
+| 1 | Copilot button hidden. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | HideCopilotButton |
+| Path | Taskbar > AT > StartMenu |
+
+
+
+
+
+
+
+
## HideFrequentlyUsedApps
@@ -1430,7 +1492,7 @@ To validate this policy, do the following steps:
| Scope | Editions | Applicable OS |
|:--|:--|:--|
-| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | |
+| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later |
diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md
new file mode 100644
index 0000000000..3eda0ccc64
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@@ -0,0 +1,95 @@
+---
+title: WindowsAI Policy CSP
+description: Learn more about the WindowsAI Area in Policy CSP.
+author: vinaypamnani-msft
+manager: aaroncz
+ms.author: vinpa
+ms.date: 08/29/2023
+ms.localizationpriority: medium
+ms.prod: windows-client
+ms.technology: itpro-manage
+ms.topic: reference
+---
+
+
+
+
+# Policy CSP - WindowsAI
+
+[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)]
+
+
+
+
+
+
+## TurnOffWindowsCopilot
+
+
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25929.1000] |
+
+
+
+```User
+./User/Vendor/MSFT/Policy/Config/WindowsAI/TurnOffWindowsCopilot
+```
+
+
+
+
+This policy setting allows you to turn off Windows Copilot.
+
+- If you enable this policy setting, users won't be able to use Copilot. The Copilot icon won't appear on the taskbar either.
+
+- If you disable or don't configure this policy setting, users will be able to use Copilot when it's available to them.
+
+
+
+
+
+
+
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | `int` |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value | 0 |
+
+
+
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Enable Copilot. |
+| 1 | Disable Copilot. |
+
+
+
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | TurnOffWindowsCopilot |
+| Path | WindowsCopilot > AT > WindowsComponents > WindowsCopilot |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+## Related articles
+
+[Policy configuration service provider](policy-configuration-service-provider.md)
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index a909cac63a..9125eb9388 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -440,6 +440,8 @@ items:
href: policy-csp-feeds.md
- name: FileExplorer
href: policy-csp-fileexplorer.md
+ - name: FileSystem
+ href: policy-csp-filesystem.md
- name: Games
href: policy-csp-games.md
- name: Handwriting
@@ -554,6 +556,8 @@ items:
href: policy-csp-webthreatdefense.md
- name: Wifi
href: policy-csp-wifi.md
+ - name: WindowsAI
+ href: policy-csp-windowsai.md
- name: WindowsAutopilot
href: policy-csp-windowsautopilot.md
- name: WindowsConnectionManager
From cf16c1f9879c109d90a991c5a22986c6d372b7b8 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 31 Aug 2023 11:37:52 -0400
Subject: [PATCH 2/3] Update GPO strings using latest ADMX/L files
---
...icy-csp-admx-microsoftdefenderantivirus.md | 15 ++-
.../mdm/policy-csp-admx-terminalserver.md | 5 +-
.../mdm/policy-csp-fileexplorer.md | 6 +-
.../mdm/policy-csp-filesystem.md | 27 +++++-
.../mdm/policy-csp-humanpresence.md | 42 +++++---
.../mdm/policy-csp-multitasking.md | 8 +-
.../mdm/policy-csp-notifications.md | 36 +++++--
.../mdm/policy-csp-privacy.md | 95 +++++++++++++++----
.../mdm/policy-csp-settingssync.md | 17 +++-
.../client-management/mdm/policy-csp-start.md | 13 ++-
.../mdm/policy-csp-system.md | 12 ++-
.../mdm/policy-csp-webthreatdefense.md | 19 +++-
.../mdm/policy-csp-windowsai.md | 11 ++-
13 files changed, 239 insertions(+), 67 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
index 7cdc026046..f462eeaba0 100644
--- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
+++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -3239,7 +3239,12 @@ This policy setting allows you to configure heuristics. Suspicious detections wi
-
+
+This policy setting allows you to configure scanning for packed executables. It's recommended that this type of scanning remain enabled.
+
+- If you enable or don't configure this setting, packed executables will be scanned.
+
+- If you disable this setting, packed executables won't be scanned.
@@ -3256,7 +3261,6 @@ This policy setting allows you to configure heuristics. Suspicious detections wi
-
[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
**ADMX mapping**:
@@ -3264,6 +3268,11 @@ This policy setting allows you to configure heuristics. Suspicious detections wi
| Name | Value |
|:--|:--|
| Name | Scan_DisablePackedExeScanning |
+| Friendly Name | Scan packed executables |
+| Location | Computer Configuration |
+| Path | Windows Components > Microsoft Defender Antivirus > Scan |
+| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan |
+| Registry Value Name | DisablePackedExeScanning |
| ADMX File Name | WindowsDefender.admx |
diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md
index 845fe646f5..690350461f 100644
--- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md
+++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_TerminalServer Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -2457,6 +2457,9 @@ Per Device licensing mode requires that each device connecting to this RD Sessio
- If you enable this policy setting, the Remote Desktop licensing mode that you specify is honored by the Remote Desktop license server and RD Session Host.
- If you disable or don't configure this policy setting, the licensing mode isn't specified at the Group Policy level.
+
+> [!NOTE]
+> AAD Per User mode is deprecated on Windows 11 and above.
diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md
index 8c51b03f44..75e9fb777f 100644
--- a/windows/client-management/mdm/policy-csp-fileexplorer.md
+++ b/windows/client-management/mdm/policy-csp-fileexplorer.md
@@ -4,7 +4,7 @@ description: Learn more about the FileExplorer Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/29/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -145,7 +145,7 @@ When This PC location is restricted, give the user the option to enumerate and n
-Turning off files from Office.com will prevent File Explorer from requesting recent cloud file metadata and displaying it in the Quick access view.
+Turning off this setting will prevent File Explorer from requesting cloud file metadata and displaying it in the homepage and other views in File Explorer. Any insights and files available based on account activity will be stopped in views such as Recent, Recommended, Favorites, etc.
@@ -177,7 +177,7 @@ Turning off files from Office.com will prevent File Explorer from requesting rec
| Name | Value |
|:--|:--|
| Name | DisableGraphRecentItems |
-| Friendly Name | Turn off files from Office.com in Quick access view |
+| Friendly Name | Turn off account-based insights, recent, favorite, and recommended files in File Explorer |
| Location | Computer Configuration |
| Path | WindowsComponents > File Explorer |
| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer |
diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md
index 98bb86e6a8..57ec3f91e0 100644
--- a/windows/client-management/mdm/policy-csp-filesystem.md
+++ b/windows/client-management/mdm/policy-csp-filesystem.md
@@ -4,7 +4,7 @@ description: Learn more about the FileSystem Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/29/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -40,7 +40,10 @@ ms.topic: reference
-
+
+Dev drive is a drive optimized for performance considering developer scenarios and by default no file system filters are attached to it. Filters listed in this setting will be allowed to attach even on a dev drive.
+
+A reboot is required for this setting to take effect.
@@ -57,7 +60,6 @@ ms.topic: reference
-
[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
**ADMX mapping**:
@@ -65,6 +67,10 @@ ms.topic: reference
| Name | Value |
|:--|:--|
| Name | DevDriveAttachPolicy |
+| Friendly Name | Dev drive filter attach policy |
+| Location | Computer Configuration |
+| Path | System > Filesystem |
+| Registry Key Name | System\CurrentControlSet\Policies |
| ADMX File Name | filtermanager.admx |
@@ -90,7 +96,14 @@ ms.topic: reference
-
+
+Dev drive or developer volume is a volume optimized for performance of developer scenarios. A developer volume allows an administrator to choose file system filters that are attached on the volume.
+
+Disabling this setting will disallow creation of new developer volumes, existing developer volumes will mount as regular volumes.
+
+If this setting isn't configured the default policy is to enable developer volumes while allowing antivirus filter to attach on a deveveloper volume. Further, if not configured, a local administrator can choose to not have antivirus filter attached to a developer volume.
+
+A reboot is required for this setting to take effect.
@@ -107,7 +120,6 @@ ms.topic: reference
-
[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
**ADMX mapping**:
@@ -115,6 +127,11 @@ ms.topic: reference
| Name | Value |
|:--|:--|
| Name | EnableDevDrive |
+| Friendly Name | Enable dev drive |
+| Location | Computer Configuration |
+| Path | System > Filesystem |
+| Registry Key Name | System\CurrentControlSet\Policies |
+| Registry Value Name | FsEnableDevDrive |
| ADMX File Name | refs.admx |
diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md
index e0cc0d9db0..6584e6372b 100644
--- a/windows/client-management/mdm/policy-csp-humanpresence.md
+++ b/windows/client-management/mdm/policy-csp-humanpresence.md
@@ -4,7 +4,7 @@ description: Learn more about the HumanPresence Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -38,8 +38,8 @@ ms.topic: reference
-
-Determines whether Allow Adaptive Dimming When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
+
+Determines whether Allow Adaptive Dimming When Battery Saver On checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
@@ -72,7 +72,12 @@ Determines whether Allow Adaptive Dimming When External Display Connected checkb
| Name | Value |
|:--|:--|
| Name | ForceAllowDimWhenExternalDisplayConnected |
-| Path | Sensors > AT > WindowsComponents > HumanPresence |
+| Friendly Name | Force Allow Dim When External Display Connected |
+| Location | Computer Configuration |
+| Path | Windows Components > Human Presence |
+| Registry Key Name | Software\Policies\Microsoft\HumanPresence |
+| Registry Value Name | ForceAllowDimWhenExternalDisplayConnected |
+| ADMX File Name | Sensors.admx |
@@ -97,8 +102,8 @@ Determines whether Allow Adaptive Dimming When External Display Connected checkb
-
-Determines whether Allow Lock on Leave When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
+
+Determines whether Allow Lock on Leave When Battery Saver On checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
@@ -131,7 +136,12 @@ Determines whether Allow Lock on Leave When External Display Connected checkbox
| Name | Value |
|:--|:--|
| Name | ForceAllowLockWhenExternalDisplayConnected |
-| Path | Sensors > AT > WindowsComponents > HumanPresence |
+| Friendly Name | Force Allow Lock When External Display Connected |
+| Location | Computer Configuration |
+| Path | Windows Components > Human Presence |
+| Registry Key Name | Software\Policies\Microsoft\HumanPresence |
+| Registry Value Name | ForceAllowLockWhenExternalDisplayConnected |
+| ADMX File Name | Sensors.admx |
@@ -156,7 +166,7 @@ Determines whether Allow Lock on Leave When External Display Connected checkbox
-
+
Determines whether Allow Wake on Approach When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
@@ -190,7 +200,12 @@ Determines whether Allow Wake on Approach When External Display Connected checkb
| Name | Value |
|:--|:--|
| Name | ForceAllowWakeWhenExternalDisplayConnected |
-| Path | Sensors > AT > WindowsComponents > HumanPresence |
+| Friendly Name | Force Allow Wake When External Display Connected |
+| Location | Computer Configuration |
+| Path | Windows Components > Human Presence |
+| Registry Key Name | Software\Policies\Microsoft\HumanPresence |
+| Registry Value Name | ForceAllowWakeWhenExternalDisplayConnected |
+| ADMX File Name | Sensors.admx |
@@ -215,7 +230,7 @@ Determines whether Allow Wake on Approach When External Display Connected checkb
-
+
Determines whether Disable Wake on Approach When Battery Saver On checkbox is forced checked/unchecked by the MDM policy. The user won't be able to change this setting and the checkbox in the UI will be greyed out.
@@ -249,7 +264,12 @@ Determines whether Disable Wake on Approach When Battery Saver On checkbox is fo
| Name | Value |
|:--|:--|
| Name | ForceDisableWakeWhenBatterySaverOn |
-| Path | Sensors > AT > WindowsComponents > HumanPresence |
+| Friendly Name | Force Disable Wake When Battery Saver On |
+| Location | Computer Configuration |
+| Path | Windows Components > Human Presence |
+| Registry Key Name | Software\Policies\Microsoft\HumanPresence |
+| Registry Value Name | ForceDisableWakeWhenBatterySaverOn |
+| ADMX File Name | Sensors.admx |
diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md
index 3fd43b32c1..c12b74e90f 100644
--- a/windows/client-management/mdm/policy-csp-multitasking.md
+++ b/windows/client-management/mdm/policy-csp-multitasking.md
@@ -4,7 +4,7 @@ description: Learn more about the Multitasking Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -37,9 +37,9 @@ ms.topic: reference
-This setting controls the inclusion of Microsoft Edge tabs into Alt+Tab.
+This setting controls the inclusion of app tabs into Alt+Tab.
-This can be set to show all tabs, the most recent 3 or 5 tabs, or no tabs from Microsoft Edge.
+This can be set to show the most recent 3, 5 or 20 tabs, or no tabs from apps.
If this is set to show "Open windows only", the whole feature will be disabled.
@@ -82,7 +82,7 @@ This policy only applies to the Alt+Tab switcher. When the policy isn't enabled,
| Name | Value |
|:--|:--|
| Name | BrowserAltTabBlowout |
-| Friendly Name | Configure the inclusion of Microsoft Edge tabs into Alt-Tab |
+| Friendly Name | Configure the inclusion of app tabs into Alt-Tab |
| Element Name | Pressing Alt + Tab shows. |
| Location | User Configuration |
| Path | Windows Components > Multitasking |
diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md
index 10ce383407..1f7b42377a 100644
--- a/windows/client-management/mdm/policy-csp-notifications.md
+++ b/windows/client-management/mdm/policy-csp-notifications.md
@@ -4,7 +4,7 @@ description: Learn more about the Notifications Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -38,8 +38,16 @@ ms.topic: reference
-
-This policy allows you to prevent Windows from displaying notifications to Microsoft account (MSA) and local users in Start (user tile). Notifications include getting users to: reauthenticate; backup their device; manage cloud storage quotas as well as manage their Microsoft 365 or XBOX subscription. If you enable this policy setting, Windows won't send account related notifications for local and MSA users to the user tile in Start.
+
+This policy allows you to prevent Windows from displaying notifications to Microsoft account (MSA) and local users in Start (user tile).
+
+Notifications include getting users to: reauthenticate; backup their device; manage cloud storage quotas as well as manage their Microsoft 365 or XBOX subscription.
+
+- If you enable this policy setting, Windows won't send account related notifications for local and MSA users to the user tile in Start.
+
+- If you disable or don't configure this policy setting, Windows will send account related notifications for local and MSA users to the user tile in Start.
+
+No reboots or service restarts are required for this policy setting to take effect.
@@ -71,7 +79,12 @@ This policy allows you to prevent Windows from displaying notifications to Micro
| Name | Value |
|:--|:--|
| Name | DisableAccountNotifications |
-| Path | AccountNotifications > AT > WindowsComponents > AccountNotifications |
+| Friendly Name | Turn off account notifications in Start |
+| Location | User Configuration |
+| Path | Windows Components > Account Notifications |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AccountNotifications |
+| Registry Value Name | DisableAccountNotifications |
+| ADMX File Name | AccountNotifications.admx |
@@ -318,12 +331,16 @@ No reboots or service restarts are required for this policy setting to take effe
-
+
This policy setting turns on multiple expanded toast notifications in action center.
- If you enable this policy setting, the first three notifications of each application will be expanded by default in action center.
-- If you disable or don't configure this policy setting, only the first notification of each application will be expanded by default in action center. Windows 10 only. This will be immediately deprecated for Windows 11. No reboots or service restarts are required for this policy setting to take effect.
+- If you disable or don't configure this policy setting, only the first notification of each application will be expanded by default in action center.
+
+Windows 10 only. This will be immediately deprecated for Windows 11.
+
+No reboots or service restarts are required for this policy setting to take effect.
@@ -355,7 +372,12 @@ This policy setting turns on multiple expanded toast notifications in action cen
| Name | Value |
|:--|:--|
| Name | ExpandedToastNotifications |
-| Path | WPN > AT > StartMenu > NotificationsCategory |
+| Friendly Name | Turn on multiple expanded toast notifications in action center |
+| Location | User Configuration |
+| Path | Start Menu and Taskbar > Notifications |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications |
+| Registry Value Name | EnableExpandedToastNotifications |
+| ADMX File Name | WPN.admx |
diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md
index 5102bebb64..b272736200 100644
--- a/windows/client-management/mdm/policy-csp-privacy.md
+++ b/windows/client-management/mdm/policy-csp-privacy.md
@@ -4,7 +4,7 @@ description: Learn more about the Privacy Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -2946,8 +2946,20 @@ If an app is open when this Group Policy object is applied on a device, employee
-
-This policy setting specifies whether Windows apps can access the human presence sensor.
+
+This policy setting specifies whether Windows apps can access presence sensing.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access presence sensing and employees in your organization can't change it.
+
+If you choose the "Force Deny" option, Windows apps aren't allowed to access presence sensing and employees in your organization can't change it.
+
+If you disable or don't configure this policy setting, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
@@ -2980,8 +2992,12 @@ This policy setting specifies whether Windows apps can access the human presence
| Name | Value |
|:--|:--|
| Name | LetAppsAccessHumanPresence |
-| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
-| Element Name | LetAppsAccessHumanPresence_Enum |
+| Friendly Name | Let Windows apps access presence sensing |
+| Element Name | Default for all apps. |
+| Location | Computer Configuration |
+| Path | Windows Components > App Privacy |
+| Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
+| ADMX File Name | AppPrivacy.admx |
@@ -3006,8 +3022,20 @@ This policy setting specifies whether Windows apps can access the human presence
-
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps.
+
+This policy setting specifies whether Windows apps can access presence sensing.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access presence sensing and employees in your organization can't change it.
+
+If you choose the "Force Deny" option, Windows apps aren't allowed to access presence sensing and employees in your organization can't change it.
+
+If you disable or don't configure this policy setting, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
@@ -3030,8 +3058,11 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
| Name | Value |
|:--|:--|
| Name | LetAppsAccessHumanPresence |
-| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
-| Element Name | LetAppsAccessHumanPresence_ForceAllowTheseApps_List |
+| Friendly Name | Let Windows apps access presence sensing |
+| Location | Computer Configuration |
+| Path | Windows Components > App Privacy |
+| Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
+| ADMX File Name | AppPrivacy.admx |
@@ -3056,8 +3087,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
-
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps.
+
+This policy setting specifies whether Windows apps can access presence sensing.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access presence sensing and employees in your organization can't change it.
+
+If you choose the "Force Deny" option, Windows apps aren't allowed to access presence sensing and employees in your organization can't change it.
+
+If you disable or don't configure this policy setting, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
@@ -3080,8 +3123,11 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
| Name | Value |
|:--|:--|
| Name | LetAppsAccessHumanPresence |
-| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
-| Element Name | LetAppsAccessHumanPresence_ForceDenyTheseApps_List |
+| Friendly Name | Let Windows apps access presence sensing |
+| Location | Computer Configuration |
+| Path | Windows Components > App Privacy |
+| Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
+| ADMX File Name | AppPrivacy.admx |
@@ -3106,8 +3152,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
-
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the human presence privacy setting for the listed apps. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps.
+
+This policy setting specifies whether Windows apps can access presence sensing.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access presence sensing and employees in your organization can't change it.
+
+If you choose the "Force Deny" option, Windows apps aren't allowed to access presence sensing and employees in your organization can't change it.
+
+If you disable or don't configure this policy setting, employees in your organization can decide whether Windows apps can access presence sensing by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
@@ -3130,8 +3188,11 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
| Name | Value |
|:--|:--|
| Name | LetAppsAccessHumanPresence |
-| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
-| Element Name | LetAppsAccessHumanPresence_UserInControlOfTheseApps_List |
+| Friendly Name | Let Windows apps access presence sensing |
+| Location | Computer Configuration |
+| Path | Windows Components > App Privacy |
+| Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
+| ADMX File Name | AppPrivacy.admx |
diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md
index 7a792dc92c..954bbaeaf2 100644
--- a/windows/client-management/mdm/policy-csp-settingssync.md
+++ b/windows/client-management/mdm/policy-csp-settingssync.md
@@ -4,7 +4,7 @@ description: Learn more about the SettingsSync Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -101,7 +101,14 @@ If you don't set or disable this setting, syncing of the "accessibility" group i
-
+
+Prevent the "language preferences" group from syncing to and from this PC. This turns off and disables the "languages preferences" group on the "Windows backup" settings page in PC settings.
+
+If you enable this policy setting, the "language preferences", group won't be synced.
+
+Use the option "Allow users to turn language preferences syncing on" so that syncing is turned off by default but not disabled.
+
+If you don't set or disable this setting, syncing of the "language preferences" group is on by default and configurable by the user.
@@ -118,7 +125,6 @@ If you don't set or disable this setting, syncing of the "accessibility" group i
-
[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)]
**ADMX mapping**:
@@ -126,6 +132,11 @@ If you don't set or disable this setting, syncing of the "accessibility" group i
| Name | Value |
|:--|:--|
| Name | DisableLanguageSettingSync |
+| Friendly Name | Do not sync language preferences settings |
+| Location | Computer Configuration |
+| Path | Windows Components > Sync your settings |
+| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync |
+| Registry Value Name | DisableLanguageSettingSync |
| ADMX File Name | SettingSync.admx |
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md
index c3738fcb56..a62fd83d3f 100644
--- a/windows/client-management/mdm/policy-csp-start.md
+++ b/windows/client-management/mdm/policy-csp-start.md
@@ -4,7 +4,7 @@ description: Learn more about the Start Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/29/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -1506,8 +1506,8 @@ To validate this policy, do the following steps:
-
-This policy setting allows you to hide the personalized websites in the recommended section of the Start Menu. If you enable this policy setting, the Start Menu will no longer show personalized website recommendations in the recommended section of the start menu.
+
+Remove Personalized Website Recommendations from the Recommended section in the Start Menu.
@@ -1539,7 +1539,12 @@ This policy setting allows you to hide the personalized websites in the recommen
| Name | Value |
|:--|:--|
| Name | HideRecommendedPersonalizedSites |
-| Path | StartMenu > AT > StartMenu |
+| Friendly Name | Remove Personalized Website Recommendations from the Recommended section in the Start Menu |
+| Location | Computer and User Configuration |
+| Path | Start Menu and Taskbar |
+| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer |
+| Registry Value Name | HideRecommendedPersonalizedSites |
+| ADMX File Name | StartMenu.admx |
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md
index 58708cd210..700b3d03f2 100644
--- a/windows/client-management/mdm/policy-csp-system.md
+++ b/windows/client-management/mdm/policy-csp-system.md
@@ -4,7 +4,7 @@ description: Learn more about the System Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -111,6 +111,8 @@ This policy is only supported up to Windows 10, Version 1703. Please use 'Manage
+This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
+
AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
To enable this behavior:
@@ -120,7 +122,7 @@ To enable this behavior:
Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting doesn't change the Windows diagnostic data collection level set for the device.
-If you disable or don't configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing".
+If you disable or don't configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing'.
See the documentation at for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data.
@@ -189,6 +191,8 @@ See the documentation at for i
+This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
+
This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
To enable this behavior:
@@ -751,6 +755,8 @@ If you disable or don't configure this policy setting, the device will send requ
+This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
+
This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
To enable this behavior:
@@ -876,6 +882,8 @@ Specifies whether to allow the user to factory reset the device by using control
+This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
+
This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
To enable this behavior:
diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md
index 06336a8d08..a5834287ac 100644
--- a/windows/client-management/mdm/policy-csp-webthreatdefense.md
+++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md
@@ -4,7 +4,7 @@ description: Learn more about the WebThreatDefense Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/10/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -40,8 +40,14 @@ ms.topic: reference
-
-Automatically collect website or app content when additional analysis is needed to help identify security threats.
+
+This policy setting determines whether Enhanced Phishing Protection can collect additional information-such as content displayed, sounds played, and application memory-when your users enter their work or school password into a suspicious website or app. This information is used only for security purposes and helps SmartScreen determine whether the website or app is malicious.
+
+- If you enable this policy setting, Enhanced Phishing Protection may automatically collect additional content for security analysis from a suspicious website or app when your users enter their work or school password into that website or app.
+
+- If you disable this policy setting, Enhanced Phishing Protection won't collect additional content for security analysis when your users enter their work or school password into a suspicious site or app.
+
+- If this policy isn't set, Enhanced Phishing Protection automatic data collection will honor the end user's settings.
@@ -73,7 +79,12 @@ Automatically collect website or app content when additional analysis is needed
| Name | Value |
|:--|:--|
| Name | AutomaticDataCollection |
-| Path | WebThreatDefense > AT > WindowsComponents > WebThreatDefense |
+| Friendly Name | Automatic Data Collection |
+| Location | Computer Configuration |
+| Path | Windows Components > Windows Defender SmartScreen > Enhanced Phishing Protection |
+| Registry Key Name | Software\Policies\Microsoft\Windows\WTDS\Components |
+| Registry Value Name | CaptureThreatWindow |
+| ADMX File Name | WebThreatDefense.admx |
diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md
index 3eda0ccc64..5d7b09569f 100644
--- a/windows/client-management/mdm/policy-csp-windowsai.md
+++ b/windows/client-management/mdm/policy-csp-windowsai.md
@@ -4,7 +4,7 @@ description: Learn more about the WindowsAI Area in Policy CSP.
author: vinaypamnani-msft
manager: aaroncz
ms.author: vinpa
-ms.date: 08/29/2023
+ms.date: 08/30/2023
ms.localizationpriority: medium
ms.prod: windows-client
ms.technology: itpro-manage
@@ -38,7 +38,7 @@ ms.topic: reference
-
+
This policy setting allows you to turn off Windows Copilot.
- If you enable this policy setting, users won't be able to use Copilot. The Copilot icon won't appear on the taskbar either.
@@ -75,7 +75,12 @@ This policy setting allows you to turn off Windows Copilot.
| Name | Value |
|:--|:--|
| Name | TurnOffWindowsCopilot |
-| Path | WindowsCopilot > AT > WindowsComponents > WindowsCopilot |
+| Friendly Name | Turn off Windows Copilot |
+| Location | User Configuration |
+| Path | Windows Components > Windows Copilot |
+| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot |
+| Registry Value Name | TurnOffWindowsCopilot |
+| ADMX File Name | WindowsCopilot.admx |
From bb77d24325c98e6f6dda5428fbb8b4dfdc14c63d Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 8 Sep 2023 11:18:36 -0700
Subject: [PATCH 3/3] gcc-relhealth-8337541
---
windows/deployment/update/check-release-health.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/deployment/update/check-release-health.md b/windows/deployment/update/check-release-health.md
index a5732df6ef..ba7b6d264d 100644
--- a/windows/deployment/update/check-release-health.md
+++ b/windows/deployment/update/check-release-health.md
@@ -13,7 +13,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 06/07/2023
+ms.date: 09/08/2023
---
# How to check Windows release health
@@ -36,7 +36,7 @@ Ensure the following prerequisites are met to display the Windows release health
- Most roles containing the word `administrator` give you access to the Windows release health page such as [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator), [Helpdesk Administrator](/azure/active-directory/roles/permissions-reference#helpdesk-administrator), and [Service Support Administrator](/azure/active-directory/roles/permissions-reference#service-support-administrator). For more information, see [Assign admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/assign-admin-roles).
> [!NOTE]
-> Currently, Windows release health isn't available for Government Community Cloud (GCC) tenants.
+> Currently, Windows release health is available for Government Community Cloud (GCC) tenants, but isn't available for GCC High and DoD.
## How to review Windows release health information